FTC Warns that Notice and Choice May Not Be Enough to Protect Privacy

During a recent lecture at Fordham Law School, Samuel Levine, the Director of the Federal Trade Commission Bureau of Consumer Protection warned that when it comes to privacy “notice and choice is a fantasy world.” Mr. Levine did not mince words, further calling notice and choice a regime that “became a way for companies to give invasive data practices a thin veer of legitimacy.”

This isn’t the first time the Federal Trade Commission (FTC) has raised the issue of notice and choice in the context of privacy. In 2019 the FTC held a panel discussion at the 12^th Hearing on Competition and Consumer Protection in the 21^st Century at the FTC Constitution Center in Washington, DC. The theme of the hearing was “The FTC’s Approach to Consumer Privacy” and the focus of the discussion was on the role of notice and choice.

These recent remarks echoed many of the issues the FTC has been discussing for years, with Mr. Levine stating: “The problems with notice and choice have been clear for a long time. Americans are not reading every word of every privacy policy. Even if we did read the policies, it would be difficult to comprehend the full extent of how our data can be used. And even if we read the policies and understood them, we can hardly exercise choice given how much we rely on digital services, and the lack of competition in many markets.”

What was new, and interesting, in these remarks, however, was the clear insinuation that rulemaking could supplant notice and consent with a legal framework that would create liability for each business who became the holder of the personal information. Specifically, Mr. Levine referenced a consumer credit rule, named the Holder Rule, which disallowed contracts (the equivalent of “notice and consent”) that allowed a creditor to assign a loan and cut off the consumer’s rights to dispute or challenge the legitimacy of the loan or the actions taken by the subsequent holder of the loan. Reading between the lines, the remarks appeared to suggest that the FTC could consider rulemaking that would allow a consumer’s notice and choice to follow the individual’s personal information, no matter to whom that personal information was disclosed, while allowing the consumer to dispute the adequacy of the original “notice and consent” given.

The FTC has become increasingly active in the privacy enforcement space and notice and consent continue to be an area of concern. Even among privacy professionals there is a debate about what constitutes notice and consent and whether it actually provides any level of protection (or true choice) around the use and disclosure of personal information.

Businesses should continue to monitor their notice and consent processes and carefully scrutinize the mechanisms that are in place. It will be important to start analyzing whether the notice and consent process in place allows the consumer to exercise choice about how their data is collected, used, processed, and disclosed. Business should use this information to make changes that align with the expectation that consent equates to true choice. This is an area to watch closely. Stay tuned as this evolving area of privacy develops.