President Biden’s Antitrust Order May Affect Data Privacy

UPDATE: On August 11, 2022, the FTC issued an Advanced Notice of Proposed Rulemaking (“ANPR”) addressing the issues discussed below. The ANPR can be found here.

On July 9, 2021 President Biden signed an Executive Order that focused on antitrust enforcement but will directly affect the data privacy sector. Most reports regarding the Executive Order focus on its effect on traditional antitrust law and enforcement, but the Order also aims “to enforce the antitrust laws to meet the challenges posed by new industries and technologies, including the rise of the dominant Internet platforms, especially as they stem from . . . the aggregation of data, unfair competition in attention markets, [and] the surveillance of users . . . .” The Order urges the Federal Trade Commission (FTC) to exercise its rulemaking authority to “address persistent and recurrent practices that inhibit competition . . . in areas such as: (i) unfair data collection and surveillance practices that may damage competition, consumer autonomy, and consumer privacy . . . .”

The FTC shares antitrust enforcement responsibility with the Department of Justice, and it acts as the lead federal enforcement agency with respect to privacy and data security. Thus, the Order places substantial responsibility for its implementation in the FTC’s hands.

In this light, Biden’s appointment of former Columbia Law professor Lina Khan as FTC Chair takes on new significance. Before her appointment, Khan gained prominence calling for aggressive antitrust enforcement against big companies. Khan’s appointment as FTC Chair may signal that the agency will view data privacy through the lens of antitrust law or use antitrust laws to regulate the data privacy arena — or combine both approaches.

Either way, the FTC’s privacy regulation will become more aggressive. The same day Biden signed the Order, Khan and Antitrust Division Acting Assistant Attorney General Richard A. Powers issued a joint statement announcing their plan “to jointly launch a review of our merger guidelines with the goal of updating them to reflect a rigorous analytical approach consistent with applicable law.” Observers of antitrust and privacy law have recently noticed a confluence of the two areas, but Biden’s Order and this cooperation between the FTC and DOJ’s antitrust division will hasten their convergence.

Before Khan’s arrival in June, the FTC’s efforts in the privacy sector focused on inadequate data security, sharing of customers’ information without consent, and occasionally, data collection that violated the Children’s Online Privacy Protection Act of 1998. Biden’s Order urges the agency to expand its regulatory efforts to other data privacy areas. I expect these areas will include:

• Facial recognition regulation

• Social media data collection

• Attention markets, and

• User surveillance, or online tracking

FTC’s potential role in these areas is discussed below.

Facial Recognition Regulation

Facial recognition is a hot-button issue right now. On July 13, the U.S. House of Representatives held a hearing on law enforcement’s controversial use of facial recognition, which followed last month’s General Accounting Office report criticizing the federal government’s use of facial recognition and last year’s legislative proposal to ban it altogether. Aside from legislative pressure, facial recognition technology has also attracted expensive lawsuits, such as Facebook’s $650 million settlement for allegedly misusing the technology.

The FTC is no stranger to this battle, having involved itself in the facial recognition field nearly a decade ago. In May, the agency reached its first facial recognition settlement with Ever for allegedly enabling its online photo app, Everalbum, to use facial recognition technology on its users without their permission.

Given this heightened legislative pressure regarding facial recognition and the FTC’s established involvement in the technology, the agency will almost certainly begin regulating facial recognition more actively. The FTC has only begun using its enforcement powers in this area, but with President Biden’s encouragement, the FTC could soon buttress its enforcement efforts with rulemaking.

Social Media Data Collection

President Biden’s Order will likely boost the FTC’s scrutiny of social media companies. The FTC already has Facebook in its sights. The agency has sued the company in a recently dismissed antitrust lawsuit, and in December 2020, the agency ordered Facebook and other social companies to provide data on how they collect, use, and present personal information. Facebook and other social media companies also face congressional inquiries about their antitrust compliance. If that were not enough, Biden’s Order explicitly calls out “dominant Internet platforms” and their “aggregation of data” — an unambiguous reference to Facebook, Twitter, and other large social media companies.

Together, these facts signal that the FTC will not only continue, but intensify its investigation of social media and its data collection efforts. Moreover, given Congress’s inability or unwillingness to pass federal privacy legislation, the FTC or another agency may consider using its rulemaking authority to fill the legislative gap.

Attention Markets

In the “attention market,” consumers pay attention to entertaining or informative content, and social media delivers that attention to advertisers for a price. Former Columbia Law professor Tim Wu has written extensively about the attention market and a concept he called “attention theft” — when companies “seize our time and attention for absolutely nothing in exchange, and indeed, without consent at all.” Recently, courts and officials have concluded that antitrust law governs or should govern attention market activity — particularly where consumers have no protection against sophisticated psychological engineering techniques that subtly draw and retain their attention without their conscious awareness.

Wu is now Biden’s Special Assistant on Technology and Competition Policy, and he was reportedly a “key architect” of Biden’s Order. So the Order’s mention of “attention markets” was more than just a passing note. The administration, including the FTC, will likely focus on attention markets and their anticompetitive effects going forward. UPDATE: On January 2, 2023, Tim Wu announced his departure from the White House and return to Columbia Law School. How his departure will affect the Biden administration’s focus on attention markets will be seen soon enough.

Besides antitrust implications, attention markets also implicate data security. Social media — included in Wu’s definition of “attention merchants” — relies on users to share their information, but data security concerns make consumers hesitant to do so. Data security may offer “attention merchants” a business advantage, but as the recent Facebook data breach shows, this advantage is more aspirational than actual.

The FTC has long pursued enforcement actions against companies that have, in its view “violated consumers’ privacy rights, or misled them by failing to maintain security for sensitive consumer information . . . .” The Order signals that this pursuit will continue into the attention markets.

User Activity Monitoring

The Order mentions “the surveillance of users,” a reference to user activity monitoring or online tracking. The FTC has issued guidance for consumers with respect to activity monitoring, but it only occasionally took action, with perhaps its highest profile action coming in its 2012 administrative action against MySpace. The FTC’s January 2017 report on cross-device tracking urged the industry to regulate its own user surveillance but made no mention of government regulation.

The July 9 Order could change that. The FTC may take a harder look at online tracking to determine whether that tracking is unfair within the meaning of the Federal Trade Commission Act. With the president’s encouragement, the FTC and other agencies may start using their statutory rulemaking powers to regulate online user surveillance. In the EU, the ePrivacy Directive, i.e., the “Cookie Law,” only allows online tracking if the user consents to it. Federal regulators may adopt or build upon this rule.

Conclusion

Most observers have focused on the July 9 Order’s antitrust implications, but its privacy implications also deserve attention. In the coming months, expect action from the federal government generally — and the FTC specifically — with regard to various hot-button privacy issues. Companies involved in any of these fields should prepare themselves for increased regulation through enforcement actions and rulemaking.

Sean Griffin is an attorney and certified cybersecurity expert (CIPP-US) who advises clients on cybersecurity and litigates cybersecurity/privacy cases in Virginia, Maryland, and the District of Columbia. You can reach him via email at sgriffin@dykema.com or by phone at (202) 906-8703.