Internet Privacy: Additional Federal Authority Could Enhance Consumer Protection and Provide Flexibility

In April 2018, Facebook disclosed that a Cambridge University researcher may have improperly shared the data of up to 87 million of its users with a political consulting firm. This disclosure followed other recent incidents involving the misuse of consumers' personal information from the Internet, which is used by about three-quarters of Americans. GAO was asked to review federal oversight of Internet privacy. This report addresses, among other objectives: (1) how FTC and FCC have overseen consumers' Internet privacy and (2) selected stakeholders' views on the strengths and limitations of how Internet privacy currently is overseen and how, if it all, this approach could be enhanced.

GAO evaluated FTC and FCC Internet privacy enforcement actions and authorities and interviewed representatives from industry, consumer advocacy groups, and academia; FTC and FCC staff; former FTC and FCC commissioners; and officials from other federal oversight agencies. Industry stakeholders were selected to represent different sectors, and academics were selected because of their expertise in privacy, consumer protection, and regulatory issues.

The United States does not have a comprehensive Internet privacy law governing the collection, use, and sale or other disclosure of consumers' personal information. At the federal level, the Federal Trade Commission (FTC) currently has the lead in overseeing Internet privacy, using its statutory authority under the FTC Act to protect consumers from unfair and deceptive trade practices. However, to date FTC has not issued regulations for Internet privacy other than those protecting financial privacy and the Internet privacy of children, which were required by law. For FTC Act violations, FTC may promulgate regulations but is required to use procedures that differ from traditional notice-and-comment processes and that FTC staff said add time and complexity.

In the last decade, FTC has filed 101 enforcement actions regarding Internet privacy; nearly all actions resulted in settlement agreements requiring action by the companies. In most of these cases, FTC did not levy civil penalties because it lacked such authority for those particular violations. The Federal Communications Commission (FCC) has had a limited role in overseeing Internet privacy. From 2015 to 2017, FCC asserted jurisdiction over the privacy practices of Internet service providers. In 2016, FCC promulgated privacy rules for Internet service providers that Congress later repealed. FTC resumed privacy oversight of Internet service providers in June 2018.

Stakeholders GAO interviewed had varied views on the current Internet privacy enforcement approach and how it could be enhanced. Most Internet industry stakeholders said they favored FTC's current approach—direct enforcement of its unfair and deceptive practices statutory authority, rather than promulgating and enforcing regulations implementing that authority. These stakeholders said that the current approach allows for flexibility and that regulations could hinder innovation. Other stakeholders, including consumer advocates and most former FTC and FCC commissioners GAO interviewed, favored having FTC issue and enforce regulations. Some stakeholders said a new data-protection agency was needed to oversee consumer privacy. Stakeholders identified three main areas in which Internet privacy oversight could be enhanced:

Statute . Some stakeholders told GAO that an overarching Internet privacy statute could enhance consumer protection by clearly articulating to consumers, industry, and agencies what behaviors are prohibited.

Rulemaking . Some stakeholders said that regulations can provide clarity, enforcement fairness, and flexibility. Officials from two other consumer protection agencies said their rulemaking authority assists in their oversight efforts and works together with enforcement actions.

Civil penalty authority. Some stakeholders said FTC's Internet privacy enforcement could be more effective with authority to levy civil penalties for first-time violations of the FTC Act.

Comprehensive Internet privacy legislation that establishes specific standards and includes traditional notice-and-comment rulemaking and broader civil penalty authority could enhance the federal government's ability to protect consumer privacy.

Congress should consider developing comprehensive legislation on Internet privacy that would enhance consumer protections and provide flexibility to address a rapidly evolving Internet environment. Issues that should be considered include what authorities agencies should have in order to oversee Internet privacy, including appropriate rulemaking authority.

In April 2018, Facebook disclosed that a Cambridge University researcher  may have improperly shared the data of up to 87 million of Facebook’s  users with a political consulting firm. This followed other incidents in  recent years involving the misuse of consumers’ personal information  from the Internet, which about three-quarters of Americans use. These  types of incidents raise public concern because people use the Internet  as an essential service for everyday social and economic purposes, and  consumer products are increasingly being connected to the Internet.  These Internet-based services and products often collect and use various  forms of personal information about users, including their location, search  terms, contact information, financial information, and many other forms of  inherently or potentially sensitive details that could cause users harm if  released.

To address such privacy concerns, in May 2018, the European Union  implemented the General Data Protection Regulation, a set of Internet  privacy rules that give consumers control over the collection, use, and  sharing of their personal information. In addition, California passed its  own Internet privacy law in June 2018 that becomes effective in 2020.  The United States does not have a similar comprehensive data privacy  law at the federal level and instead relies in part on an industry-specific  (sectoral) privacy approach. This involves industry-specific laws enforced  by various agencies governing areas such as healthcare and financial  services. In addition, the Federal Trade Commission (FTC) currently has  the lead in overseeing Internet privacy across all industries, with some  exceptions. Specifically, FTC addresses consumer concerns about  Internet privacy using its broad authority under the FTC Act to protect  consumers from unfair and deceptive trade practices. FTC has jurisdiction  over a broad range of entities and activities that are part of the Internet  economy, including websites, applications (apps), advertising networks,  data brokers, device manufacturers, and others. The common carrier  exemption in the FTC Act, however, prohibits FTC from taking action  against common carriers, such as providers of telecommunications  services.

From 2015 to 2017, the Federal Communications Commission (FCC)  classified broadband Internet service as a telecommunications service  and asserted statutory and regulatory authority to address privacy  concerns related to broadband providers of this service, known as  Internet service providers. FCC developed privacy regulations governing  these entities in 2016, but Congress repealed the regulations before they  took effect. In December 2017, FCC reversed its decision to classify  broadband as a telecommunications service, and in June 2018, FTC  resumed privacy oversight of Internet service providers.

You asked us to examine issues related to federal oversight of Internet  privacy. This report discusses:  the benefits and concerns associated with the collection of Internet  users’ personal information for commercial purposes, how FTC and FCC have overseen consumers’ Internet privacy, and  selected stakeholders’ views on the strengths and limitations of how  Internet privacy currently is overseen and how, if it all, this approach  could be enhanced.

To determine what is known about the benefits and concerns associated  with the collection of Internet users’ personal information for commercial  purposes, we reviewed public opinion surveys conducted by the  Commerce Department’s National Telecommunications and Information  Administration (NTIA) in 2017 and the Pew Research Center in 2015 and  2018, prior GAO reports, and other related literature. For this and the other objectives, we interviewed FTC and FCC staff; NTIA officials;  stakeholders from 4 consumer advocacy groups and 4 industry groups; 6  Internet service providers; 6 Internet content providers; and 11  academics about Internet privacy. To obtain a variety of perspectives, we  selected 6 Internet service providers that represented different industry  sectors (i.e., cable, satellite, and telephone-based Internet service) and 6  Internet content providers that provide a variety of information and social  media services. Academic stakeholders were selected because of their  expertise in privacy, consumer protection, and regulatory issues. We  also interviewed a former congressional staff member who has expertise  on privacy issues and is now a consultant. Stakeholders were selected to  represent a range of views, but our interview results are not generalizable  to all stakeholders. Appendix I lists our interviewees.

To address how FTC and FCC have overseen Internet privacy, we  analyzed 101 Internet privacy enforcement actions that FTC filed during  the last 10 years and an FCC Internet privacy case that was brought  during the 2015-2017 period when the agency asserted jurisdiction over  the privacy practices of Internet service providers. We also reviewed  FTC and FCC guidance on Internet privacy and enforcement and a  memorandum of understanding between FTC and FCC regarding Internet  privacy jurisdiction and coordination.

To determine selected stakeholders’ views on the strengths and  limitations of how Internet privacy currently is overseen and to identify  how, if it all, this approach could be enhanced, we reviewed pertinent  literature, the legislative history of FTC’s statutory rulemaking authorities,  and consumer protection statutes and regulations. We also interviewed  the stakeholders identified above and eight former FTC and FCC  commissioners. We selected to interview former FTC and FCC  commissioners who served during the Barack Obama and George W.  Bush administrations and are from different political parties. We also  interviewed officials from other federal agencies that oversee various  industries about the strengths and limitations of their regulatory and  enforcement authorities and approaches. The interviews included officials  from three consumer protection agencies—the Consumer Financial  Protection Bureau (CFPB), the Consumer Product Safety Commission  (CPSC), and the Food and Drug Administration (FDA)—and two worker  protection agencies—the Occupational Safety and Health Administration  (OSHA) and the Equal Employment Opportunity Commission (EEOC).  We selected these agencies because they had consumer- or worker- protection responsibilities. In addition, we compared FTC’s authorities  regarding Internet privacy to characteristics we identified in our prior work  that should be reflected in new regulatory systems and to the Fair  Information Practice Principles, which are a set of internationally  developed voluntary principles for protecting the privacy and security of  personal information.

This report focuses on Internet data privacy, which is affected by the  collection and use of consumers’ personal information such as their  Internet browsing histories, purchases, locations, and travel routes.  Although this report discusses some Internet privacy enforcement actions  that also involved data security issues, for the purposes of this review we  are distinguishing between Internet data privacy and Internet data  security, the latter of which can involve illegal breaches of sensitive  information through hacking.

We conducted semi-structured interviews; not all interviewees were  asked the same questions. Throughout this report, we use certain  qualifiers when describing responses from interview participants, such as  “some,” and “most.” We define “some” as three or more but less than half  and “most” as a majority of all interviewees or a relevant subset of them.

We conducted this performance audit from October 2017 through January  2019 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

To varying extents, Internet content providers—also called “edge  providers”—and Internet service providers collect, use, and share  information from their customers to enable their services, support  advertising, and for other purposes. Many companies describe these and  other privacy-related practices in privacy policies, to which consumers  may be required to consent in order to use the service. Consumers  access such services through a variety of devices, including mobile  phones and tablets, computers, and other devices connected to the  Internet by wired or wireless means.

A nationwide survey that the U.S. Census Bureau conducted for NTIA in  2017 found that 78 percent of Americans ages 3 and older used the  Internet. Another nationwide survey that the Pew Research Center  conducted in 2018 found that 69 percent of American adults reported that  they use some kind of social media platform such as Facebook.

No comprehensive federal privacy law governs the collection, use, and  sale or other disclosure of personal information by private-sector  companies in the United States. Rather, the federal privacy framework for  private-sector companies is comprised partly of a set of tailored laws that  govern the use and protection of personal information for specific  purposes, in certain situations, or by certain sectors or types of entities.  These laws include the Fair Credit Reporting Act, which protects the  security and confidentiality of personal information collected or used to  help make decisions about individuals’ eligibility for such products as  credit or for insurance or employment; the Gramm-Leach-Bliley Act,  which protects nonpublic personal information that individuals provide to  financial institutions or that such institutions maintain; and the Health  Insurance Portability and Accountability Act which establishes a set of  national standards for the protection of certain health information. In  addition, as detailed in this report, FTC addresses consumer concerns  about Internet privacy using its broad authority to protect consumers from  unfair and deceptive trade practices.

We have reported on a variety of Internet privacy concerns in recent  years that include the collection and use of data such as people’s Internet  browsing histories, purchases, locations, and travel routes, including:  Internet of things: In 2017, we found that as new and more devices  become connected, they increase not only the opportunities for  security and privacy breaches, but also the scale and scope of any  resulting consequences.

Vehicle data privacy: We found in 2017 that most selected  automakers reported limiting their data collection, use, and sharing,  but their written notices did not clearly identify data sharing and use  practices.

Information resellers: In a 2013 report on companies that collect and  resell information on individuals, we found that no overarching federal  privacy law governs the collection and sale of personal information  among private-sector companies, including information resellers.  We found that gaps exist in the federal privacy framework, which does  not fully address changes in technology and the marketplace. Among  the issues we noted were the potential need for changes to privacy  controls for web tracking, mobile devices, and other technologies. We  recommended that Congress consider strengthening the consumer  privacy framework to reflect the effects of changes in technology and  the marketplace. Such legislation has not been enacted to date.

Mobile device location data: In 2012, we found that, according to  privacy advocates, consumers are generally unaware of how their  location data are shared with and used by third parties. We  recommended that FTC consider issuing guidance establishing FTC’s  views regarding mobile companies’ appropriate actions to protect  location data privacy. FTC implemented that recommendation in  2013.

To guide their privacy practices, many organizations and governments  have used the Fair Information Practice Principles. As noted above, these  principles—which are not limited to Internet privacy—address the  collection and use of personal information, data quality and security, and  transparency, among other things, and have served as the basis for many  of the privacy recommendations federal agencies have made. The  Organisation for Economic Co-Operation and Development developed a  version of these principles in 1980 that has been widely adopted and was  updated in 2013. In 2000, FTC recommended that Congress enact a  consumer Internet privacy statute that would require companies to comply  with broad and flexible definitions of the principles, and an FTC  commissioner said in a 2014 speech that they are a solid framework and  are flexible and effective. While they are principles, not legal  requirements, they provide a possible approach for balancing the need for  privacy with other interests. Table 1 provides more detailed information  about the principles.

FTC and FCC Oversight of Internet Privacy

FTC is primarily a law enforcement agency that, among other  responsibilities, currently has the lead in overseeing Internet privacy at  the federal level. Specifically, it addresses consumer concerns about  Internet privacy, both for Internet service providers and content providers,  using its general authority under section 5 of the FTC Act. Section 5, as  amended in 1938, prohibits “unfair or deceptive acts or practices in or  affecting commerce.” Although the FTC Act generally empowers FTC to  take enforcement action, it prohibits FTC from taking action against  common carriers such as telecommunication services, airlines, and  railroads under certain circumstances. FTC also does not have  jurisdiction over banks, credit unions, or savings and loans institutions.

Even though the FTC Act does not speak in explicit terms about  protecting consumer privacy, the Act authorizes such protection to the  extent it involves practices FTC defines as unfair or deceptive. According  to FTC, an act or practice is “unfair” if it causes, or is likely to cause,  substantial injury not reasonably avoidable by consumers and not  outweighed by countervailing benefits to consumers or competition as a  result of the practice. FTC has used this “unfairness” authority to address  situations where a company has allegedly failed to properly protect  consumers’ data. According to FTC, a representation or omission is  “deceptive” if it is material and is likely to mislead consumers acting  reasonably under the circumstances. For example, the omission of terms  in an advertisement would need to be material and likely to mislead  consumers in order to be deceptive. FTC applies this “deceptive”  authority to address deceptions or violations of written privacy policies  and representations concerning data security.

FTC’s Bureau of Consumer Protection investigates Internet privacy  complaints from various sources, including consumers, other agencies,  Congress, and industry, and also initiates investigations on its own. If the  bureau has reason to believe that an entity is engaging in an unfair or  deceptive practice, it may forward an enforcement recommendation to the  commission. The commission then determines whether to pursue an  enforcement action, which can include the following:  litigating commission-filed administrative complaints before an FTC  administrative law judge;  filing and litigating complaints in federal district court seeking  preliminary and permanent injunctions, monetary redress for  consumers or other equitable relief; or  referring complaints seeking civil penalties for violations of rules  authorizing such penalties or for violations of administrative orders to  the Department of Justice (DOJ) and assisting DOJ in litigating those  cases (if DOJ does not take action, FTC can pursue the action on its  own).

FTC’s Internet privacy enforcement cases may be settled without the  imposition of civil penalties. Instead, FTC typically enters into settlement  agreements requiring companies to take actions such as:  implementing reasonable privacy and security programs; being subject to long-term monitoring of compliance with the  settlements by outside entities; providing monetary redress to consumers;  forfeiting any money gained from the unfair or deceptive conduct; deleting illegally obtained consumer information; and providing transparency and choice mechanisms to consumers.

If a company violates an FTC final consent order, the agency can then  request civil monetary penalties in court for the violations. In addition, as  discussed below, FTC can seek to impose civil monetary penalties  directly for violations of certain privacy statutes and regulations such as  the statute pertaining to the Internet privacy of children and its  implementing regulations. Although FTC can levy civil penalties up to  $41,484 per violation, per day, against an entity that violates a trade  regulation rule under the FTC Act, it has not promulgated trade regulation  rules under section 5 specific to privacy.

Although FTC has not implemented its section 5 authority by issuing  regulations regarding Internet privacy, it has issued regulations to  implement other statutory authorities. Likewise, other federal agencies  use regulations to implement the statutes they are charged with  administering. The process by which federal agencies typically develop  and issue regulations is spelled out in the Administrative Procedure Act  (APA). Section 553 of the APA establishes procedures and requirements  for what is known as “informal” rulemaking, also known as notice-and- comment rulemaking. Among other things, section 553 generally  requires agencies to publish a notice of proposed rulemaking in the  Federal Register. After giving interested persons an opportunity to  comment on the proposal by providing “data, views, or arguments,” the  statute then requires the agency to publish the final rule in the Federal  Register. Regulations may be enforced in various ways, for example, by  seeking civil penalties for non-compliance. FTC has authority to seek civil  penalties, for example, when a company knowingly violates a regulation  or, as discussed below, a final consent order.

In contrast to the APA section 553 rulemaking process, the rulemaking  process that FTC generally must follow to issue rules under the FTC Act  is spelled out in the Magnuson-Moss Warranty Act amendments to the  FTC Act (Magnuson-Moss). The Magnuson-Moss amendments— enacted in 1975 partly in response to industry opposition to FTC’s trade  regulations, and amended in 1980—require additional rulemaking steps  beyond APA section 553. For example, Magnuson-Moss requires FTC  to publish an advance notice of proposed rulemaking in addition to the  notice of proposed rulemaking required by the APA, and to offer  interested parties the opportunity for an informal hearing involving oral  testimony. FTC has not promulgated any regulations using the  Magnuson-Moss procedures since 1980; according to FTC staff, the  additional steps required under Magnuson-Moss add time and complexity  to the rulemaking process.

The Children’s Online Privacy Protection Act (COPPA), enacted in 1998,  governs the online collection of personal information from children under  the age of 13 by operators of websites or online services, including  mobile applications. COPPA required FTC to issue and enforce  regulations concerning children’s online privacy and directed FTC to  promulgate these regulations using the APA section 553 notice-and- comment rulemaking process. COPPA contained a number of specific  requirements that FTC was directed to implement by regulation, such as  requiring websites to post a complete privacy policy, to notify parents  directly about their information collection practices, and to obtain  verifiable parental consent before collecting personal information from  their children or sharing it with others. The commission’s original COPPA  regulations became effective on April 21, 2000, and amended COPPA  regulations took effect on July 1, 2013. According to an FTC staff  member, COPPA and FTC’s implementing regulations reflect various  principles that are similar to the Fair Information Practice Principles.

FCC regulates the telecommunications industry pursuant to the  Communications Act of 1934, as amended (Communications Act). FCC  follows the APA section 553 notice-and-comment rulemaking process to  promulgate regulations implementing the Communications Act. FCC also  has an enforcement bureau that pursues violations of its regulations and  the Communications Act.

The Communications Act establishes separate definitions for “information  services” and “telecommunications services” and treats these two types  of services differently. Specifically, information services are subject to  less regulation by FCC than telecommunications services under the  Communications Act. However, FTC is prohibited from regulating  telecommunications carriers (a provider of telecommunications services)  under the common carrier exemption. Prior to 2015, Internet services  were considered information services under the Communications Act, and  thus FTC was not prohibited from considering the privacy practices of  Internet service providers under its FTC Act authority to protect  consumers from unfair and deceptive practices. This changed in 2015  when FCC classified broadband as a telecommunications service, which  meant that broadband Internet service providers were considered  telecommunications carriers and FCC asserted primary oversight over  them. As a result of the reclassification, FTC no longer had jurisdiction  over Internet service providers. Once FCC had asserted primary  oversight over Internet service providers, FCC promulgated privacy  regulations specific to them. However, before the privacy regulations went into effect, Congress repealed them under the Congressional Review  Act. In December 2017, FCC reclassified broadband as an information  service—reverting Internet service providers’ classification to what it had  been prior to 2015. When that reclassification became effective in June  2018, jurisdiction of Internet privacy for Internet service providers was  effectively transferred from FCC back to FTC. As a result, FCC currently  has limited Internet privacy oversight responsibilities, as shown in figure  1.

Stakeholders’ Views Varied on the Benefits and Concerns with Collecting and Using Consumers’ Data from the Internet

Perspectives on the benefits of and concerns about the collection and use  of consumers’ data from the Internet varied somewhat across stakeholder  groups. Various stakeholders we interviewed—including those from  academia, industry, and government—said that there should be a  balance between the freedom of companies to collect and use  consumers’ data needed to provide services and the necessity to protect  consumers’ privacy. In general, industry stakeholders highlighted the  benefits of data collection and use, such as facilitating innovation, while  consumer advocacy groups and other stakeholders emphasized concerns  about consumers’ loss of control over their data and their lack of  understanding of how companies collect and use their information.  Additionally, surveys and other literature that we reviewed on Internet  privacy highlighted concerns among consumers. The key benefits of  information collection were identified as:

Enables certain services. According to two industry stakeholders,  the collection and use of consumer data from the Internet enable  content providers to provide services. These stakeholders said that  sometimes a content provider must collect and use information from  consumers to provide the service. For example, a mapping service  must collect and use consumers’ current location to provide them with  up-to-date directions.

Provides low-cost or free services. A representative from a content  provider said that revenue from targeted advertising helps allow some  content providers’ services to be offered to consumers at little or no  charge. Instead of charging a subscription fee, a social media  company may be able to provide free service because it uses  information that it collects from consumers to target advertisements to  users on a customized, user-by-user basis. These ads are targeted to  users based on interests they express through their use of social  media, among other things. According to a representative from an  Internet search engine, using consumer data for targeted advertising  may be relatively less important for some kinds of content providers,  such as search engines. This company representative said that  search engines may use keywords entered for a particular Internet  search to provide advertisements relevant to the search. For example,  a search for “car insurance” can offer the consumer advertisements  from car insurance companies without any additional data from the  consumer other than the search’s keywords.

Supports innovation and customization. According to some  stakeholders, the collection and use of data also benefit consumers  through other means such as providing innovative products or  customized services. According to a representative from a content  provider, the collection of personal information, with consent, for  commercial purposes can at times have benefits. The representative  said, for example, that collection of images containing identifiable  information, like faces, can help in the development of new  technologies such as object and facial recognition. According to two  content providers, consumers may also benefit from customized  services and content. For example, according to a representative from  a travel-related company, that company can collect information about  a consumer to suggest travel itineraries and suggestions for activities.  Additionally, representatives from a consumer advocacy group and a  content provider stated that direct-marketing approaches are enabled  through data collection. Such marketing approaches allow consumers  to receive advertisements that are uniquely tailored to their interests.  For example, a consumer that a content provider has identified as  being a hiker may receive advertisements for hiking boots.

Despite these benefits, public opinion surveys have shown concerns  about the collection and use of consumers’ information on the Internet.  For instance, recent analyses based on surveys by the Pew Research  Center and NTIA showed that the public lacks trust in Internet privacy, a  concern that may limit economic activities. NTIA’s survey results show  that privacy concerns may lead to lower levels of economic productivity  as people decline to make financial transactions on the Internet.  According to the NTIA analysis, in 2017, 24 percent of American  households surveyed avoided making financial transactions on the  Internet due to privacy or security concerns. Consumers NTIA surveyed  indicated that their specific concerns were identity theft, credit card or  banking fraud, data collection by online services, loss of control over  personal information, data collection by government, and threats to  personal safety. Stakeholders we interviewed elaborated on some of  these concerns:

Public disclosure and data breaches. Some stakeholders, including  representatives from content providers, said that personal information  from the Internet can be publicly disclosed, including through data  breaches. An academic and a former FCC commissioner told us that  such disclosures are becoming more frequent. Various consumer  advocacy groups and state governments continue to report data  breaches. This personal information can include financial information  such as credit card information, the disclosure of which can result in  financial harm to the consumer. It can also include other kinds of  sensitive information such as political views or medical conditions, the  disclosure of which can cause non-financial harms such as  embarrassment or harassment. According to public reports, the 2017  breach of consumer information from Equifax, a credit-reporting  agency, resulted in the disclosure of 143 million American consumers’  sensitive information. According to NTIA’s 2017 survey, 45 percent of  households surveyed reported major concerns about credit card  fraud. Regarding non-financial information, in a recent case FTC  alleged that an Internet-based company publicly disclosed patients’  sensitive medical information without their knowledge after patients  submitted what they thought were confidential reviews of physicians.  According to FTC, these reviews were then publicly posted on the  company’s website.

Financial and other harms. Stakeholders identified both potential  financial and non-financial harms associated with misuse of personal  information from the Internet. A former FTC acting chair has said that  privacy and data-security incidents can cause injuries that do not only  involve financial loss and that it may be difficult to measure this type  of non-financial injury. In a February 2018 speech, this former acting  FTC chair cited a case that the agency filed involving the misuse of  personal information from the Internet that resulted in people losing  jobs or job opportunities or being threatened, stalked, and harassed.  The acting chair said that in another case, there was evidence that  several people committed suicide after their names and other data  were disclosed. The commission can, by bringing suit in district court,  obtain an order compelling content providers to provide monetary  relief to consumers if a data disclosure results in financial harm to a  consumer. However, an academic noted that many data disclosures  of sensitive information cannot be financially redressed; information  can indefinitely persist on the Internet once it is disclosed.

Consumers’ lack of understanding. A range of stakeholders we  interviewed, including those from industry, said that consumers lack  an understanding of how their data are collected and used. Some  stakeholders said content providers are insufficiently transparent  about how they collect and use data. For instance, content providers’  privacy policies, according to various stakeholders, may contain  technical language that is difficult for typical consumers to understand,  may be located in a difficult-to-access or inconspicuous part of the  content provider’s website, or may be lengthy to the point where it  becomes prohibitively difficult for a consumer to set aside enough  time to read. Furthermore, according to an academic, companies may  have an incentive to intentionally obscure their privacy practices,  since clarity could put the companies at a competitive disadvantage.

The academic also stated that different privacy policies may apply to  different parts of a consumer’s experience on a single website. For  example, the academic described how a website may have contracts  with third-party vendors for specific services included on the website  that consumers use, such as an online shopping cart’s features. The  privacy policy for the website and the third-party shopping cart can be  separate and unrelated to each other, and consumers may not be  aware of this since these policies may never appear to consumers or  be hard to obtain. A representative from a consumer advocacy group  also mentioned that consumers may be unaware that companies track  consumers’ Internet activity in order to target those consumers with  customized prices. An academic said that these practices may  disproportionately affect people with low computer literacy, as they  may not be aware of tracking or know of ways to counteract it. In  2015, we found that the lack of computer and Internet skills is one of  the primary barriers people face in using the Internet and that this is a  particular problem for certain demographic segments who may lack  exposure to or knowledge about computers, such as those of age 65  and older and those with low levels of income and education.

Consumer lack of control. Some academics and consumer  advocacy groups also identified a lack of control as a concern with  respect to Internet privacy—consumers have little or no control over  how their information is collected, used, and shared. In a 2015 survey  conducted by Pew Research Center, 65 percent of respondents said it  is very important to be in control of what information is collected about  them. However, according to an academic and a consumer advocacy  group we interviewed, privacy policies offer consumers little or no  bargaining power, and consumers may be forced to either accept the  terms of the policy as written or not use the application or service at  all. Furthermore, we recently reported that sometimes consumers’  information is used for purposes that are altogether separate from  what those consumers originally anticipated. For example, FTC  alleged in an enforcement action that in 2009 and 2010, a company  told consumers that it would track the websites they visited in order to  provide them with personalized offers, when in fact the company was  also transmitting credit card information it collected through such  tracking to third parties. The company settled with FTC. We also  recently reported on how devices that comprise the Internet of Things  pose privacy concerns for consumers, including that information  collected by such Internet-connected devices can be used in ways to  which the consumer was not given the option to opt out.

As discussed above, stakeholders described various types of harm that  could result from Internet privacy violations. Regardless of whether  violations involve financial or other types of harm, a challenging factor in  providing Internet privacy oversight is identifying the responsible parties.  A former federal government official with experience in privacy issues  said that it frequently is difficult to identify which Internet entity in the  chain is ultimately responsible for a privacy-related harm. For example, if  a consumer is harmed by the theft of his or her Social Security number, it  can be difficult to determine which entity is responsible if multiple entities  have suffered data breaches of information systems that contained the  Social Security number. In addition to the challenges in identifying  responsible parties, the federal government has faced challenges in  providing Internet privacy oversight. Our prior work has found that such  efforts lack clearly defined roles, goals and performance measures,  and that gaps exist in the current privacy framework.

FTC and FCC Have Used Different Approaches to Oversee Internet Privacy FTC Primarily Uses Settlement Agreements with a Range of Companies to Address Internet Privacy Violations

We found that during the last decade, FTC filed 101 Internet privacy  enforcement actions for practices that the agency alleged were unfair,  deceptive, a violation of COPPA, a violation of a settlement agreement,  or a combination of those reasons. Most of these actions pertained to  first-time violations of the FTC Act for which FTC does not have the  authority to levy civil penalties. In those cases where a party violated an  FTC regulation or settlement agreement, however, FTC does have the  authority to impose civil penalties. The 101 cases—filed between July 1,  2008 and June 30, 2018—involved a variety of products, services, and  industries that collect and use personal information from the Internet.  During the years for which we examined full-year data, the number of  enforcement actions taken per year ranged from 5 in 2010 and 2016 to 23  in 2015. For example, in recent years, FTC took enforcement action  against the following entities for alleged conduct that the agency  contended violated section 5 or COPPA: a toy manufacturer for collecting personal information from children  online without providing direct notice and obtaining their parents’  consent; a computer manufacturer for pre-loading laptops with software that  compromised security protections in order to deliver ads to  consumers; a mobile ride-hailing business for misrepresenting the extent to which  it monitored its employees’ access to personal information about  users; a television manufacturer for installing software on its televisions to  collect viewing data on 11 million consumers without their knowledge  or consent and providing the viewing data to third parties; and a mobile advertising network for deceptively tracking the locations of  hundreds of millions of consumers, including children, without their  knowledge or consent, to serve them geographically targeted  advertising.

Of the 101 actions filed during the 10-year period, 51 involved Internet  content providers, 21 involved software developers, 12 involved the sale  of information or its use in advertising, 5 involved manufacturers, 1  involved an Internet service provider, and 11 involved a variety of different  products, such as those provided by rent-to-own companies or  certification services. In nearly all 101 cases, companies settled with  FTC, which required the companies to make changes in their policies or  practices as part of the settlement. FTC levied civil penalties against two  of those companies for violating their settlement agreements. Also  during this 10-year period, FTC levied civil penalties against 15  companies (a total of $12.7 million) for alleged violations of the COPPA  regulations. The COPPA civil penalties ranged from $50,000 to $4 million  and the average amount was $847,333. FTC can also seek to compel  companies to provide monetary relief to those they have harmed. During  this time period, FTC levied civil penalties against companies for  violations of consent decrees or ordered monetary relief to consumers  from companies for a total of $136.1 million. These payment orders  ranged from $200,000 to $104.5 million and the average amount was $17  million.

In the majority of these 101 enforcement actions that FTC settled, FTC  alleged that companies engaged in practices that were deceptive.   Examples of the charges FTC brought include:  “Deceptive practices” cases (61 cases): In 2016, FTC alleged that  Turn, Inc., an Internet advertising company, continued to track the  Internet activities of consumers for targeted advertising purposes after  the company had made representations that it would stop doing so.  According to FTC, the company led consumers to believe they could  turn off such tracking when in fact they were unable to do so.  “Unfair practices” cases (4 cases): In 2014, FTC alleged that  LeapLab, a data broker, knowingly provided scammers with hundreds  of thousands of consumers’ sensitive personal information, including  Social Security and bank account numbers.  “Unfair and deceptive” practices cases (19 cases): In 2015, FTC  alleged that Equiliv Investments, a software developer, lured  consumers into downloading its “rewards” application, saying it would  be free of malware, when the application’s main purpose was actually  to load the consumers’ mobile phones with malicious software to mine  virtual currencies for the developer.

COPPA and COPPA regulations cases (6 cases): In 2011, FTC  alleged that Broken Thumbs Apps, a software developer, had  collected information from Internet applications that the developer  specifically targeted toward children under the age of 13. FTC’s  complaint stated that the company had, among other things, failed to  provide notice of what information it collected and how it was used  and also had failed to inform parents of these practices and receive  their consent as COPPA required.

Violation of settlement agreement cases (2 cases): In 2012, Google  agreed to pay a $22.5 million civil penalty to settle FTC charges that it  misrepresented to users of Apple’s Safari Internet browser that  Google would not place tracking cookies or provide targeted ads to  those users, violating an earlier settlement agreement between the  company and FTC.

In 14 of the 101 cases, FTC required companies to be audited by outside  entities to monitor compliance with the terms of the settlement. The audit  period ranged from 5 years to 20 years, with an average of 17.5 years.

As noted above, 2 of the 101 cases involved a violation of FTC settlement  agreements. In addition, in March 2018, FTC announced that it is  investigating whether Facebook’s privacy practices violate a 2012  Facebook settlement agreement with FTC. In the case that resulted in the  2012 settlement, FTC charged Facebook with deceiving consumers by  telling them they could keep their information private, but then allowing it  to be shared and made public.

Appendix II contains more detailed information about the 101 cases.

FCC Developed Internet Privacy Rule for Internet Service Providers That Was Later Repealed

As stated earlier, in 2015, FCC classified broadband Internet service as a  telecommunications service, placing primary oversight of broadband  Internet service providers’ privacy practices under FCC’s jurisdiction  instead of FTC’s jurisdiction. In 2016, FCC filed a privacy enforcement  action against a mobile Internet service provider, alleging, in part,  violation of section 222 of the Communications Act and FCC’s Open  Internet Transparency Rule. Section 222 requires telecommunications  carriers to protect the confidentiality of customers’ proprietary information.  In that case, FCC fined Verizon Wireless $1.4 million for failing to disclose  that it was inserting “unique identifier headers,” also called “perma- cookies” or “super cookies” (mobile web tracking cookies that users  cannot remove), into customers’ Internet traffic over its wireless network.  Although the settlement was finalized during the 2015-2017 period when  FCC had asserted jurisdiction over the privacy practices of Internet  providers, the Verizon Wireless practices occurred prior to the  classification of Internet service providers as telecommunications carriers.  The investigation therefore did not rely upon FCC’s subsequent assertion  of authority over Internet service providers’ privacy practices.

In October 2016, after FCC had reclassified broadband as a  telecommunications service, the commission issued Internet service  provider privacy regulations, asserting its authority under section 222 of  the Communications Act. In April 2017, however, Congress repealed  these regulations under the Congressional Review Act before they took  effect. In December 2017, FCC then reversed its 2015 classification of  broadband, and oversight of broadband Internet service providers’ privacy  practices reverted to FTC once the decision took effect in June 2018. In  explaining the December 2017 decision, FCC’s new chair said that FTC’s  privacy oversight approach regarding Internet service providers—using its  authority to protect consumers against unfair, deceptive, and anti- competitive practices—had worked well in the past and that this action  would “put the nation’s most experienced privacy cop back on the beat.”  Under FCC’s new legal approach, it no longer asserts jurisdiction to take  enforcement action against Internet service providers for privacy-related  matters, including mobile Internet service providers. As part of FTC’s  resumption of Internet service provider oversight, FCC and FTC entered  into a memorandum of understanding in December 2017 spelling out their  roles and responsibilities regarding oversight of these companies. FTC  staff said that they regularly communicate with FCC and have an  agreement to share Internet privacy complaints.

Selected Stakeholders Provided Various Views on the Effectiveness of Current Internet Privacy Oversight and How It Could be Enhanced Industry Stakeholders View Current Enforcement Approach as Providing Flexibility, While Consumer Stakeholders See Limitations with This Approach

As previously discussed, no federal statute comprehensively and  specifically governs Internet privacy across all sectors. FTC oversees  some aspects of Internet privacy by using its FTC Act section 5 authority  to protect consumers from unfair and deceptive practices. FTC also uses  its specific COPPA authority to police the collection and use of personal  information from children by online services. Some industry  representatives said that FTC’s enforcement has been effective because  the agency has expertise and experience in privacy issues and has the  flexibility to take enforcement action on a case-by-case basis. In addition,  a content provider said that FTC has taken enforcement actions against  companies of various sizes in different sectors and has a powerful tool by  being able to require companies to be audited by outside entities for up to  20 years.

Industry stakeholders we interviewed generally said that “direct  enforcement” of a statute is preferable to promulgating and enforcing  regulations implementing that statute (which constitutes enforcement of  the statute as well). These stakeholders noted several key concerns they  believe exist with regulatory versus statutory enforcement of Internet  privacy:

Regulations can stifle innovation. Two industry stakeholders said  that regulations can hinder companies’ ability to innovate. For  example, representatives from an Internet service provider said that  innovation can stop during the rulemaking process as the industry  waits for the regulation to be finalized.

Regulations may create loopholes. Representatives from an  Internet industry group and a content provider said that regulations  can also contain loopholes that can be legally exploited because  imprecise language in a regulation may allow a company to legally  engage in an action that was originally unforeseen by the regulator.

Regulations can become obsolete. Several industry stakeholders  said regulations also may become obsolete quickly because the  Internet industry is rapidly changing. An Internet industry  representative noted that there can be large shifts in the Internet  industry from year to year, while it often takes an agency much longer  than a year to adopt a rule. Industry stakeholders said the flexibility of  FTC’s approach allows FTC to adapt continuously to changing market  conditions.

Rulemakings can be lengthy. FCC officials said that in some cases,  rulemakings can take a long time, especially when the issues are  complex and there is no statutory deadline. Our previous work on  rulemaking found that length of time required for the development and  issuance of final rules varied both within and among agencies.

Additionally, while some stakeholders suggested that regulations can  clarify acceptable practices, other stakeholders, including from industry  and academia, said that enforcement actions can send a similar  message. According to both a representative from a content provider and  an academic, enforcement actions such as settlement agreements, for  example, establish precedents that companies can follow, similar to the  way that case law developed by courts provides guidance for companies.

Although some industry representatives we interviewed said that FTC’s  use of settlement agreements provides companies with guidance, certain  trade associations took a different position in a recent case brought  before the U.S. Court of Appeals for the Third Circuit, FTC v. Wyndham  Worldwide Corp. 799 F.3d 236 (3d Cir. 2015). However, the court did not  agree with the associations’ arguments. The case involved an  enforcement action against Wyndham Worldwide Corporation where FTC  alleged that data security failures led to three data breaches at the  company in less than 2 years. The court considered whether FTC could  bring an enforcement case involving cybersecurity using FTC’s section 5  “unfair practices” authority and, if so, whether Wyndham had “fair notice”  that its specific cybersecurity practices could be deemed “unfair.” A  group of companies and the U.S. Chamber of Commerce wrote a friend- of-the-court brief supporting Wyndham, criticizing FTC’s “regulation- through-settlements” approach. The companies argued this approach  subjects businesses to “vague, unknowable, and constantly changing  data-security standards” and businesses often are unaware of the  standards to which they are held until after they receive a notice of  investigation from FTC, at which point they must settle or expend  considerable resources fighting the agency.

Potential Limits on Federal Trade  Commission (FTC) Remedies  A recently decided federal appeals court case  illustrates potential limits on the remedies that  FTC can order in an “unfair practices”  enforcement proceeding. In this 2018 case,   LabMD, Inc. v. FTC, 891 F.3d 1286 (11th Cir.  2018), the U.S. Court of Appeals for the  Eleventh Circuit found that FTC could not  direct a medical laboratory to create and  implement wholesale data-security protective  measures as a remedy to the laboratory’s  alleged unfair practices.   FTC had filed a complaint against LabMD  under section 5 of the FTC Act for allegedly  committing an unfair act or practice by failing  to provide reasonable and appropriate  security for personal information on its  computer networks. The commission found  that LabMD’s inadequate security constituted  an unfair act or practice and ordered LabMD  to take various actions, including establishing  and maintaining a reasonable and  comprehensive information security program.   On appeal, the Eleventh Circuit ruled that  FTC’s order exceeded its authority because it  did not prohibit a specific act or practice but  instead, mandated a complete overhaul of the  company’s data-security program. FTC had  argued that the FTC Act gives it broad  discretion to prevent unfair or deceptive acts  or practices that injure the general public and  that FTC had spelled out standards for  LabMD to craft a reasonable security  program. The court ruled, however, that such  a general approach would make it difficult for  a reviewing court to determine if LabMD had  complied with the order, in the event of a  future FTC challenge. company can reasonably foresee that a court could construe its conduct  as falling within the meaning of the statute.”

A majority of non-industry stakeholders we interviewed identified  limitations in the current Internet privacy oversight approach because they  view regulations in conjunction with enforcement as being more effective.  These stakeholders include all of the former FTC commissioners we  interviewed, three of the four former FCC commissioners we interviewed,  and representatives from consumer advocacy groups we interviewed. In  addition, a former FCC commissioner said that the current Internet  privacy oversight approach is limited in part because he viewed  regulations applying equally to all players in the Internet ecosystem in  conjunction with enforcement as being more effective. A representative  from a consumer advocacy group also said that regulations in conjunction  with enforcement are essential for effective privacy protection. Some of  these stakeholders noted key ways that they believe Internet privacy  regulations can provide clarity to industry and consumers, as well as  fairness and flexibility in enforcement:

Regulations can provide clarity. An Internet industry group  representative said that various companies have favorable views of  regulations because they can provide clear expectations about what  actions are permissible. Similarly, a former congressional staff  member with expertise on privacy issues said that some companies  have favorable views of regulations because the regulations often  provide clearer expectations about what the companies can do. FCC  officials said that with respect to telephone privacy provisions of the  Communications Act, the telephone industry wanted rules because it  sought greater clarity about what it should be doing, what constituted  a violation, how to comply, and what behaviors were acceptable.

Regulations may promote fairness. Some other stakeholders  discussed the ability of regulations to provide fairness. For example, a  former federal enforcement official described regulations as creating a  fair and consistent oversight regime across the entire industry in a  way that case-by-case enforcement actions do not. Another former  federal enforcement official said that regulations give companies fair  notice of what actions may be violations and thus help those  companies avoid surprising or unexpected enforcement.

Regulations can be flexible. An academic said that by targeting  behaviors and not specific technologies, regulations can be written in  such a way that they do not become obsolete. An academic also said  that regulations based on broad performance-standards principles can  avoid being overly prescriptive. FCC officials also noted that  regulations can be amended to adapt to changes in technology often  faster than new laws can be enacted. Furthermore, regulations  determined to be obsolete can be repealed. FTC staff told us that the  agency systematically reviews all of its regulations every 10 years,  even though it is only legally required to review its most significant  ones, and that the number of FTC regulations has decreased because  the agency determined prior ones were obsolete. The Regulatory  Flexibility Act requires federal agencies to analyze the effect of their  regulations on small entities.

Regulations can be a deterrent. FCC officials said that rules can  have a deterrent effect on bad practices in the industry or have a role  in mitigating the negative effects of bad practices after they occur.  They said, for example, that the practice of pretexting (improperly  obtaining people’s telephone records) was greatly curtailed by an  FCC regulation prohibiting such practices. They also said that rules  can foreclose arguments by companies claiming that because no rule  was in place, they had no reasonable notice or awareness that they  should behave in a particular way.

Consumer advocacy groups and other stakeholders, including some  former FTC and FCC commissioners, had concerns about the efficacy of  an enforcement approach such as FTC’s approach to Internet privacy  oversight, which focuses on enforcing a statute rather than implementing  regulations. They said that FTC’s enforcement approach limits the ability  of the agency to affect companies’ behavior, and that any enforcement  activity occurs after the violation, undesirable behavior, harm, or illegal  action has already occurred. A former federal enforcement official also  said that regulations can prevent companies from engaging in bad  practices in the first instance and thus have a preventive effect. A former  FCC commissioner said that by the nature of a direct statutory- enforcement approach (as opposed to rulemaking), an agency would only  address a harm after it has occurred. As discussed above, for example,  data often cannot be removed from the Internet because copies of the  data can exist among many bad actors, and it can be difficult to identify  the entity responsible for unwanted disclosures. Therefore, it may be  more important to avoid such Internet privacy harms from occurring in the  first place. Another former FCC commissioner told us that Internet privacy  oversight should be returned to FCC because it has APA section 553  notice-and-comment rulemaking authority and considerable enforcement  experience.

Representatives from consumer advocacy groups said that FTC’s  enforcement action has been insufficient because it investigates only a  small portion of actual Internet-privacy violations or takes action regarding  only the most egregious or outrageous cases that it can win. FTC has  also stated in its strategic plan that it focuses on investigating and  litigating cases that cause or are likely to cause substantial injury to  consumers and that by focusing on practices that are actually harming or  likely to harm consumers, FTC can best use its limited resources.  Representatives from an Internet association said that FTC’s Internet- privacy enforcement actions should focus on concrete harms. An FTC  staff member from the Division of Privacy and Identity Protection said that  the agency has been effective with the limited enforcement resources it  has available. Furthermore, the staff member said the agency uses no  formal written criteria or template to assess individual cases but considers  the size and scale of a company’s effect on consumer privacy when  deciding whether to take enforcement action. However, a former FTC  commissioner told us that the agency needs more resources to effectively  oversee Internet privacy.

We asked stakeholders whether it was clear under what circumstances  FTC will take Internet privacy enforcement action. In response, some  stakeholders said that FTC’s enforcement priorities are reflected in its  settlement agreements, which provide information that is similar to a body  of case law. Individual commissioners also may issue statements  explaining their decisions. Two stakeholders also said that FTC’s closing  letters, which the agency sends to companies and posts on its website  when it closes an investigation without taking enforcement action, may  explain its decisions. Other stakeholders said that more guidance would  be helpful to provide additional clarity on how the agency uses its Internet  privacy enforcement authority. FTC staff and other stakeholders also said  that FTC has provided useful Internet privacy guidance. For example, in  2015, FTC published guidance for businesses on complying with COPPA.

Stakeholders and FTC Identified Potential Actions to Enhance Federal Oversight of Consumers’ Internet Privacy

Various stakeholders we interviewed said that opportunities exist for  enhancing Internet privacy oversight. A key component of FTC’s mission,  as specified by the FTC Act, is to protect consumers against unfair and  deceptive practices. As discussed earlier, some stakeholders believe that  FTC’s reliance on its unfair and deceptive practices authority to address  Internet privacy issues has limitations. In addition, although the Fair  Information Practice Principles provide internationally recognized  principles for protecting the privacy and security of personal information,  they are not legal requirements and FTC cannot rely on them to define  what constitutes unfair and deceptive practices related to privacy and  data security.

We stated in our 2013 information resellers report that the current U.S.  privacy framework is not always aligned with the Fair Information Practice  Principles and that these principles provide a framework for balancing the  need for privacy with other interests. We found that there are limited  privacy protections under federal law for consumer data used for  marketing purposes. We said that although the Fair Information Practice  Principles call for restraint in the collection and use of personal  information, the scope of protections provided under current law has been  narrow in relation to: (1) individuals’ ability to access, control, and correct  their personal data; (2) collection methods and sources and types of  consumer information collected; and (3) new technologies, such as  tracking of web activity and the use of mobile devices. Although we  recommended in that report that Congress consider strengthening the  consumer privacy framework to reflect the effects of changes in  technology and the marketplace, this matter for congressional  consideration was not specific to Internet privacy or to the oversight  authorities of any particular agency or agencies.

As noted above, various stakeholders expressed concern about the ability  of consumers to control their data and understand how that data are  used. These concerns suggest that companies are not always following  the Fair Information Practice Principles, such as that companies’ data  practices should be transparent, allow consumers the right to access and  edit their data, and limit the collection of data to the extent feasible.

Those stakeholders who believe that FTC’s current authority and  enforcement approach is unduly limited identified three main actions that  could better protect Internet privacy: (1) enactment of an overarching  federal privacy statute to establish general requirements governing  Internet privacy practices of all sectors; (2) APA section 553 notice-and- comment rulemaking authority; and (3) civil penalty authority for any  violation of a statutory or regulatory requirement, rather than allowing  penalties only for violations of settlement agreements or consent decrees  that themselves seek redress for a statutory or regulatory violation.

Stakeholders from a variety of perspectives—including from academia,  industry, consumer advocacy groups, and former FTC and FCC  commissioners—told us that a privacy statute could enhance Internet  privacy oversight by, for example, clearly articulating to consumers,  industry, and privacy enforcers what behaviors are prohibited, among  other things. In addition, a former FCC commissioner said that a new  privacy statute could enhance Internet privacy oversight by creating  uniform standards for all players in the Internet ecosystem that is focused  on the consumer rather than the regulatory legacy of the companies  involved (regulations that apply to specific types of companies based on  what they are or used to be, such as telecommunications carriers, cable  companies, broadcasters, and mobile wireless providers). The former  FCC commissioner said that as companies, technologies, and markets  change, there is a question about whether existing law should be  modernized. In 2015, FTC staff recommended that Congress enact broad-based legislation that is flexible and technology-neutral, while also  providing clear rules of the road for companies about such issues as how  to provide choices to consumers about data collection and use  practices. Some stakeholders suggested that such a framework could  either designate an existing agency as responsible for privacy oversight  (such as FTC) or create a new privacy-oriented agency. A representative  from a consumer advocacy group mentioned that the European Union, for  example, has established the European Data Protection Supervisor, an  independent data protection authority, to monitor and ensure the  protection of personal data and privacy. Similarly, in Canada, the Office of  the Privacy Commissioner, an independent body that reports directly to  the Parliament, was established to protect and promote individuals’  privacy rights.

Some stakeholders also stated that the absence of a comprehensive  Internet privacy statute affects FTC’s enforcement. For example, a former  federal enforcement official said that FTC is limited in how it can use its  authority to take action against companies’ unfair and deceptive trade  practices for problematic Internet privacy practices. Similarly, another  former federal enforcement official said that FTC is limited in how and  against whom it can use its unfair and deceptive practices authority  noting, for example, that it cannot pursue Internet privacy enforcement  over exempted industries such as common carriers. In addition, a former  FCC commissioner said that it is more difficult for FTC to take effective  action because its enforcement comes only after a complaint and after an  often lengthy review process. The former FCC commissioner also said  that without “ex ante” rules (rules that define prohibited activity before it  has occurred), there inevitably will be delay, confusion, and lack of  knowledge about what is and is not acceptable behavior.

In addition, some stakeholders—including a representative from a  consumer group, a former federal enforcement official, and a former FCC  commissioner—said FTC’s section 5 “unfair or deceptive practices”  authority may not enable it to fully protect consumers’ Internet privacy  because it can be difficult for FTC to establish that Internet privacy  practices are legally “unfair.” For example, under section 5, FTC has  charged companies with committing a “deceptive” practice if their privacy  policies said they would not collect or use consumers’ personal  information but then did so. However, a former congressional staff  member said that companies often write broad and vague policy  statements, making it difficult for FTC to charge companies with  committing deceptive practices. Instead, according to a representative  from a consumer advocacy group, FTC would have to show the  companies’ actions were “unfair,” which, according to the representative,  is legally difficult to establish. We found in our 2017 report on vehicle data  privacy that most automakers’ written privacy notices used vague  language. Similarly, we found in our 2012 report on mobile device  location data that although companies’ policies stated that they shared  location data with third parties, they were sometimes vague about which  types of companies these were and why they were sharing the data.

Some stakeholders said that FTC relies more heavily on its authority to  take enforcement action against deceptive trade practices compared with  the agency’s unfair trade practices authority. This was confirmed in our  analysis of FTC’s Internet privacy enforcement actions discussed  previously. However, a representative from a consumer advocacy group  said that FTC’s ability to take such action is limited practically to instances  where a company violates its own privacy policy—companies generally  can collect and use data in any way they want if they include language in  their policies asserting their intent to do so. According to a former FCC  commissioner, a privacy statute could clarify the situations in which FTC  could take enforcement action.

Various stakeholders said that there are advantages to overseeing  Internet privacy with a statute that provides APA section 553 notice-and- comment rulemaking authority. As discussed above, that provision lays  out the basic process by which so-called informal agency rulemaking  shall be conducted, namely, publication of proposed regulations in the  Federal Register; an opportunity for public comment (written and possibly  oral submission of data and views); and publication of final regulations in  the Federal Register with an explanation of the rules’ basis and purpose.  Also as noted above, Congress imposed additional rulemaking steps on  FTC in the Magnuson-Moss Act when FTC is promulgating rules under  section 5 of the FTC Act. These additional steps include providing the  public and certain congressional committees with advance notice of  proposed rulemaking (in addition to notice of proposed rulemaking).  FTC’s rulemaking under Magnuson-Moss also calls for, among other  things, oral hearings, if requested, presided over by an independent  hearing officer, and preparation of a staff report after the conclusion of  public hearings, giving the public the opportunity to comment on the  report. Finally, Congress made it easier for the public to appeal FTC’s  Magnuson-Moss rules by making the agency meet a higher standard  when the rules are challenged in court. FTC staff said that these  additional steps add time and complexity to the rulemaking process.

In congressional testimony in 2010, the then-Director of FTC’s Bureau of  Consumer Protection said that “if Congress enacts privacy legislation, the  commission agrees that such legislation should provide APA rulemaking  authority to the commission.” According to FTC, this testimony was  voted on and approved by the commissioners and, therefore, constituted  the commission’s official position at the time.

Moreover, according to stakeholders, in many cases regulations can be  used to implement statutes. Officials from other consumer and worker  protection agencies we interviewed described their enforcement  authorities and approaches. For example, officials from the CFPB and the  FDA, both of which use APA section 553 notice-and-comment  rulemaking, said that their rulemaking authority assists in their oversight  approaches and works together with enforcement actions. OSHA officials  said that the standards that the agency promulgates under its authority  specify what employers are required to do to reduce safety and health  risks to workers. Such standards lay out the workplace conditions that  must be maintained by employers and require that employers implement  certain practices, operations, or processes that ensure worker  protections. EEOC officials said that regulations are used to guide  investigations that establish whether enforcement action is appropriate.  CPSC officials said that the agency conducts consumer protection not  only by establishing and enforcing mandatory regulations, but also  through collaborative actions such as educating industry, developing  consensus voluntary safety standards, removing defective products from  the marketplace through voluntary corrective actions, and litigating when  necessary. In addition, in contrast to FTC’s approach, FCC has APA  section 553 notice-and-comment rulemaking authority and has issued  regulations implementing section 222 of the Communications Act using  that rulemaking authority to protect the privacy of telephone users.

Ability to Levy Civil Penalties for Initial Violations and to Impose Larger Civil Penalties

Some stakeholders suggested that FTC’s current ability to levy civil  penalties could also be enhanced. Currently, FTC can levy civil penalties  against companies for violating certain regulations, such as COPPA  regulations, or if the company violates the terms of a settlement  agreement already in place. According to most former FTC  commissioners and some other stakeholders we interviewed, FTC should  be able to levy fines for initial violations of section 5 of the FTC Act. An  academic told us that the power of an agency to levy a fine is a tangible  way to hold industries accountable. Another academic noted, however,  that fines may be relatively less effective in industries where there is  limited competition because the costs of those fines may be more  effectively passed on to consumers in the form of higher prices for  services. In addition, some stakeholders said that payments required by  FTC orders are not large enough to act as a deterrent and that  companies may consider them to be a cost of doing business.

There is a growing debate about the federal government’s role in  overseeing Internet privacy. In a July 2018 congressional hearing, FTC’s  new chair testified that the FTC Act cannot address all privacy and data- security concerns in the marketplace. The chair said, for example, that  FTC’s lack of civil penalty authority for violations of the FTC Act reduces  its deterrent capability. He also noted the agency lacks authority over  non-profits and over common carrier activity, even though those entities  and activities often have serious implications for consumer privacy and  data security. In November 2018, FTC’s chair testified before Congress  and urged Congress to consider enacting privacy legislation that would be  enforced by FTC. A majority of the commission has indicated support  for APA rulemaking and civil penalty authority for privacy. FTC also held  hearings in September, November, and December 2018 to advance the  discussion around privacy issues, among other topics, and FTC plans to  hold an additional hearing on data security and consumer privacy in  February 2019. In a Federal Register notice, FTC announced that it is  interested in the benefits and costs of various state, federal and  international privacy laws and regulations, including the potential conflicts  among those standards. FTC also indicated that it is particularly  interested in the efficacy of the commission’s use of its current authority  and the identification of any additional tools or authorities the commission  may need to adequately deter unfair and deceptive conduct related to  privacy and data security. Also in July 2018, an NTIA official announced  that NTIA, in coordination with the Commerce Department’s International  Trade Administration and National Institute of Standards and Technology,  had recently started holding stakeholder meetings to identify common  ground and formulate core, high-level principles on data privacy.

Regarding the development of the Administration’s approach to consumer  privacy, in September 2018, NTIA requested comments on ways to  advance consumer privacy while protecting prosperity and innovation.  Our 2009 report on a framework for assessing proposals for modernizing  the financial regulatory system similarly found that regulators should have  the authority to carry out and enforce their statutory missions. We  further said that a regulatory system should be flexible and forward  looking, allowing regulators to readily adapt to market innovations and  changes, including identifying and acting on emerging risks in a timely  way without hindering innovation. These factors are useful considerations  as the federal government explores how it can better oversee privacy and  data security. Having sufficient and appropriate authorities and providing  flexibility to address a rapidly evolving Internet environment could better  ensure that the federal government can protect consumers’ privacy.

Recent developments regarding Internet privacy suggest that this is an  appropriate time for Congress to consider comprehensive Internet privacy  legislation. Although FTC has been addressing Internet privacy through  its unfair and deceptive practices authority, among other statutes, and  other agencies have been addressing this issue using industry-specific  statutes, there is no comprehensive federal privacy statute with specific  standards. Debate over such a statute could provide a vehicle for  consideration of the Fair Information Practice Principles, which are  intended to balance privacy concerns with the need for using consumers’  data. Such a law could also empower a specific agency or agencies to  provide oversight through means such as APA section 553 rulemaking,  civil penalties for first time violations of a statute, and other enforcement  tools. Comprehensive legislation addressing Internet privacy that  establishes specific standards and includes APA notice-and-comment  rulemaking and first-time violation civil penalty authorities could help  enhance the federal government’s ability to protect consumer privacy,  provide more certainty in the marketplace as companies innovate and  develop new products using consumer data, and provide better  assurance to consumers that their privacy will be protected.

Congress should consider developing comprehensive legislation on  Internet privacy that would enhance consumer protections and provide  flexibility to address a rapidly evolving Internet environment. Issues that  should be considered include: which agency or agencies should oversee Internet privacy; what authorities an agency or agencies should have to oversee  Internet privacy, including notice-and-comment rulemaking authority  and first-time violation civil penalty authority; and how to balance consumers’ need for Internet privacy with industry’s  ability to provide services and innovate.

We provided a draft of this report to FTC, FCC, and the Department of  Commerce for their review and comment. FTC and FCC provided  technical comments, which we incorporated as appropriate. The  Department of Commerce indicated that it did not have comments.

As agreed with your office, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the FTC chair, the FCC  chair, the Secretary of Commerce, and interested congressional  committees. In addition, the report will be available at no charge on the  GAO website at http://www.gao.gov.

If you or members of your staff have any questions about this report,  please contact Alicia Puente Cackley at (202) 512-8678 or  cackleya@gao.gov or Mark Goldstein at (202) 512-2834 or  goldsteinm@gao.gov. Contact points for our Offices of Congressional  Relations and Public Affairs may be found on the last page of this report.  Major contributors to this report are listed in appendix III.

For this review, we interviewed staff from agencies with roles in Internet  privacy; officials from other consumer- and worker-protection agencies;  stakeholders from consumer advocacy groups, industry groups, Internet  service providers, and Internet content providers; academics; and former  government officials. To obtain a variety of perspectives, we selected  Internet service providers that represented different industry sectors and  Internet content providers that provide a variety of information and social  media services. Academic stakeholders were selected because of their  expertise in privacy, consumer protection, and regulatory issues. We also  interviewed former Federal Trade Commission (FTC) and Federal  Communications Commission (FCC) commissioners who served during  the Barack Obama and George W. Bush administrations and are from  different political parties.

Consumer Financial Protection Bureau (CFPB)  Consumer Product Safety Commission (CPSC)  Department of Commerce, National Telecommunications and Information  Administration (NTIA)  Equal Employment Opportunity Commission (EEOC)  Federal Communications Commission (FCC)  Federal Trade Commission (FTC)  Food and Drug Administration (FDA)  Occupational Safety and Health Administration (OSHA)

Appendix II: Federal Trade Commission Internet Privacy Enforcement Cases

The following table identifies 101 Federal Trade Commission (FTC)  Internet privacy enforcement actions filed between July 1, 2008 and June  30, 2018 in which the agency alleged a violation of either the Federal  Trade Commission Act (FTC Act) or the Children’s Online Privacy  Protection Act (COPPA) and implementing COPPA regulations and  subsequently entered into a settlement agreement with the target entity.  Although some of these cases may involve both Internet data privacy and  security issues, this table does not include cases that involved data  security issues only.

Appendix III: GAO Contacts and Staff Acknowledgments

In addition to the contact names above, Andrew Huddleston, Assistant  Director; Kay Kuhlman, Assistant Director; Bob Homan, Analyst-in- Charge; Melissa Bodeau; John de Ferrari; Camilo Flores; Erica Miles;  Josh Ormond; and Sean Standley made significant contributions to this  report.

In April 2018, Facebook said that up to 87 million users' personal data may have been improperly disclosed. This was one of many recent Internet privacy incidents.

We found that there is no comprehensive U.S. Internet privacy law governing private companies’ collection, use, or sale of users’ data. Consumer advocates and others told us greater regulatory powers are needed. Most industry representatives we interviewed favored the current enforcement approach and warned that regulations could hinder innovation.

We recommended that Congress consider developing comprehensive Internet privacy legislation to better protect consumers.