FTC’s Current Regulatory Model Works Well for Online Privacy, But Has Limits, Commissioner Ohlhausen Says

The FTC’s notice and consent-based regulatory model has worked fairly well, but it has its limits, FTC Commissioner Maureen Ohlhausen said Thursday at an International Association of Privacy Professionals conference. FTC Commissioner Julie Brill, in a separate event at the same conference, had discussed moving away from that model -- and toward a model that focuses on data use. “We've done pretty well with the deception-based model, and I wouldn’t want to give that up too easily,” Ohlhausen said. “With that being said, I think there is a role for unfairness. … But I think it’s important for us to follow the guidance Congress has set out in the statute for unfairness.” The FTC can declare a specific company action as deceptive or unfair -- and therefore unlawful -- under Section 5 of the FTC Act.

Ohlhausen said she’s also “standing back and seeing how things play out” on the development of Do Not Track (DNT) online privacy features. The debate is now between competing models championed by the World Wide Web Consortium and the Network Advertising Initiative, she said. “I think that there’s some appeal, it’s really important for some consumers to have this choice,” Ohlhausen said. “We need to pay careful attention to how it will be done. Is there going to be an enforcement mechanism? … Will it give them what they expect?” She said she’s also looking at DNT for possible competition issues.

Consumer demographics play a “very important” role in FTC rulemaking, Ohlhausen said. It’s helpful for the FTC to examine privacy enforcement through its deception guidelines because those guidelines are flexible, which is particularly helpful because perceptions of appropriate levels of online privacy vary widely among different age groups, she said. “I think it’s very important that we give consumers information and they make their choices,” Ohlhausen said. “We make sure their choices are respected."