FTC consumer protection chief Levine sees 'paradigm shift' in US privacy enforcement

Comment: FTC consumer protection chief Levine sees 'paradigm shift' in US privacy enforcement

2 August 2023
By Mike Swift

Since early May, the US Federal Trade Commission has launched unprecedented legal action to block Meta Platforms from monetizing the data of young people, and it has completed the first significant federal privacy enforcement cases against Microsoft and Amazon.

The FTC banned a popular fertility app, Premom, from sharing its users’ data with advertisers. The agency proposed strengthening the Health Breach Notification Rule, a long-neglected privacy enforcement tool that was the basis for the Premom order. It entered an order against education tech provider Edmodo prohibiting it from using children’s data for ads, for the first time alleging an “unfair” business practice as part of a company’s interaction with schools.

The FTC went to court against Amazon, filing suit in Seattle on allegations it used “dark patterns” manipulation to lock consumers into its Prime subscriptions. The FTC issued a warning letter to about 130 hospitals and health care providers about the legal peril they face for allowing online ad tracking software on their apps or websites. It filed an amended complaint against data broker Kochava’s alleged “unfair” collection and sale of location data.

And all the while behind the scenes, the FTC has been in a legal gutter brawl with one of the world’s richest men, Elon Musk, about whether Twitter has violated the terms of a privacy consent order the platform — now renamed X — agreed to last year.

In short, the past 90 days have arguably been among the most consequential three months in US privacy enforcement history, and may someday be seen as a moment of transformation in American data privacy enforcement. Where the FTC is struggling to change the enforcement rules in antitrust, it is breaking through on the privacy and consumer protection side of the house.

“They’re basically on fire,” said David Vladeck, director of the FTC’s Bureau of Consumer Protection from 2009 to 2012. “Putting aside some of the problems the FTC has been facing on the competition side, I think the commission is really humming when it comes to privacy and consumer protection.”

The person most directly at the helm of those changes is Samuel Levine, the current director of the FTC’s Bureau of Consumer Protection. In a recent extended conversation with MLex, Levine detailed what he sees as the result of a two-year shift in how the FTC enforces privacy cases. The regulator is moving away from a strict reliance on the “notice and choice” regime in which US companies typically could use personal data freely for advertising or other purposes, so long as they disclosed those practices and gave consumers the choice to opt out.

“I think what has changed over the last two years is that FTC leadership including the Chair, including myself, including other commissioners, have been very clear and upfront with the public that the notice and choice regime, which has essentially governed US privacy for decades, is failing,” Levine said.

“Early on, we made clear the reasons why: We can't put all the onus on consumers to read these long privacy notices, why choice is often illusory, why consumers can't opt out of the digital economy,” Levine said. “Maybe it made sense two decades ago, but really, this whole framework is built on a fiction. I think that was obvious, maybe, to many people. But I think we were probably the first agency in the federal government to really be clear about saying that.”

Where the FTC has so far run into the brick wall of the federal court system in trying to change the legal standard for antitrust violations, it has obtained privacy settlements such as in the Edmodo case based on its authority to police “unfair” business practices under Section 5 of the FTC Act, and not just deceptive violations of Section 5. US courts have defined “unfair” violations as practices that harm consumers which they could not reasonably avoid, and that have no counterbalancing benefit. It was rarely used by the FTC in the past.

“We called out the problem with the notice and choice regime, and what that led to is a whole paradigm shift in how we think about privacy, and how we think about the responsibilities of companies versus the responsibilities of consumers,” Levine said.

“We’re just getting started,” he added.

No timeline for rulemaking

The outcome of many of the FTC’s voluminous and consequential privacy enforcement cases this spring and summer is still to be written. As it has on the antitrust side, the FTC will no doubt lose some of its court challenges on privacy. Even backers such as Vladeck acknowledge that the FTC’s aggressive move against Meta’s monetization of teenagers’ data, on claims that the former Facebook violated the terms of its $5 billion 2020 privacy settlement with the FTC, will be “a heavy lift.”

Amazon is poised to fight the FTC’s dark patterns allegations over Prime with everything it has. The e-commerce giant has already hired three law firms — Covington & Burling, Davis Wright Tremaine, and Hueston Hennigan — to defend itself in that case. Meta has already moved to block the FTC’s bid to limit its monetization of teens’ data, asking a federal judge in Washington, DC, to find that the FTC is using the wrong court for that action.

The FTC has so far failed to propose a single rule in the “commercial surveillance” rulemaking process it launched a year ago, and Levine offered no promise that there will be one soon.

“It won't surprise you that I can't commit to any timeline, and I can't commit that we will move forward with a rulemaking on privacy and surveillance,” he told MLex.

The FTC has received more than 10,000 comments from the public on the proposed rulemaking, however. “I think what that reflects is that privacy, data security, these are not just concerns among people living in DC. There's broad interest throughout the country in ensuring that people's data is protected,” Levine said.

Levine said the FTC does plan to be a regulatory force on artificial intelligence and is “uniquely positioned” to be the lead US regulator on AI. He said the FTC also plans to aggressively enforce any violation of the new EU-US Data Privacy Network.

One of the most critical needs for protecting US privacy, Levine believes, is national privacy legislation.

"We are falling behind the rest of the world when it comes to protecting Americans' data and I think it's vitally important that we that we catch up." But in the meantime, he said, the FTC is determined to act.

"I really think this is about making sure we are adapting the tools we have, especially Section 5 of the FTC Act, to emerging problems in the economy, rather than just kind of waiting around for Congress to pass legislation," Levine said. "We welcome Congress doing so. We hope they do so soon, but we can't afford to sit on our hands."

'Popular' work

Anyone familiar with the 109-year history of the FTC might wonder whether the FTC’s aggressive stance under Chair Lina Khan will create an echo of the 1970s, when the FTC came under attack for its activist stance in regulating issues such as children’s television ads and was labeled a “national nanny” by the press. The FTC suffered significant staff cuts in the following years under Republican President Ronald Reagan.

Khan recently got a rough ride from Republicans in Congress, who at a hearing July 13 lobbed harsh characterizations of her management, her record in litigation and her “left-wing” policymaking. Levine said, however, that he isn’t worried about the FTC flying too close to the sun and falling back to earth on privacy, in a reprise of the ‘70s.

“One of the things that I've been struck by over the last two years in this job, actually, is how much bipartisan support we've had for our work in the Bureau of Consumer Protection,” Levine said. “You reference some of the noise around the agency and obviously I'm well aware of that. But if you look at the day-to-day work that we're doing, it's overwhelmingly popular with the American people and popular with both parties.”
 
Indeed, Khan and the FTC received praise at the July 13 hearing from conservative Representative Matt Gaetz, a Florida Republican, for its case against Kochava — a company Gaetz called “evil” and “creepy” for tracking places of worship people attend. The FTC has challenged Kochava’s collection of location data as an "unfair" violation of Section 5.

“I really want to encourage your work in this space, and I hope that your litigation against Kochava is something that creates precedent,” Gaetz told Khan. “There’s been criticism of some of your losses in court, but we as sophisticated lawyers know sometimes that a motion to dismiss an initial complaint can create a pathway to an amended complaint to achieve relief.”

Not contrite over lawsuits

Levine said he isn’t inclined to dial back the pressure against tech companies that don’t turn over documents the FTC is seeking in privacy investigations.

In recent months, the FTC concluded enforcement actions that have forced companies to change their personal data practices, including the orders against Premom and Edmodo that block their sharing of personal data for ad purposes. In other cases, such as an order last year against Weight Watchers subsidiary Kurbo, the FTC ordered defendants to destroy personal data or AI algorithms constructed with data the FTC said was collected illegally.

If the FTC is successful in pursuing its claims that Meta violated its 2020 privacy settlement with the agency, it would go even further and block the social media giant’s monetization of personal data from users under age 18 on all its platforms, including Facebook, Instagram, WhatsApp, and Oculus.

“If you look at the orders we've gotten, these are not just, ‘Fix the mistakes you made.’ They're really designed to protect the public going forward and to realign incentives and to prevent recidivism,” Levine said. Those types of aggressive injunctive orders will continue, even as the FTC seeks monetary civil penalties where it can, he said.

The FTC was more likely to negotiate a settlement in the past, but under Khan and Levine it has surprised several tech companies by filing lawsuits in the course of an ongoing investigation. In June, after the FTC sued Amazon over its alleged use of dark patterns, the company complained that the FTC filed suit “without notice to us, in the midst of our discussions with FTC staff members to ensure they understand the facts, context, and legal issues, and before we were able to have a dialogue with the Commissioners themselves before they filed a lawsuit.”

Levine is not contrite about the FTC filing suit if it concludes companies are dragging their feet in responding to its civil investigative demands or other requests for information and documents.

“There's no question that we welcome the opportunity to resolve cases out of court,” he said. “But I think we are also making clear to the marketplace that we are not afraid to take companies to court when we think that's the only way to protect the public, particularly when firms are violating FTC orders, when they're misleading FTC lawyers or investigators, or when they're trying to engage in gamesmanship around tolling agreements or CID production.”

“Most of the time, we can settle cases and that's great, I think, for all involved,” he said. “But when companies are not turning over key information, how can we possibly negotiate a settlement that protects the public when we don't have the information we need about the harms that led to the investigation in the first place?”

For access to our Data Privacy & Security news and analysis in real time, start your free trial today.