Comparing Regulatory Responses to Privacy Threats in Digital Markets

By Madalyn Grace*

PDF Available

On October 12, leaders from the Federal Trade Commission (“FTC”) and Department of Justice (“DOJ”) participated in a G7 Joint Competition Policy Makers & Enforcers Summit to discuss competition policy and enforcement in digital markets.^[1] Digital markets challenge the efficacy of existing competition law in nearly every jurisdiction: regulators of the world’s largest economies agree some form of ex-ante regulation is necessary to address the insufficient effectiveness and timeliness of ex-post remedies, especially concerning data privacy.^[2]

Several participants shared how they are improving their ability to respond to consumer privacy threats posed by Big Tech.^[3] For example, to increase competition in digital markets while protecting consumers, the European Union published the Digital Markets Act (“DMA”) on October 12, 2022.^[4] The DMA allows regulators to issue prescriptive rules applicable to digital gatekeepers identified by monthly active users, capitalization, and other indicia.^[5] Once implemented, these self-executing rules may help the EU avoid lengthy lawsuits.^[6]

Using a different approach to ex-ante rulemaking, the United Kingdom established the Digital Markets Unit (“DMU”) within its competition agency; with future legislation it will “pro-actively shape the behavior of digital firms with significant and far-reaching market power, by making clear how they are expected to behave.”^[7] The reform would allow conduct requirements for firms with Strategic Market Status, or “substantial, entrenched market power in at least one digital activity, providing the firm with a strategic position.”^[8] Therefore, it may enforce further requirements on such companies’ use of data.^[9]

Although several states have specific privacy laws, and five comprehensive state consumer privacy laws take effect in 2023,^[10] the United States has not yet passed comprehensive privacy legislation at the federal level. The FTC has recently sought to fill this void and clarify its authority through adjudication and ex-ante rulemaking. As the agency relayed at the Summit, “The FTC seeks to improve coordination across competition, consumer protection, and privacy activities and apply an integrated approach to the agency’s cases, rules, research, and other policy tools. This may help identify interconnections between the conditions that give rise to competition and consumer protection violations. … For example, as alleged in the FTC’s amended complaint against Facebook, increased concentration in a market may lead to lower levels of service quality in areas such as privacy and data protection.”^[11]

First, the FTC is attempting to use its authority over Unfair or Deceptive Acts and Practices (“UDAP”) under Section 5 of the FTC Act of 1914 (“FTC Act”) to sue Kochava, a company that allegedly sold sensitive consumer data without first anonymizing it, allowing the purchaser to track the movements of mobile device users.^[12] However, per West Virginia v. EPA, the FTC must demonstrate a “clear congressional authorization” for the power it claims.^[13] This raises the question whether the FTC can impose a condition on the sale of sensitive consumer information when it does not enforce a federal law expressly providing for the requirement.^[14] Considering the Children’s Online Privacy Protection Act of 1998 (“COPPA”) narrowly applies to children under thirteen,^[15] and the FTC Act did not contemplate privacy, the FTC’s efforts may be unappreciated by the current Court.

More notably, the FTC is exercising its rulemaking authority under Section 18 of the FTC Act via Advance Notice of Proposed Rulemaking (“ANPR”) regarding commercial surveillance and lax data privacy practices.^[16] The agency has not yet announced its proposed rules, but it is currently seeking input regarding the business of collecting, analyzing, and profiting from consumer information.^[17] The proposed rules may introduce substantive limits on the use and collection of data to replace the dominant “notice and consent” privacy paradigm.^[18]

FTC rulemaking offers numerous advantages over attempting to litigate consumer privacy standards into existence. Although rulemaking is a slow process, the FTC can implement rules addressing topics beyond the narrow question at issue in typical competition suits, which may render an outdated holding by the time a final judgment is entered.^[19] Second, the FTC generally cannot seek financial penalties for first-time violations of the FTC Act, and trade regulation rules may more effectively deter unlawful conduct because they do not carry the same limitation.^[20] Finally, the ANPR process invites greater public participation, especially considering the notice and comment period in this instance has been extended to November 21, 2022.^[21]

The FTC may issue both procedural and substantive rules “for the purpose of carrying out the [FTC Act’s] provisions,”^[22] and it has previously used its UDAP authority to create several consumer protection rules where it has congressional authorization to regulate certain industries.^[23] However, in the century since its inception, it has never exercised its authority over Unfair Methods of Competition (“UMC”) to create consumer privacy rules, and it has not enforced the one antitrust rule it promulgated.^[24]

Through one or both of these mandates, the FTC may be capable of addressing privacy challenges in digital markets like comparable agencies in the EU and UK, but it faces significant adversity from the courts. Ironically, a letter from President Eisenhower suggests a major appeal of delegating responsibility to a federal agency was that federal courts would have less discretion over novel antitrust issues,^[25] yet the FTC may end up litigating the question of whether it should be cabined to the role of a law enforcement agency or if it can fill the privacy void in federal law.

---

* J.D. Candidate, Class of 2024, Sandra Day O’Connor College of Law at Arizona State University.

[1] Press Release, Fed. Trade Comm’n, Federal Trade Commission and Justice Department Meet With Fellow G7 Enforcement Partners on Competition in Digital Markets (Oct. 12, 2022), https://www.ftc.gov/news-events/news/press-releases/2022/10/federal-trade-commission-justice-department-meet-fellow-g7-enforcement-partners-competition-digital-markets.

[2] OECD, EXECUTIVE SUMMARY OF THE HEARING ON EX ANTE REGULATION AND COMPETITION IN DIGITAL MARKETS: ANNEX TO THE SUMMARY RECORD OF THE 136TH MEETING OF THE COMPETITION COMMITTEE 3 (2021), https://one.oecd.org/document/DAF/COMP/M(2021)2/ANN4/FINAL/en/pdf.

[3] See generally G7 JOINT COMPETITION POL’Y MAKERS & ENFORCERS SUMMIT, COMPENDIUM OF APPROACHES TO IMPROVING COMPETITION IN DIGITAL MARKETS (2022), https://www.bundeskartellamt.de/SharedDocs/Publikation/EN/Others/G7_Compendium.pdf?__blo b=publicationFile&v=4.

[4] Francesco Liberatore, DMA: EU Publishes the New Digital Markets Act, NAT’L L. REV., (Oct. 13, 2022), https://www.natlawreview.com/article/dma-eu-publishes-new-digital-markets-act.

[5] Aline Blankertz, The EU’s Experimental Approach in Overhauling Competition Rules, BROOKINGS INST. (Apr. 14, 2022), https://www.brookings.edu/techstream/the-eus-experimental-approach-in-overhauling-competition-rules-digital-markets-act-dma/.

[6] See id.

[7] DEP’T BUS., ENERGY & INDUS. STRATEGY & DEP’T DIGIT. CULTURE, MEDIA & SPORT, A NEW PRO-COMPETITION REGIME FOR DIGITAL MARKETS, CP 489 (2021), https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment _data/file/1003913/Digital_Competition_Consultation_v2.pdf; see Brad Stone & Jillian Deutsch, CMA’s Hayter Says UK’s Tech Law Enforcement Is ‘Out of Date’, BLOOMBERG (Sept. 28, 2022), https://www.bloomberg.com/news/articles/2022-09-28/cma-s-hayter-says-uk-s-tech-law-enforcement-is-out-of-date.

[8] DEP’T BUS., ENERGY & INDUS. STRATEGY & DEP’T DIGIT. CULTURE, MEDIA & SPORT, supra note 7, at 19.

[9] OECD COMPETITION DIVISION, G7 INVENTORY OF NEW RULES FOR DIGITAL MARKETS 20-21 (2022), https://www.bmwk.de/Redaktion/DE/Downloads/g7-inventory-of-new-rules-for-digital-markets.pdf?__blob=publicationFile&v=6.

[10] FED. TRADE COMM’N, A LOOK AT WHAT ISPS KNOW ABOUT YOU: EXAMINING THE PRIVACY PRACTICES OF SIX MAJOR INTERNET SERVICE PROVIDERS, at 10 (2021), https://www.ftc.gov/system/files/documents/reports/look-what-isps-know-about-you-examining-privacy-practices-six-major-internet-service-providers/p195402_isp_6b_staff_report.pdf; Peter Guffin & Melanie Conroy, As Mass. Punts on Privacy Law, Cos. Can’t Be Complacent, LAW360 (Oct. 11, 2022), https://www.law360.com/articles/1538387/as-mass-punts-on-privacy-law-cos-can-t-be-complacent.

[11] COMPENDIUM, supra note 3, at 85.

[12] 15 U.S.C. § 45(a)(1) (2018); Press Release, Fed. Trade Comm’n, FTC Sues Kochava for Selling Data That Tracks People at Reproductive Health Clinics, Places of Worship, and Other Sensitive Locations, (Aug. 29, 2022), https://www.ftc.gov/news-events/news/press-releases/2022/08/ftc-sues-kochava-selling-data-tracks-people-reproductive-health-clinics-places-worship-other.

[13] W. Va. v. Env’t Prot. Agency, 142 S. Ct. 2587, 2609 (2022).

[14] Esposito et al., FTC Privacy Suit Tests Agency’s Regulatory Authority, LAW360 (Sept. 22, 2022), https://www.law360.com/articles/1532689/ftc-privacy-suit-tests-agency-s-regulatory- authority.

[15] 15 U.S.C. §§ 6501–6506 (2012).

[16] Press Release, Fed. Trade Comm’n, FTC Explores New Rules Cracking Down on Commercial Surveillance and Lax Data Security Practices (Aug. 11, 2022), https://www.ftc.gov /news-events/news/press-releases/2022/08/ftc-explores-rules-cracking-down-commercial- surveillance-lax-data-security-practices; Lesli Esposito et al., FTC Privacy Suit Tests Agency’s Regulatory Authority, LAW360 (Sept. 22, 2022), https://www.law360.com/articles/1532689/ftc- privacy-suit-tests-agency-s-regulatory-authority.

[17] Chair Lina Khan, Fed. Trade Comm’n, Remarks as Prepared for Delivery at the IAPP Global Privacy Summit (Apr. 11, 2022).

[18] Id.

[19] See Rohit Chopra & Lina M. Khan, The Case for “Unfair Methods of Competition” Rulemaking, 87 U. CHI. L. REV. 357, 362 (2020).

[20] Fed. Trade Comm’n, supra note 16.

[21] Id.; Press Release, Fed. Trade Comm’n, FTC Extends Comment Deadline on Commercial Surveillance, Lax Data Security Practices Initiative Exploring Possible Rules (Oct. 14, 2022), https://www.ftc.gov/news-events/news/press-releases/2022/10/ftc-extends-comment-deadline-commercial-surveillance-lax-data-security-practices-initiative.

[22] 15 U.S.C. § 46(g) (2012); Nat’l Petroleum Refiners Ass’n v. FTC, 482 F.2d 672 (D.C. Cir. 1973).

[23] Daniel A. Crane, Debunking Humphrey’s Executor, 83 GEO. WASH. L. REV. 1835, 1861-63 (2015); Telemarketing Sales Rule, 16 C.F.R. § 310.1 (2015) (implementing Telemarketing and Consumer Fraud and Abuse Prevention Act, 15 U.S.C. §§ 6101–6108 (2012)). Children’s Online Privacy Protection Rule, 16 C.F.R. § 312.1 (2015) (implementing Children’s Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6501–6506 (2012)).

[24] Crane, supra note 23, at 1861; FTC Men’s and Boy’s Tailored Clothing Rule, 16 C.F.R. § 412 (1968); Notice of Rule Repeal, 59 Fed. Reg. 8527 (1994).

[25] Id. at 1859; See President Woodrow Wilson, Address to a Joint Session of Congress on Trusts and Monopolies (Jan. 20, 1914) (transcript available at the American Presidency Project website, https://www.presidency.ucsb.edu/documents/address-joint-session-congress-trusts-and-monopolies).