The FTC convened its eighth annual privacy conference on March 6, 2024.  The full transcript of the event can be found here.   Both Chair Khan and Commissioner Bedoya provided remarks during the event that are likely to be considered provocative by many.

Commissioner Khan’s remarks focused on what she referred to as three key high-level principles that are driving the FTC’s privacy efforts:

• Business Incentives Driving Unlawful Conduct:  She noted that “enforcement actions are designed to account for how business incentives are driving unlawful conduct,” and she pointed to AI model training and machine learning as “features that could further incentivize firms to be collecting a lot of user data.” 
• Sensitive Data:  Another principle Chair Khan emphasized was that selling sensitive data can be presumptively off limits in at least some circumstances, referring to the FTC unfairness actions in recent months against companies selling sensitive data without permission.
• Upstream Liability:  Chair Khan noted that the FTC will look upstream to establish liability and pinpoint actors that “are driving or enabling unlawful conduct on a massive scale.”  As evidence, she pointed to enforcement actions against data brokers and emphasized that the FTC is “looking past the consumer focused applications and zeroing in on the backend infrastructure that is facilitating the commercial surveillance ecosystem.” 

Additionally, Commissioner Bedoya spoke during the conference and emphasized the following themes based on enforcement actions:

• Outright Bans on Specific Practices:  Commissioner Bedoya reflected a trend where FTC enforcement actions seek “outright bans on specific commercial practices,” referencing model deletion where those models have been built using allegedly illegally obtained data or through illegal practices. 
• Sensitive Data:  Echoing Chair Khan’s remarks, Commissioner Bedoya noted the FTC’s emphasis on sensitive data.  Importantly, he noted that “sensitive data usually doesn’t require further identifiers in order to be sensitive and require protection” and that this is a “really long way of saying something that our technology blog said much more simply” that “browsing and location data are sensitive, full stop.”
• Retention:  Commissioner Bedoya also noted that the FTC will be “skeptical” of claims that data needs to be retained for long periods of time.  He stated that data generates value, “whether it’s used for advertising or to train a machine learning model.” 
• Teen Privacy:  Commissioner Bedoya further stated that he would “press companies to set privacy settings for children and teens, at their maximum.”  Referencing “design practices” that keep teens online longer than they want to or content recommendation systems, he noted that these “merit careful scrutiny.”
• Algorithmic Discrimination:  The FTC will also continue to scrutinize algorithmic decision-making systems “when they substantially injure people,” such as through biased algorithmic decisions. 

We will continue to cover this and other FTC developments on the blog.