FTC Blasts 'Commercial Surveillance Ecosystem,' Calls for New Laws

• by Wendy Davis  @wendyndavis, Yesterday

Large social media companies and streaming video services threaten consumers' privacy by collecting a “staggering” amount of data in order to serve behaviorally targeted ads, the Federal Trade Commission said Thursday in a new staff report.

“The status quo is unacceptable,” Samuel Levine, director of the FTC's consumer protection bureau wrote in a preface to a critical new report, “A Look Behind the Screens: Examining the Data Practices of Social Media and Video Streaming Services.”

“The report leaves no doubt that without significant action, the commercial surveillance ecosystem will only get worse,” Levine added. “Our privacy cannot be the price we pay to accomplish ordinary basic daily activities, and responsible data practices should not put a business at a competitive disadvantage.”

FTC Chair Lina Khan added that the report shows how tech companies “harvest an enormous amount of Americans’ personal data and monetize it to the tune of billions of dollars a year.”

“While lucrative for the companies, these surveillance practices can endanger people’s privacy, threaten their freedoms, and expose them to a host of harms, from identify theft to stalking,” Khan stated.

The report, unanimously approved Thursday by the FTC, grew out of an investigation launched in December 2020, when the agency sought detailed information from Meta, Amazon, Twitter, YouTube, TikTok, Discord, Reddit and Snap about their data gathering and ad targeting practices.

The amount of data the companies collect is “simply staggering,” Levine wrote.

“They track what we read, what websites we visit, whether we are married and have children, our educational level and income bracket, our location, our purchasing habits, our personal interests, and in some cases even our health conditions and religious faith,” Levine continued.

He added that the companies amassed so much information that they often couldn't answer questions about all the “data points” that were collected, or the third parties that received the information.

The report recommends both that Congress enact new privacy laws, and that tech companies minimize the amount of data they collect and share.

"Self-regulation is not the answer and federal legislation is necessary to ensure that the companies protect consumers’ privacy," the report states. 

The FTC said legislation should include “default safeguards against the over-collection, monetization, disclosure, or undue retention of personal data."

“Users should be able to proactively choose whether they do or do not wish to be tracked, and they should be able to make this choice freely, rather than under conditions that restrict their autonomy,” the FTC added.

The ad industry's current self-regulatory standards generally call for companies to notify people about the collection of cross-site data, and allow them to opt out of receiving behaviorally targeted ads. (The standards also call for companies to obtain consumers' explicit consent to the collection of certain sensitive data.)

In addition to calls for legislation, the report also urges social and streaming platforms to avoid using “privacy-invasive tracking technologies” like pixels to collect sensitive information from consumers. The report doesn't define all types of “sensitive” information, but suggests the term includes demographic categories such as race, religion, sexual orientation, and political affiliation.

Khan specifically singled out online behavioral advertising as the driving force behind current practices.

“Marketers have always sought to reach their desired audience, but digitization enabled an unprecedented degree of behavioral targeting,” she stated Thursday. “This newfound ability to monetize people’s behavior, activity, and characteristics helped drive the creation of a multi-billion dollar industry specializing in tracking and collecting vast amounts of Americans’ personal data.”

The report itself asserts that targeted advertising “can pose serious privacy risks to consumers.”

“Consumers are frequently unaware of the potential downstream uses -- including the sale to third parties of location data that may be used to identify consumers and their visits to sensitive locations, such as houses of worship and doctors’ offices -- of the immense amounts of data collected about them,” the report states.

The authors add that targeting based on “sensitive categories” of data “can be extremely harmful to consumers and cause a wide range of injuries to users” -- including discrimination, embarrassment and harms to reputations.

“Targeted ads based on knowledge about protected categories can be especially distressing,” the report says. “One example is when someone has not disclosed their sexual orientation publicly, but an ad assumes their sexual orientation.”

The report also found that most social platforms and streaming services collected the same types of data from teens as from users over 17.

FTC Commissioner Andrew Ferguson, though he approved the report, took issue with its criticism of targeted advertising.

“I do not share the report’s apparent view that the display of targeted advertising to adults is, on balance, harmful,” he stated Thursday, adding that targeted advertising to children and teens “is another matter entirely.”

Association of National Advertisers' CEO Bob Liodice criticized the report as “sensationalist.”

"Rather than simply throwing out the baby with the bathwater, this FTC report decides to tear down the entire house with a sensationalist report that claims that the theoretical harms of data use outweigh all the staggering benefits of the digital economy to individuals and businesses,” he stated.

"Interest-based advertising is the economic engine that funds free and low-cost services to millions of Americans through the digital apps, online services, news publishers, and websites they love.” Liodice added.

Interactive Advertising Bureau CEO David Cohen stated that the organization was “disappointed with the FTC’s continued characterization of the digital advertising industry as engaged in ‘mass commercial surveillance.'”

He added that the organization supports a national data privacy law.

“Congress, rather than a federal agency, should balance consumers' privacy rights, competition and the value exchange between consumers and publishers,” he stated.

Lou Mastria, CEO and president of the self-regulatory group Digital Advertising Alliance, responded to the report by touting the industry's AdChoices program, which uses a clickable icon to notify consumers about online behavioral advertising and take them to sites that offer opt-out links.

He stated that self-regulatory initiatives like AdChoices "have provided ubiquitous real-time access to information and choices around interest-based advertising across millions of web pages and billions of ads."

The advocacy group Consumer Reports, which has supported strong state privacy laws, called the FTC's findings “alarming but not surprising.”

“We need to rein in the rampant overcollection and misuse of consumer data by making strong data minimization protections the default and ensuring companies are held accountable when they violate the trust of consumers,” Justin Brookman, the organization's director of technology policy, stated Thursday.