FTC Releases 2023 Privacy and Data Security Update

The Federal Trade Commission released its Privacy and Data Security Update for 2023 that highlights the FTC’s work to protect consumer privacy and respond to the evolving ways that companies use consumer data such as in the development of artificial intelligence models and misuse of health data.

“The FTC is taking bold actions to challenge the indiscriminate collection and monetization of consumers’ data,” said Samuel Levine, Director of the FTC’s Bureau of Consumer Protection. “We are securing meaningful remedies to protect consumers’ information, rather than placing the burden on consumers to protect themselves.”

The publication highlights the FTC’s privacy and data security work in the last few years. Through 2023, the FTC has brought 97 privacy cases and 169 Telemarketing Sales Rule and CAN-SPAM cases since 1999, as well as 89 data security cases. In addition to its law enforcement work, the agency also has engaged in rulemaking and policy work to push companies to bolster privacy protections for consumers and implement safeguards to secure consumer data.

Between 2021 and 2023, the FTC has taken action to address privacy and security threats in several key areas including:

• Artificial Intelligence: The FTC has brought a number of enforcement actions related to the collection, retention, or use of consumers’ personal information to develop or deploy machine learning or similar algorithms. For example, the FTC alleged that Amazon Alexa violated the Children’s Online Privacy Protection Act (COPPA) by indefinitely retaining children’s voice recordings, which it used to improve its speech recognition algorithm. Last year, the agency also brought a case against Rite Aid over charges it failed to take reasonable steps to ensure that the AI facial recognition technology it deployed in its retail stores did not erroneously flag people as shoplifters or other wrongdoers.
• Health Privacy: Protecting the privacy and security of consumers’ sensitive health information has long been a top FTC priority. Last year, the FTC gave final approval to an order banning BetterHelp, an online counseling service, from sharing sensitive health data for advertising with Facebook and other third parties and requiring it to pay $7.8 million to provide partial refunds to consumers. Also in 2023, the FTC banned GoodRx from sharing sensitive health data with applicable third parties for advertising and also required the company to pay a civil penalty for violating the Health Breach Notification Rule, the agency’s first action under the rule.
• Children’s privacy: The FTC also has worked vigorously to protect children’s privacy through its enforcement of COPPA. In addition to the FTC’s action against Amazon, the agency has brought several other COPPA-related actions including cases involving major gaming companies and education technology providers. For example, the FTC obtained a record $275 million penalty against Fortnite maker Epic Games, which also was required to adopt strong privacy default settings for both children and teens and other protections, and brought an action against ed tech provider Edmodo for using children’s personal information for advertising in violation of COPPA and outsourcing its responsibilities under COPPA to schools. In late 2023, the FTC also proposed key changes to strengthen and update the COPPA Rule that would further limit the ability of companies to condition access to services on monetizing children’s data.
• Geolocation Data: As with health data, location data can reveal highly sensitive information about people by tracking their visits to such places as reproductive health clinics, houses of worship, and domestic violence shelters. Given this, the FTC has taken action to protect such data. In 2022, the FTC sued data broker Kochava Inc. for selling geolocation data from hundreds of millions of mobile devices that can be used to trace the movements of individuals to and from sensitive locations.

The FTC also has remained active in targeting companies that fail to implement reasonable data security measures to protect consumer data. In 2022 and 2023 alone, the FTC announced or finalized enforcement actions against Global Tel*Link, Drizly, Chegg, and CafePress for data security failures.

The agency also has worked to ensure companies comply with the Fair Credit Reporting Act, which sets out requirements for companies that use data to determine creditworthiness, insurance eligibility, suitability for employment, and to screen tenants. The FTC has brought 117 FCRA cases and obtained more than $137 million in civil penalties. This includes a 2023 action that the FTC and Consumer Financial Protection Bureau brought against Trans Union LLC and a subsidiary for failing to ensure the accuracy of tenant screening reports by including inaccurate and incomplete eviction records about consumers, hampering their ability to obtain housing.

In addition to vigorous enforcement, the FTC has engaged in rulemaking and other policy work to establish baseline standards that protect consumers’ privacy. In the past few years, the Commission has proposed rules to clarify the applicability of the Health Breach Notification Rule to health apps, and strengthen COPPA. It has also issued an advanced notice of proposed rulemaking to explore rules that would crack down on harmful surveillance and lax data security, and published a policy statement that makes clear that is against the law for companies to force parents and schools to surrender their children’s privacy rights to be able to learn remotely.

The lead staffer on this update was Katherine McCarron in the FTC’s Bureau of Consumer Protection.