‘Don’t lie’: FTC Commissioner Rebecca Slaughter on why today’s data privacy approaches don’t work (Audio Q&A)

The following excerpts of the June 30 interview have been edited for length and clarity. To hear the full conversation, listen to the audio above.

A federal judge just threw out the FTC’s antitrust lawsuit against Facebook, but the agency has a chance to rework its case. How can it strengthen its arguments?
Well, look, let me start by saying I voted to support the complaint here, so obviously I thought it had substantial merit and I was disappointed by the initial decision. But, I’m going to be careful to avoid further details to comment because we’re in the process of evaluating our options going forward for this specific case. I do think, as a general matter, it is our job as an agency to lay out the best case we can for the outcomes that are right for consumers, for workers, for markets and then if the courts interpret the law in ways that are problematic that helps Congress understand where the law needs to be changed.

Why do you think antitrust and data privacy are interconnected?
So I think the thing to understand is that antitrust analysis in data-driven markets has to understand the role of data in the accrual and exercise of market power. To the extent that data privacy issues involve the erosion of privacy in order to allow companies to accrue more data which they can then use to exercise market power potentially in anticompetitive ways, that’s a really important part of antitrust analysis.

On top of that, privacy can be a quality metric on which companies can compete, and in properly functioning markets, I think they would compete on privacy as a quality metric, just as companies compete on lots of other quality metrics. So, I think there are many different ways that these issues are intertwined, but the most important thing to me fundamentally is that to understand these data-driven markets we have to understand the role of data collection, data use, data sharing in the development of market power and how companies exercise it.

Is U.S. law set up to recognize how data plays a role in driving markets today?
Well, that’s exactly, I think, going to be one of the questions that Congress is currently evaluating, that the FTC is evaluating and that the public will have a chance to evaluate as not just the next steps for the FTC-Facebook lawsuit but also what happens in DOJ’s Google lawsuit.

How does the rulemaking group you helped establish while acting FTC chair change things?
My view was, let’s create a centralized process for the development of these rules, their legal analysis, the work that goes into them and be well-structured to execute these statutory responsibilities in a constructive, productive, efficient manner.

I will note that on our open meeting agenda tomorrow [July 1] one of the items that [FTC Chairwoman Lina Khan] listed is a proposal to bring the commission’s rules of practice in line with the statutory requirements we have for rulemaking in the consumer protection space. That change will fix a current self-imposed problem of commission rules that add unnecessary procedural hurdles and complexity to our rulemaking. And an additional process point that was important to me and that I hope will be important to the new chair is to take this opportunity to add an equity impact analysis to all of our new rules and into our existing rule reviews as they come up.

If those things are incorporated into the process, what does that mean in practice?
This is a little technical and in-the-weeds, but the FTC for consumer protection rules [have] a different process laid out in statutes than most agencies use when they do rulemaking. 

On top of that, over the sort of ’80s deregulatory period, the commission added into its rules a practice of a bunch of procedural hurdles and burdens to make the rulemaking on the consumer protection side even more difficult: making it more like formal judicial hearings than the informal hearings required by statute, for example, and adding complexity that really [isn’t] required by the statute. 

Sounds like this could help the FTC take advantage of its rulemaking powers in a way that it hasn’t in the past few decades?
I think that’s exactly the right way to understand it, that it’s very technical and legalistic but the effect at the end of the day is to allow us to properly execute our delegated statutory authority exactly as Congress directed us to do when it passed the law to begin with.

In your day-to-day, what would more money and more resources mean for you and your role as a commissioner?
Well, from the time I got to the FTC three years ago, the thing I heard over and over and over from the staff was that resources were the biggest constraint on our ability to do our work. That problem has only increased since then as markets have gotten more complicated, cases have gotten more expensive, the law has gotten less favorable, and on top of that, we’re in the middle of a massive merger boom. So more resources will allow us to hire more staff, build out our technical expertise, harmonize our strategies and workload across our mission areas, bring more complicated cases and litigate where we have to to get the right outcome rather than taking settlements that don’t really solve the problem because it’s too expensive or time-consuming or burdensome to litigate.

And [the 2019 Facebook settlement] was a good example of that. That was a case where what we could get the company to agree to I didn’t think was going to be adequate to solve the problem, and so we would just end up back in the same place with the same issues. Instead, I would have rather that we litigated to seek the right outcome, and if the courts came down differently, then that’s a problem with the law, not a problem with the agency’s efforts or resourcing.

So if the FTC had had more resources when it settled with Facebook in 2019, would it have litigated instead?
I just flag it as the kind of case where, to get to an outcome that is the right thing for consumers and workers and markets, we may not get companies to agree. We may need them, we may need to take them to court, and that is a very expensive endeavor.

Dark patterns are showing up in data collection notice and choice options presented to people. Why do you think it’s such an important issue?
So I think it’s worth taking a step back and recognizing that, at the federal level, we don’t have a specific privacy law. All of our data and privacy enforcement comes out of the FTC’s authority to challenge unfair and deceptive acts and practices, and most of the privacy framework is built around the deception problem. In other words, most of our privacy cases are ones in which someone has lied about what they are doing with data.

That reflects the notice and choice framework for data. Tell people what you are going to do with them and give them an option about whether to consent to that and don’t lie. I think that framework leaves an enormous amount to be desired in a general matter. I just don’t think notice and consent works in today’s [data-]driven economy and dark patterns illustrate exactly why. So even if you accept the concept of a notice and choice framework, dark patterns entirely undermine it by obscuring notice and impeding choice. So dark patterns I believe represent data practices that are not only deceptive but are also fundamentally unfair.

Will we see new rulemaking at the FTC related to dark patterns?
Well, I don’t want to prejudge any particular rules but I do think it makes sense for the FTC to explore how best we can use our statutory authority to address widespread unfair and deceptive practices on a market-wide rather than a case-by-case basis.