FTC Attempts End Run to Ban Meta from “Monetizing” Minors’ Data
The FTC took unprecedented action yesterday when it moved to impose what it describes as a “blanket prohibition” preventing the company from monetizing young people’s data. The FTC contends that this prohibition is warranted as a result of repeated violations of Meta’s 2020 consent order (“Proposed Order”).
In taking this action, the FTC is relying on its administrative authority to “reopen and modify” orders to address alleged order violations, rather than to press its compliance case in federal court under the FTC Act. In doing so, the FTC seeks to significantly expand the scope and duration of the existing order to cover new conduct. Even against recent examples of aggressive FTC action (see examples here, here, and here), this one markedly stands out. And, in the face of mounting agency losses in challenges to its enforcement authority in Axon and AMG and its aftermath, the Proposed Order is extraordinary.
The Commission voted 3-0 to issue the Proposed Order and accompanying Order to Show Cause. Commissioner Bedoya issued a statement expressing reservations about the “monetization” restrictions described below, specifically questioning whether the provision related to minors’ data is sufficiently related to either the 2012 or 2020 violations or order. Meta has 30 days to answer the FTC’s proposal.
Order to Show Cause
The FTC’s 2020 Consent Order, which was obtained in federal court consistent with prior Commission practice, was itself a modification of a 2012 order. If the FTC adopts the Proposed Order, it would be the third order stemming from a single administrative complaint that was filed more than a decade ago. That alone sets the FTC’s action apart from any other Commission action in memory.
The heavily redacted Order to Show Cause alleges that Meta violated several obligations under the 2020 Consent Order. The FTC did not release its Preliminary Finding of Facts, but it is evident that the first report filed by the independent assessor, Protiviti, under the 2020 Consent Order, is the underlying source behind many of the FTC’s allegations. It is notable that the only unredacted conduct relates to practices that predate entry of the 2020 order, which is strange, given that 2020 order contained terms broadly releasing Meta from all pre-2020 order violations.
Specific alleged order violations include deficiencies in risk assessment and third-party risk management processes, security controls, and transparency practices, among others. The Order to Show Cause also asserts that Meta misrepresented the extent to which third-party developers would have access to users’ nonpublic information. The FTC acknowledges that Meta corrected one of these alleged instances by July 2019, but nonetheless alleges that Meta violated the 2012 Consent Order, Section 5 of the FTC Act, and the COPPA Rule (a Rule not included in the prior orders) during this time period. This, of course, raises the question of why the FTC is moving on this now, fully four years after it was corrected by Meta.
The Proposed Order
The FTC’s Proposed Order would expand the 2020 Consent Order by permanently prohibiting Meta from “[c]ollecting, using, selling, licensing, transferring, sharing, disclosing, or otherwise benefitting from Covered Information from Youth Users” except for specific purposes, such as operating a service, performing authentication, or maintaining security. “Youth Users” include not only children under the age of 13 but also minors who are ages 13 through 17.
This provision specifically prohibits using Youth Users’ information for targeted advertising or to train or improve algorithms models. Although the FTC’s press release focuses on stopping Meta from “monetizing” minors’ data, the Proposed Order goes further by prohibiting Meta from “benefitting” from minors’ data, except as permitted by this paragraph.
The Proposed Order also would require specific safeguards and assessment requirements concerning Youth Users and “enhanced monitoring of higher risk Covered Third Parties” at least once per year.
And, remarkably, it would prohibit Meta from releasing new or modified products, services, or features without written confirmation from the assessor that the Meta privacy program complies with the order’s requirements and presents no material gaps or weaknesses. This is an extraordinary provision that would essentially turn the independent privacy assessor into the master of all new launches on Facebook, Instagram, WhatsApp, and Oculus, among other services.
Why Isn’t this in Federal Court?
The FTC’s authority to reopen an administrative order stems from Section 5(b) of the FTC Act:
[T]he Commission may at any time, after notice and opportunity for hearing, reopen and alter, modify, or set aside, in whole or in part any report or order made or issued by it under this section, whenever in the opinion of the Commission conditions of fact or of law have so changed as to require such action or if the public interest shall so require, . . .
In the past, the FTC has touted how it eases conditions in its orders in response to changes in legal or factual circumstances, usually in response to a respondent’s petition. One relatively recent example comes from 2018, when the FTC granted Sears’ petition to modify its 2009 order to exempt certain first-party, mobile app-based data collection from the order’s opt-in consent requirements. The FTC agreed to modify the definition of “Tracking Application” to exclude software programs that only engage in types of tracking consumers have come to expect, citing changes to the mobile application marketplace that make the collection and transmission of certain types of consumer data critical to support application features expected by consumers. In light of market realities and consumer expectations, the FTC recognized that the original notice and consent requirements were burdensome, unnecessary, counterproductive, and potentially confusing to consumers, who might mistakenly fear that Sears’ applications were unusual or used consumer data in unusual ways.
This decidedly is not what is happening here. The FTC is leveraging § 3.72(b) to attempt to impose new and onerous obligations – without having to make its case in federal court -- based on what it perceives as changed circumstances, not to ease an order obligation as warranted by changed facts and the public interest.
What Happens Next?
The FTC’s Rules of Practice provide scant details about what happens next. According to 16 C.F.R. § 3.72(b), after receiving an answer from Meta, the FTC may determine whether the matter “raises issues of fact to be resolved” and order a hearing. If the briefs for a hearing raise “substantial factual issues,” the Commission may order an evidentiary hearing. It is then up to the Commission to determine whether modifying the order is “in the public interest” – a determination that a court of appeals may review.
At this point, the reach of any such modification is anyone’s guess. The Order to Show Cause asserts that the “changed conditions” include not only violations of FTC orders but also violations of “Section 5, COPPA, and the COPPA Rule,” and that it has “good cause to believe the public interest” and these “changed conditions” require modifying the 2020 Consent Order.
In the end, it may be up to a federal court of appeals to determine whether these assertions are correct. It is also possible, however, that the Supreme Court’s recent decision in Axon clears a path to an early challenge to the Proposed Order in federal district court. In a statement released on the same day as the FTC’s announcement, Meta stated that “[w]e will vigorously fight this action and expect to prevail.”