Angwin: Biden’s executive order has created a lot of excitement about what the administration intends in terms of promoting competition and protecting privacy. Can you give a sense of what the order is seeking to do and how you view it as a signal of where they’re going?
Hartzog: This is an attempt to lay out a vision by the administration that tethers privacy and consumer data collection with questions of corporate power and competition.
It makes sense, given [FTC chairwoman] Lina Khan’s antitrust background and scholarship
, which tends to equate questions about personal data with questions of power, which, from an antitrust scholar’s perspective, involves questions about competition.
I see this as a way for the administration to make a clear theoretical separation from the early internet days when the FTC was largely concerned with notice and choice and transparency. This order clearly seems to want to move beyond that and has language specifically addressed towards these larger questions of how data, surveillance, and other affordances of technologies grant power to businesses.
: The tech piece of the order relies heavily on the FTC’s unfairness authority
. Can you walk us through the history of this authority, how it’s been used, and how it’s been constrained?
Hartzog: The FTC’s original charge with respect to consumer protection essentially boils down to a prohibition on deceptive and unfair trade practices: “Do not lie and ultimately do not harm.”
But it wasn’t always clear what an unfair trade practice was. For a long time an unfair trade practice in theory could be anything that violated established public policy, which is a broad potential swath of activities, which of course is useful for the agency when they started investigating things, because all sorts of things could potentially be unfair practices.
Then in the late 1970s, the FTC began to be concerned about the role of children’s advertising on television. The FTC wanted to consider certain ads targeting children as potentially unfair given the vulnerable state of kids. That created a massive uproar that’s known as the KidVid episode among the people that were there at the time, and even today it still resonates.
There was pushback from Congress when it became clear that the FTC was investigating these companies advertising sugary products to children on Saturday-morning cartoons. The FTC and Congress began to clarify exactly what unfairness meant, and over time it became clear that unfairness was essentially a do no harm rule. It wasn’t just anything that violates public policy.
That dramatically limits what potentially is an unfair trade practice. And yet it still is remarkably broad. What constitutes harm is really open to debate.
The executive order speaks in relatively broad strokes about unfair data collection, about the kind of data collection that jeopardizes consumer choices and consumer privacy, and all of that I think is worth looking into. I think that it’s worth exploring.
Angwin: I’m constantly hearing that the FTC doesn’t have the authority to do the kind of aggressive rulemaking that it wants to do. To get the world that you’re envisioning, would Congress need to give them more authority?
Hartzog: The end answer is probably yes. If you were to ask Chairwoman Khan and the members of the Biden administration that are pushing this forward whether they ultimately need congressional support and reform of the FTC Act in order to do what they want to do, they would probably say yes. While the FTC does have the ability to make rules around consumer privacy, it’s really hard and laborious.
But the broader question is whether congressional intervention is going to be needed to change the entire mission of the FTC in a way that will respond to modern privacy problems presented by gigantic tech companies. What I mean by that is that, even if the FTC is given rulemaking authority to prohibit unfair trade practices in a particular area—say the collection of sensitive data or engaging in dark patterns or not having good data security, all of which has been explored as an area for rulemaking—an individual-level focus on consumer interaction in the marketplace might not be the right frame to respond to the massive power of these tech companies.
Without the ability to look at collective harms or more ethereal harms that are hard to articulate on an individual basis but become clear when you see them at the population level—things like the inability to move about from place to place without all of your movements being monitored and recorded and the chilling effects and potential deprivation of opportunities that come with things like biometric surveillance—that’s not something that manifests easily within unfairness authority because unfairness law demands an individual consumer injury. But so many modern privacy harms are only present when you have a wide-angle lens instead of a very narrow focus.
Angwin: So what should a layperson expect who is reading the executive order, hoping that they will immediately see action against unfair practices by the tech platforms?
Hartzog: I think starting tomorrow we’re going to see the FTC proceeding along two fronts. The first front will be the FTC looking to initiate rulemaking proceedings on the things articulated in the executive order. I’m particularly looking at what constitutes unfair data collection and threats to consumer privacy.
That will be very exciting because that could be a revolutionary new privacy agenda that incorporates the best aspects of data protection laws from the EU, along with protections inherent in all sorts of other relationships, like the information fiduciaries concept, and rules of trust and loyalty and these questions of design and prohibitions on dark patterns. It could be a really comprehensive, robust set of rules. Or, it could end up being U.S. GDPR
. Which is—no knock on the GDPR—but it’s probably not sufficient to meaningfully respond to the threats posed by the major technology companies and practices of our day.
But I also anticipate, at the same time, the FTC will be mindful of the executive order when they are scrutinizing potential unfair and deceptive practices under the FTC Act, because there’s a lot that has been able to fit into that box.
Arguably the FTC has been pretty conservative traditionally in articulating what constitutes a deceptive or unfair trade practice. Particularly at the beginning when it was policing internet privacy, it largely stuck with the slam dunk cases—the stuff where someone outright lied about some privacy-related promise or lied about their identity to collect information, or had catastrophically bad data security practices, such that a student in Security 101 would look at what the company was doing and say, “Yeah, that’s not good.”
They’ve played it relatively safe, all with KidVid in the back of their mind, of course, because the threat from Congress has always been implicitly, if not explicitly: “If you get too creative with unfairness authority, we will defund you.”
This executive order might put the wind in the sails of the Federal Trade Commission in terms of taking its unfairness authority out for a spin.
Angwin: So just to try to summarize, it seems like the FTC, as currently operating and conceived, lacks key weapons that it needs if it’s really going to fight the battle that the Biden administration has sent them off to fight? Is that correct?
Hartzog: Yes, the FTC does so many things well, but it is not yet a fully functioning, fully realized tech enforcement authority. It still doesn’t have all of the necessary tools, clearly articulated powers, and insulation from political blowback that it needs.
But this executive order strikes me as an important step in reframing how the FTC views consumer privacy issues, which can help set enforcement actions and rulemaking in the future, and, at the very least, highlights what is necessary if the FTC is going to be a meaningful enforcer. But we’re not there yet.
In other words, the executive order is great, but not enough. This is just like slapping a horse on the rear and saying, “Go get ’em.”