Newsroom

Dear Chairman Upton and Ranking Member Pallone: We, the undersigned consumer and public interest groups, write regarding the “FTC Process and Transparency Reform Act of 2016,” a discussion draft advanced by the Subcommittee on Commerce, Manufacturing, and Trade to the full Committee that would alter the processes used by the Federal Trade Commission (FTC) to carry out its work. We are very concerned that the legislation would harm the FTC’s ability to crack down on scam artists and protect consumers from unfair, misleading, or anticompetitive business practices. Among other concerns, we are troubled that the legislation would: Thoroughly undermine the FTC’s enforcement capabilities. By allowing “[c]ompliance with any guidelines, general statement of policy, or similar guidance issued by the Commission” to be used as evidence of compliance with the law—rather than merely as evidence of a good­faith effort to comply with the law—the legislation could thoroughly undermine the Commission’s enforcement of the FTC Act. A company that is the target of an enforcement action or subject to a consent order could hunt for and cite a wide variety of general statements by the agency to evade liability for violating the law. Under these circumstances, the FTC might have to rescind the guidance it has given to businesses and consumers, and stop giving new guidance, in order to preserve its enforcement capabilities. Constrain the FTC’s authority to find that a business practice is unfair. By casting in statutory concrete portions of the FTC’s 35­year­old Policy Statement on Unfairness, but leaving out key context and references, the legislation would constrain and rigidify the agency’s authority to find that an act or practice is unfair. We are particularly concerned it would undermine the agency’s authority to find that an act or practice is unfair even though it may not directly cause physical effects, such as harassing late-night telephone calls. End investigations arbitrarily. By requiring the termination of any investigation after six months, unless the FTC sends the target of the investigation a written communication or votes to keep the investigation open, the legislation could result in critical investigations ending arbitrarily or their confidentiality being compromised. The FTC should have the flexibility to prioritize its time working on investigations in a manner consistent with the public interest, and to take the time necessary to determine how best to protect consumers. Weaken the FTC’s ability to prevent repeat offenses. By setting a shorter, eight-year standard length for FTC consent decrees, and requiring the FTC to justify continuing non­fraud decrees for more than five years, the legislation would weaken the FTC’s ability to prevent repeat offenses. The FTC can in most cases only fine a company—and thus penalize a repeat offense—for violating an order, not simply for re­committing the offense itself. The FTC’s work to promote competition and protect consumers from unfair or deceptive acts or practices is essential to the fair functioning of the marketplace. For over a century, the agency has stood up for the interests of consumers when threatened by unlawful behavior, such as predatory sales tactics, false advertising, price fixing, or abusive communications. The Commission—operating on a bipartisan basis and often via consensus—investigates consumer complaints and takes legal action as appropriate to stop illegal practices and deter others from engaging in them. As a result of these actions, consumers enjoy a far fairer, far more reasonable and dependable marketplace than otherwise would exist, and businesses operating fairly and honestly are rewarded with a more level playing field. We urge you not to report legislation to the full House that would undermine the FTC’s critical work. For any additional information, please contact William Wallace at Consumers Union, , 202-462-6262. Sincerely, Agriculture and Trade Policy Americans for Financial Reform Center for Democracy & Technology Center for Digital Democracy Center for Science in the Public Interest Common Sense Kids Action Constitutional Alliance Consumer Action Consumers for Auto Reliability and Safety Consumer Federation of America Consumer Federation of California Consumers Union Consumer Watchdog Families Rally for Emancipation and Empowerment Food & Water Watch Free Press Action Fund Funeral Consumers Alliance Georgia Watch Institute for Agriculture and Trade Policy (IATP) Knowledge Ecology International Massachusetts Consumers’ Council, Inc. Media Alliance National Association of Consumer Advocates National Consumer Law Center Privacy Times Public Citizen Public Good Law Center Public Health Advocacy Institute at Northeastern University School of Law U.S. PIRG Virginia Citizens Consumer Council Virginia Poverty Law Center World Privacy Forum

Alvaro Bedoya, Center for Digital Democracy, Common Sense Kids Action, Consumer Action, Consumer Federation of America, Consumer Watchdog, Privacy Rights Clearinghouse, and U.S. PIRG The “Privacy Best Practice Recommendations for Commercial Facial Recognition Use” that have finally emerged from the multistakeholder process convened by the National Telecommunications and Information Administration (NTIA) are not worthy of being described as “best practices.” In fact, they reaffirm the decision by consumer and privacy advocates to withdraw from the proceedings. In aiming to provide a “flexible and evolving approach to the use of facial recognition technology” they provide scant guidance for businesses and no real protection for individuals, and make a mockery of the Fair Information Practice Principles on which they claim to be grounded. That is not surprising. It was clear to those of us who participated in this process that it was dominated by commercial interests and that we could not reach consensus on even the most fundamental question of whether individuals should be asked for consent for their images to be collected and used for purposes of facial recognition. Under these “best practices,” consumers have no say. Instead, those who follow these recommendations are merely “encouraged” to “consider” issues such as voluntary or involuntary enrollment, whether the facial template data could be used to determine a person’s eligibility for things such as employment, healthcare, credit, housing or employment, the risks and harms that the process may impose on enrollees, and consumers’ reasonable expectations. No suggestions are provided, however, for how to evaluate and deal with those issues. If entities use facial recognition technology to identify individuals, they are “encouraged” to provide those individuals the opportunity to control the sharing of their facial template data – but only for sharing with unaffiliated third parties that don’t already have the data, and “control” is not defined. Just as there is nothing that “encourages,” let alone requires, asking individuals for consent for their images to be collected and used for facial recognition in the first place, there is nothing that “encourages” offering them the ability to review, correct or delete their facial template data later. The recommendations merely “encourage” entities to disclose to individuals that they have that ability, if in fact they do. Further, if facial recognition is being used to target specific marketing to, for example, groups of young children, there is no “encouragement” to follow even these weak principles. There is much more lacking in these “best practices,” but there is one good thing: this document helps to make the case for why we need to enact laws and regulations to protect our privacy. If this is the “best” that businesses can do to address the privacy implications of collecting and using one of the most intimate types of individuals’ personal data – their facial images – it falls so short that it cannot be taken seriously and it demonstrates the ineffectiveness of the NTIA multistakeholder process.

In the Matter of Petition of Public Knowledge, Center for Digital Democracy, Consumer Watchdog, Consumer Federation of America, and TURN —The Utility Reform Network Introduction: 47 U.S.C. §551 and 47 U.S.C. § 338(i) (collectively referred to as “privacy rules”) require that cable and satellite providers (herein referred to as “cable operators”) obtain the “written or electronic consent of the subscriber concerned” prior to the collection and use of that information for advertising purposes. Cable operators are also required to provide a written statement to their subscribers, which clearly and conspicuously informs the subscriber of the nature of the use of their personally identifiable information. Through these rules, Congress and the Federal Communications Commission have emphasized the importance of giving consumer’s control over how their information is being used. Despite this, cable operators have continued to use large amounts of their customers’ data without properly obtaining customer consent or informing subscribers of the extent of the use of their information. The Commission should enforce the relevant privacy provisions to ensure that cable operators only use subscriber information when they have the consent required by law. Cable Operators Collect and Share Large Amounts of Customer Data to Generate Targeted Advertising. The use of consumer data to target consumers for advertising is on the rise. Exactly how and to what extent cable operators are leveraging their customer’s data has been extensively documented in a recent report by the Center for Digital Democracy. Cable operators increasingly gather their customers’ personal information, share and combine that information with third parties, and use it to target customers for advertising on an individual level. Verizon, Comcast, Google, AT&T, Time Warner, Cablevision and others have incorporated powerful layers of data collection and digital marketing technologies to better target individuals. AT&T’s TV Blueprint, for example, “gives advertisers working with AT&T the ability to reach people based on factors like device, operating system, whether or not they’re heavy data users or the status of their carrier contract,” using “sophisticated second-by-second set- top box data” and other information. AT&T pulls data “from millions of set-top boxes” and analyzes consumer viewing history and uses these data to target consumers based on their viewing profile. Companies like Cablevision leverage granular data and precise details of household viewing behavior, and combine it with third-party data covering other intimate details of consumers’ lives to analyze and target specific individuals with video advertising across a range of screens. In their own words, “this set-top box level targeting lets marketers target customers that fit particular trends, profiles, demographics and attributes, and they can also pair the Cablevision data with their own or third-party data.” Cablevision and AT&T are not alone in their pervasive use of consumer data. Comcast recently acquired Visible World, which boasts of using data “from millions of enabled Smart TVs” as part of its advertising targeting service. Data points used to target consumers include income, ethnicity, education level, what kind of car they drive, purchase history, and location of their residence. Further, Comcast has acquired companies like This Technology, which is capable of inserting personalized content into network streams—including advertising messages tailored for specific individuals. These programs illustrate how cable providers give advertisers the ability to easily access and use a customer’s information, without that customer knowing the extent to which that information is being used. While these practices are broadly indicative of the ways many cable operators improperly use subscriber data, AT&T, Cablevision, and Comcast are among the most egregious. The Commission should investigate these practices and find that they violate the privacy rules. --- Full filed complaint attached below.

The Center for Digital Democracy (CDD), a nonprofit organization representing the interests of consumers in the digital marketplace, strongly supports the Federal Communication Commission’s (FCC) proposal to empower individuals to make effective decisions regarding their privacy on broadband networks. Broadband Internet access service (BIAS) plays a powerful and distinctive role in the commercial digital media marketplace, requiring precisely the set of sensible safeguards offered by the Notice of Proposed Rulemaking (NPRM). CDD believes it is entirely necessary and consistent with the Communications Act that the commission extend longstanding consumer-protection policies for the telephone network into the modern broadband context. The role of the network in the broadband marketplace has a distinct purpose compared to so-called “edge” content providers: to facilitate a fairly managed and efficient connection between the subscriber/consumer and the content and/or services of their choice. Given their network-management role, BIAS providers have unique capabilities in terms of monitoring the communications and activities of their subscribers, enabling the capture and use of an extensive array of personal and other consumer information. Positioned by necessity at the center of subscribers’ wireline or wireless broadband use, and holding a “digital key” that can help analyze much of their users’ digitally connected behaviors, BIAS providers have unlimited opportunities to influence the decisions consumers make via data-collection-related applications and services. Consumers today confront a far-reaching and largely invisible data-gathering apparatus that tracks and analyzes their every move online. For example, as the FTC has acknowledged, the growth of cross-device tracking, enabling the identification of a particular consumer’s use of personal computers, mobile phones, tablets, and increasingly even television, and combining multiple sources of data for the development of a targeting profile, illustrates how recent advances in digital data collection pose growing threats to consumer privacy. Indeed, the journal of the Association of National Advertisers explained just last month, “cross-device marketing … allows unprecedented access to individual consumers via personal or shared household devices. … Data-driven cross-device marketers gain exclusive access to a slew of advantageous marketing enhancements, including consistent messaging across all devices … .” Leading BIAS providers promise such cross-device targeting capabilities. Lacking the ability to enact regulations to protect privacy (except for children 12 and under), the FTC has been powerless to ensure consumer protection from cross-device tracking practices, let alone from the growing myriad of practices that gather consumer data from social media, mobile app, online video usage, programmatic targeting, and many other practices. Without the authority to issue regulations on privacy-related matters connected to consumer financial services, for example, the FTC has been forced to rely on its Section 5 authority related to unfair and deceptive practices. In practical terms, this has enabled the digital-data industry to recognize that there are no real constraints to their rapidly expanding collection, analysis, and use of consumer data. The FTC has long recognized that its inability to issue regulations has placed the agency at a serious disadvantage, and has called for the enactment of new regulatory authority. For example, as former FTC Chairman Jon Leibowitz testified before Congress in 2009, in order for the agency “to perform a greater and more effective role protecting consumers … changes in the law and additional authority to promulgate needed rules …” are required. As CDD explained in its March 2016 report on the growth of digital data gathering by leading ISPs (and filed separately in this proceeding), companies such as ATT, Comcast, Verizon, Cablevision, and Charter have made significant investments in their ability to capture, process, and take advantage of a consumer’s information across all the devices they use daily. They are using cloud- and IP-based management systems to deliver data-connected advertising and marketing; have invested in or allied with real-time programmatic marketing technologies that, in milliseconds, make personalized ad-related decisions on which consumers to target and for what product; and have acquired numerous companies that strengthen their hold and use of consumer information, including data gathered by their consumers’ use of apps, online video, and mobile phones... Key characteristics of the BIAS data collection apparatus include: [see attached comments for full submission]

Katharina Kopp, Ph.D., will join the Center for Digital Democracy (CDD) on 6 June 2016 as its deputy director and director of policy. Dr. Kopp comes to CDD with decades of experience as an advocate, scholar, policy analyst, privacy expert, and corporate leader. She will develop and oversee a range of new initiatives at CDD, expanding the scope of its work on the role and impact of “Big Data” in contemporary society. Dr. Kopp will focus particularly on developing new policies to advance individual autonomy and consumer protections, as well as social justice, equity, and human rights. She will also play a leadership role in the organization’s ongoing constituency-building and grassroots efforts. Dr. Kopp worked with the Center for Media Education during the 1990’s and served as a key policy advocate during the passage and implementation of the Children’s Online Privacy Protection Act (COPPA). In addition to her work with the Aspen Institute, the Benton Foundation, and the Health Privacy Project, Dr. Kopp served as vice president at American Express, leading its global privacy risk management program. Most recently she was the director of the Privacy and Data Project at the Center for Democracy and Technology. “We are privileged to have Katharina Kopp join CDD,” said Jeff Chester, its executive director. “Her unique leadership qualities and rich background will shape the organization’s agenda in this important new phase of our work. This includes forging partnerships with global NGOs, research institutions, and community-based organizations.” Dr. Kopp, deputy director, added: “I look forward to exploring the effects of technology and discriminatory data practices on democracy and social justice, particularly the effects on individual autonomy and increasing inequality. How to respond to these trends with appropriate public policy will be core to my work. Furthermore, I want to see CDD engaged in shaping the public’s understanding of these processes and to frame the solutions not in individualistic but collective and systemic terms. I believe that this will be key to the success of any policy proposals.” The Center for Digital Democracy is a leading nonprofit organization focused on empowering and protecting the rights of the public in the digital era. Since its founding in 2001 (and prior to that through its predecessor organization, the Center for Media Education), CDD has been at the forefront of research, public education, and advocacy protecting consumers in the digital age.