Fine Print for Every Price: The FTC’s One-Size-Fits-All Guidance
My first post at Truth on the Market—where I called myself a “Refugee from the FTC”—briefly discussed an advance notice of proposed rulemaking (ANPR) published in the Federal Register by the Federal Trade Commission (FTC) under Chair Lina Khan. This one bore the expansive title “Trade Regulation Rule on Commercial Surveillance and Data Security.”
I had more to say in a later post. I also joined my colleagues Geoffrey Manne and Kristian Stout in submitting more detailed and careful comments to the public record on behalf of the International Center for Law & Economics (ICLE). While they were more detailed and careful, those comments were no more enthusiastic. The same description fits the joint comments filed by George Mason University’s Program on Economics and Privacy and the Tech Law Program at the University of Arizona’s James E. Rogers College of Law.
We were hardly alone. Many outside the agency were surprised—if not alarmed—by the ANPR’s sweeping scope, lack of substantive clarity, and general hostility toward the digital economy. Critics included Alden Abbott, a former FTC general counsel; Jonathan Barnett of the University of Southern California; and Svetlana Gans and Natalie J. Hausknecht, writing jointly. Gans previously served as FTC chief of staff.
The concerns reached inside FTC headquarters as well. Commissioners Noah Joshua Phillips and Christine Wilson each vigorously dissented from the vote to issue the ANPR. Phillips objected, inter alia:
The Commercial Surveillance and Data Security advance notice of proposed rulemaking (“ANPR”) issued today by a majority of commissioners provides no notice whatsoever of the scope and parameters of what rule or rules might follow; thereby, undermining the public input and congressional notification processes. It is the wrong approach to rulemaking for privacy and data protection security.
What the ANPR does accomplish is to recast the Commission as a legislature, with virtually limitless rulemaking authority where personal data are concerned. It contemplates banning or regulating conduct the Commission has never once identified as unfair or deceptive. That is a dramatic departure even from recent Commission rulemaking practice. The ANPR also contemplates taking the agency outside its bailiwick. At the same time, the ANPR virtually ignores the privacy and data security concerns that have animated our enforcement regime for decades. A cavalcade of regulations may be on the way, but their number and substance are a mystery.
No notice of proposed rulemaking followed, and neither did a final rule. That was, in my view, the best possible outcome given the ANPR. If the agency had to begin a rulemaking, a more sober and restrained ANPR would have been better—one that recognized the information economy’s consumer benefits alongside its risks and avoided the skewed assumptions and loaded language of Shoshana Zuboff’s anti-tech polemic on “surveillance capitalism.” Better still would have been greater regulatory restraint from the start.