FTC report on predatory social media data collection suggests future regulation

The FTC’s new report on how social media and streaming services collect and monetize their troves of user data doesn’t hold many surprises for those who follow the space. It’s more helpful to consider the bit of paper trail the agency is laying out to justify new regulations in the space.

The report has its roots in late 2020, when the FTC ordered nine tech companies with the largest data collection apparatus to disclose numerous aspects of how their surveillance capitalism business models work (Amazon, Facebook, YouTube, Twitter, Snap, ByteDance, Discord, Reddit, and WhatsApp).

What data do you collect, from whom, and for how long is it kept? If asked to delete, will you do so? What do you use it for, who do you sell it to, and what do you do? They use for? The questions are quite broad, it is better to avoid the possibility of evasion or obfuscation by withholding important data.

The companies’ responses were, as one might expect, evasive, as Samuel Levine, director of the FTC’s Bureau of Consumer Protection, notes in his foreword:

As was the case with companies concealing and disguising their debt collection practices, many Companies provided the Commission with limited, incomplete or unhelpful responses that appeared to have been carefully crafted to serve their own interests and avoid disclosing key information.

As a result, the report details all sorts of shenanigans, representing both malice and incompetence. Few of the practices revealed will surprise anyone at this point, but the executive summary beginning on page 9 is a great reminder of all the shenanigans we have come to expect from such individuals.

Of course, it’s been almost four years since then, and many companies have changed their practices or been fined or otherwise penalized. But despite Lina Khan’s elevation to FTC chair after that investigation, there’s been no major revision or expansion of the rules that set clear boundaries like “you shall not sell your health data to advertisers.”

One exception you can count on, compliance with the Children’s Online Privacy Protection Act, also appears to be a bonus. As the FTC writes:

…In a blatant attempt to avoid liability under the COPPA Rule, most (social media and video streaming services) claimed that there were no children on their platforms because children could not create accounts. And yet we know that children use SMVSS. SMVSS should not ignore this reality… Almost all of the companies allowed teenagers to use their SMVSS and placed no restrictions on their accounts, and collected personal information from teenagers just as they do from adults.

Meta allegedly ignored obvious violations for years; Amazon settled for $25 million after “disregarding” the law; TikTok owner ByteDance is the target of a similar lawsuit filed just last month.

So what’s the point of the report if all this is already known?

Well, the FTC also has to exercise due diligence when considering regulations that could curb many of the multibillion-dollar global tech companies. If the FTC were to say in 2020, “These companies are out of control, we’re proposing new regulations!” then the industries affected could rightly challenge them on the grounds that there’s no evidence of what the rule prohibits. This sort of thing happened with net neutrality, too: broadband companies challenged it (among other things) on the grounds that the harms were exaggerated, and won.

While Chairman Khan’s statement accompanying the report suggests that it will help inform efforts by state and federal lawmakers (which is probably true), it is almost certain that it will provide a foundational factual basis on which new regulations can be built. The mere fact that both companies admit to doing these things, and that in the meantime they have been caught red-handed doing other things, would strengthen any argument for new regulations.

Khan also fends off internal opposition from commissioners who (despite a unanimous vote to release the report) accuse him of trying to regulate speech or dictate business models. He handles these arguments with the confidence of someone already developing a proposal.

This proposal (if it exists) would likely aim to clip the wings of those companies that embody entire industries in themselves. As Khan says:

…It is the relative dominance of a few of these platforms that gives their data decisions and practices a disproportionate impact on Americans. When a single company controls a market and is not controlled by competitors, its policies can effectively function as private regulation. A consolidated market is also more susceptible to coordination with or co-optation by government. Unchecked private oversight of these platforms increases the risk of inappropriate government oversight. The way these markets are structured can result in greater risks to people’s basic liberties or greater protections for those liberties.

In other words, let’s not leave it up to them, and the FTC probably doesn’t intend to.