Federal Trade Commission

Privacy Impact Assessment

Wordpress

March 2012
2

The Federal Trade Commission (FTC) has prepared this privacy impact assessment (PIA) to 

analyze and explain how the FTC handles personally identifiable information (PII) about 

individuals that may be available to the agency through the FTC’s use of the blogging service 

Wordpress (www.wordpress.com). 

The purpose of this PIA is: (i) to ensure that the FTC’s handling of available PII conforms to 

applicable legal, regulatory, and policy requirements regarding privacy, (ii) to determine the 

risks and effects if the FTC were to collect, maintain or disseminate such information, and (iii) to 

examine and evaluate protections and alternative processes for handling such information to 

mitigate potential privacy risks. See Section 208 of the E-Government Act of 2002 (E-GOV); 

Office of Management & Budget (OMB) Memoranda 03-22 (2003) & 10-23 (2010). 

As explained below, the impact of the FTC’s Wordpress usage on individual privacy is low. The 

FTC’s Chief Technologist uses Wordpress to blog about the intersection of technology and the 

Federal Trade Commission. While the FTC deems the blog and its comments official agency 

records and will maintain those records in accordance with federal requirements, the FTC does 

not routinely use the Wordpress blog to solicit, collect, maintain, or disseminate PII from any 

individual. At the same time, however, the FTC suggests that individuals who visit or interact 

with the FTC’s blog carefully review Wordpress’ Terms of Service and its Privacy Policy to 

understand how Wordpress may collect or use their personal information, even if the FTC does 

not.

SECTION 1.0 – SPECIFIC PURPOSE OF THE FTC’S USE OF WORDPRESS

1.1 – What is the specific purpose of the agency’s use of Wordpress, and how does that use 

fit with the agency’s broader mission?

The Federal Trade Commission’s Chief Technologist uses Wordpress to blog about the 

intersection of technology and the FTC to boost the Commission’s credibility within the tech 

community. The blog: Tech @ FTC: Technology, Consumers, Innovation, is publicly available

at: www.techatftc.wordpress.com. 

Use of this blog allows the Chief Technologist to engage with readers at a level that is more 

technically sophisticated than the press releases and consumer and business education materials 

that the FTC disseminates to the general public. Many of the blog posts will reflect on current 

public cases, reports, testimony, and other information about the FTC in the news, and will direct 

users to relevant resources available on official FTC websites when available. 

1.2 – Is the agency’s use of Wordpress consistent with all applicable laws, regulations, and 

polices?

Yes. With respect to the information that the Chief Technologist will blog about, the FTC Act 

authorizes the FTC to prevent unfair and deceptive acts and practices in interstate commerce and, 

in furtherance of this mission, to gather, compile, and make information available in the public 

interest. See 15 U.S.C. 45, 46(a), (f).
3

The President’s January 21, 2009 memorandum on Transparency and Open Government and the 

OMB Director’s December 8, 2009 Open Government Directive call on federal departments and 

agencies to harness new technologies to engage with the public. Using a blog to communicate 

with a specific audience that the FTC is not otherwise communicating directly with through other 

resources helps the Commission achieve the goals of transparency, participation, and 

collaboration outlined in this federal guidance. 

The FTC’s use of Wordpress also complies with other applicable federal privacy and information 

security laws, including the Privacy Act of 1974, section 208 of the E-Government Act (EGOV), the Federal Information Security Management Act (FISMA), and implementing policy 

guidance. For example, per federal guidance issued under E-GOV, the FTC includes exit 

scripts/and other notices to consumers when linking from FTC websites to Wordpress, where the 

FTC’s privacy policy does not apply. An example of an FTC exit script for a third-party website 

from FTC.gov is available here. Furthermore, the FTC will place all appropriate disclosures, 

privacy notices, and comment policies in easily accessible pages throughout the blog. 

While the Tech @ FTC blog serves as a useful communication vehicle for the Chief 

Technologist to engage the tech community, the FTC’s primary websites (e.g., www.ftc.gov) 

remain the official sources of information available to the public about the Commission, as 

explained in notices posted on the blog and in this PIA.

SECTION 2.0 – IS THERE ANY PII THAT IS LIKELY TO BECOME AVAILABLE TO 

THE AGENCY THROUGH THE USE OF WORDPRSS?

2.1 – What PII will be made available to the FTC?

The FTC does not require visitors to the Tech @ FTC blog to submit PII to view the blog. Users 

who choose to engage with the blog by, for example, following the blog through Wordpress, 

subscribing to the blog via GovDelivery, or commenting on the blog, may make some of the 

following information available to the FTC: their name, email address, website, Twitter account, 

or Facebook page. 

2.2 – What are the sources of the PII?

Individuals who choose to engage with the Tech @ FTC blog provide any PII that is available to 

the FTC through Wordpress. Readers who simply view the blog do not make any PII available to 

the FTC. 

Individuals who choose to comment on the blog, may make some PII available to the FTC. 

Wordpress offers multiple ways to comment on blog posts: registered users of the site can login

and comment; individuals can post a name, email address, and (optional) link to their website to 

comment (only the comment and name appears on the post); or they can login through a 

registered Facebook or Twitter account. Comments are not moderated prior to publishing, so any 

information that the user provides as part of their comment becomes immediately available to the 

public.
4

Registered users who choose to subscribe to the blog may follow the blog through Wordpress, 

subscribe to the RSS feed, or use the FTC-provided option of subscribing to the blog via email 

through GovDelivery. The FTC’s use of any email addresses provided by users are outlined in 

the GovDelivery PIA. 

Commenters also have the option of signing up with Wordpress to receive email notices when 

other people comment on their comment.

Wordpress may collect other PII from registered users of the site and Wordpress may use 

persistent tracking technologies for analytics and other uses, as outlined in its privacy policy, but 

the FTC does not have access to any of this information. 

2.3 – Do the FTC’s activities trigger the Paperwork Reduction Act (PRA) and, if so, how 

will the agency comply with the statute? 

Per the OMB memorandum, Social Media, Web-Based Interactive Technologies, and the 

Paperwork Reduction Act (April 7, 2010), the FTC’s use of Wordpress as outlined in Section 1.1 

does not trigger the PRA, since the FTC’s use of Wordpress is not an information collection 

activity under that law. 

SECTION 3.0 -- THE FTC’S INTENDED OR EXPECTED USE OF PII

Section 3.1 – Generally, how will the agency use the PII described in Section 2.0?

In addition to posting its own Wordpress entries, which will not contain PII, the FTC may read, 

review, or rely upon information, including PII, that may be voluntarily provided by individuals 

who choose to engage with the Chief Technologist on Wordpress (e.g., by following the blog or 

commenting on it). All blog posts and corresponding comments that do not violate the FTC’s 

posted comment policy will be collected on a routine basis as part of the agency’s federal records 

requirements.

In addition, the FTC may use analytical data from Wordpress regarding visitors to the blog, but 

those analytics do not contain or use PII. 

Section 3.2 – Provide specific examples of the types of uses to which the PII may be subject.

The FTC may read, review, or rely upon information provided by individuals in comments on 

Wordpress. The FTC routinely collects and maintains copies of blog posts and comments in 

accordance with federal record retention requirements. 

As already noted, the FTC may also use analytics from Wordpress to measure the value of the 

blog and assess the level of engagement with the public. These analytics include site stats such as 

number of visitors, number of comments, referrers, top posts, clicks, follows, shares, search 

terms, and other relevant data, but no PII.
5

SECTION 4.0 -- SHARING OR DISCLOSING OF PII

Section 4.1 – With what entities or persons inside or outside the agency will the PII be 

shared, and for what purposes will the PII be disclosed?

The primary FTC staff members with access to PII from Wordpress are the Chief Technologist 

(editor of the blog), and the Office of Public Affairs’ Social Media Strategist. However, 

comments are not moderated prior to publishing, so any information available to the FTC from 

commenting on posts is simultaneously made publicly available to anyone visiting the blog. 

Unless comments violate the FTC’s posted comment policy, they will remain on the blog. The 

FTC does not maintain records of comments that are deleted, to minimize privacy risk and 

reduce the amount of information that must be retained.

Section 4.2 – What safeguards are in place to prevent expansion of uses beyond those 

authorized under law and described in this PIA?

Only limited and approved staff members have administrative access to the Tech @ FTC blog. 

Prior to beginning account administration, each staff member with access must sign and agree to 

comply with the Commission’s internal Rules of Behavior for account management.. 

SECTION 5.0 -- MAINTENANCE AND RETENTION OF PII

Section 5.1 – How will the FTC maintain the PII, and for how long?

As explained earlier, any PII made available to the FTC on its Wordpress blog is also made 

available to the public. The FTC shall retain copies of the Chief Technologist’s blog posts and

comments in accordance with federal record retention requirements. Blog posts and comments 

are retained and disposed of in accordance with applicable schedules issued or approved by the 

National Archives and Records Administration. 

The Chief Technologist may routinely delete comments that violate the FTC’s comment policy, 

which is on the blog. The FTC does not maintain any record of deleted comments and it does not

notify users that their comments have violated the comment policy and been deleted.

Section 5.2 – Was the retention period established to minimize privacy risk?

Yes. Per the FTC’s own privacy policy, the FTC does not collect any unnecessary information, 

including PII, to minimize privacy risk and reduce the amount of information that must be 

maintained. Commenting or otherwise engaging with the blog is wholly optional, and doing so 

may make minimal PII available to FTC staff and the public. Users should consult Wordpress’ 

privacy policy to determine the retention period for any PII or other user content that may be 

retained by Wordpress.
6

SECTION 6.0 – HOW THE AGENCY WILL SECURE PII

Section 6.1 – Will the FTC’s privacy and security officials coordinate to develop methods of 

securing PII?

Not applicable. See Sections 2.0 and 5.0. Wordpress, not the FTC, controls the security of 

comments or other information posted on that site. Any PII made available to the FTC via 

commenting is simultaneously available to the public. Blog readers should review Wordpress’ 

terms of service and privacy policy for information regarding the security of that site. Any FTC 

copies of comments or other blog engagement maintained by the FTC are subject to applicable 

federal privacy and information security laws, and such copies may include some limited PII the

user makes public by engaging with the FTC via Wordpress.

SECTION 7.0 – IDENTIFICATION AND MITIGATION OF OTHER PRIVACY RISKS

Section 7.1 – What other privacy risks exist, and how will the agency mitigate those risks?

Wordpress is a third-party service that may use persistent tracking technologies. In an effort to 

help consumers understand how their information is used by Wordpress, the FTC posts a privacy 

notice on its Tech@FTC blog encouraging users to read the Wordpress privacy policy. 

When linking to Wordpress from FTC websites, users will encounter an exit script with 

notification that they are leaving a government website, and that the Commission’s privacy 

policy no longer governs. This exit script also includes a link to Wordpress’ privacy policy.

Per the terms of service negotiated by the General Services Administration and Wordpress, the 

FTC’s Tech@FTC blog does not contain any third-party advertising. This limits any association 

with, or obscure links to, additional content that the FTC has neither reviewed nor endorsed on 

the blog. In addition, Wordpress users should review the site’s terms of service and privacy 

policies to understand how Wordpress may collect information about such users, particularly 

those who choose to comment on the blog. 

Users should also exercise care and be aware of the risks associated with any third-party website, 

particularly as to any tracking technology (e.g., cookies, beacons) and potentially interactive 

content (e.g., links, videos, games, applications, messaging, or other features or functions) that 

may collect, use, or share the user’s personal information, or compromise the user’s computer 

security, without the user’s knowledge or consent (e.g., malware, spyware, phishing). 

The FTC routinely reviews Wordpress’ privacy policy for any changes that may affect the FTC’s 

use of Wordpress and will update its privacy policies on Wordpress, FTC.gov websites, and this 

PIA.
7

SECTION 8.0 – CREATION OR MODIFICATION OF A SYSTEM OF RECORDS

Section 8.1 – Will the FTC’s activities create or modify a “system of records” under the 

Privacy Act of 1974?

The FTC’s collection of comments and blog posts for records purposes of blog engagement does

not create or modify a system of records under the Privacy Act of 1974. None of the comments 

saved are maintained in any system of records retrieved by name or other personally assigned 

identifier. If any miscellaneous comments or blog posts are incorporated into, or otherwise 

maintained and retrieved from such a system, please see FTC Privacy Act System FTC-I-1, for a 

description of such records. A copy of that system of records notice is posted at: 

http://www.ftc.gov/foia/listofpaysystems.shtm. 
8

Prepared for the Business Owners of the System by:

_______________________________________ Date: __________

Cheryl Hackley

Office of Public Affairs

Review:

_______________________________________ Date: __________

Alex Tang

Office of the General Counsel

_______________________________________ Date: __________

Peter Miller

Acting Chief Privacy Officer

_______________________________________ Date: __________

Jeffrey Nakrin

Director, Records and Filings Office

_______________________________________ Date: __________

Jeffrey Smith

Information Assurance Manager

Approved:

_______________________________________ Date: _________

Jeffrey Huskey

Chief Information Officer