The Federal Trade Commission has been eating its Wheaties.
Although a judge in Idaho just dismissed the commission’s privacy case against Kochava, you can bet your booties the FTC is going to refile.
And, rather more dramatically, the FTC is proposing a series of modifications to its 2020 post-Cambridge Analytica consent decree with Facebook (from the pre-Meta days) that would have a tremendous impact on how the company does business – including a “blanket prohibition” against monetizing the data of children under 18 across all of Meta’s services.
Specifically, Meta is accused of (deep breath) violating its 2020 consent order with the FTC, misleading parents about their ability to control who their children can communicate with through the Messenger Kids app and misrepresenting the access it gave certain app developers to private user data.
An independent assessor tasked with reviewing whether Meta’s privacy program satisfies the requirements of the 2020 order also identified “several gaps and weaknesses” in the program, although most of the details have been redacted.
If the FTC is successful in its bid to modify the 2020 consent order, Meta would be barred from releasing new or updating existing products, services or features without first getting written confirmation from the assessor that its privacy program is “in full compliance” with the order.
Yes, but …
Meta, of course, denies the allegations.
Andy Stone, Meta’s director of policy communications, was rather huffy in his response, calling the FTC’s actions “a political stunt” as part of an effort to “usurp the authority of Congress” by singling out “one American company while allowing Chinese companies, like TikTok, to operate without constraint on American soil.”
A few points worth considering, however:
1. I’m no apologist for TikTok, but the company (then known as Musica.ly) has been under an FTC consent decree since 2019 after paying $5.7 million to settle allegations that it illegally collected the personal information of children.
2. This isn’t the first FTC consent decree that Facebook/Meta has been accused of violating. Facebook was also found to be in violation of a 2012 consent order barring the company from misrepresenting its privacy practices.
3. One would be forgiven for wondering whether a prohibition against monetizing the data of users under 18 will become a moot point soon enough. Meta itself acknowledges that “most young adults perceive Facebook as a place for people in their 40s and 50s.” Oof.
Settling in
There are legitimate questions as to whether the FTC is overreaching.
An op-ed published by The Wall Street’s editorial board, which is known for expressing strongly conservative views, suggests that Chair Lina Khan is zeroing in on Meta because a court recently rejected her attempt to block its acquisition of VR startup Within. So, sour grapes, basically.
And although the FTC voted 3-0 to approve the move to hold Meta’s feet to the fire, Commissioner Alvaro Bedoya released a brief statement questioning whether the commission truly has the authority to modify a consent order in this case.
But the FTC’s proposal to curtail Meta’s use of children’s data is “just one of many instances of a growing trend to push regulation that’s focused on minors,” said Heather Federman, chief privacy officer at data governance and security startup BigID.
Utah, for example, now restricts social media use for minors, Federman said, and requires people to prove they’re 18 or older before accessing a pornography site.
“Children’s privacy is considered a heightened area of interest,” she said, “and as the US traditionally takes a ‘sectoral approach’ to regulation, this may be one way to bite at the privacy apple.”
And when a federal agency like the current FTC wants to force change, it’s not surprising to see it push the envelope to try and get advantageous settlements, said Jules Polonetsky, CEO of the Future of Privacy Forum, speaking at a tech law event in early May hosted by Frankfurt Kurnit Klein & Selz in New York City.
Considering the FTC’s very public ambition to crack down on what it refers to as “commercial surveillance and lax data security practices,” it would be naive to expect anything else.
“The FTC will continue doing what it wants to do, which is to change the dynamic and talk about commercial uses of data,” Polonetsky said. “The idea is that you settle, and within a couple of years you’ve actually been able to add some new requirements.”
As ever, please feel free to let me know what you think (about this newsletter and about this cat video)! Drop me a line at allison@adexchanger.com.
