Federal Trade Commission
 

Privacy Impact Assessment
 

Twitter
 

June 2013
 
 

 

 

 

 

 

 

 

SECTION 1.0 – SPECIFIC PURPOSE OF THE FTC’S USE OF TWITTER 

1.1 – What is the specific purpose of the agency’s use of Twitter, and how does that use fit 

with the agency’s broader mission? 

The Federal Trade Commission (FTC or Commission) uses Twitter, a microblogging website 

(i.e., a blog consisting of short posts or messages limited to 140 characters), to disseminate 

information to the public. Currently, the FTC maintains four Twitter accounts. Two accounts: 

“@FTC” in English and “@laFTC” in Spanish, are administered by the Office of Public Affairs 

(OPA). Three accounts, “@JulieBrillFTC,” “@MOhlhausenFTC,” and “@Josh_WrightFTC”, 

are managed by Commissioners Julie Brill and Joshua D. Wright, respectively. The sixth and 

final account, “@TechFTC”, is managed by the FTC’s Chief Technologist. 

http://twitter.com/FTC 

http://www.twitter.com/laFTC 

http://www.twitter.com/JulieBrillFTC 

http://www.twitter.com/MOhlhausenFTC 

http://www.twitter.com/Josh WrightFTC 

http://www.twitter.com/TechFTC 

The FTC Twitter pages are public, so anyone can visit the pages and read the agency’s tweets, 

even visitors who are not registered Twitter users. In contrast, only registered users can post 

tweets on Twitter, and tweets from other users do not show up in the FTC’s home streams unless 

retweeted by an FTC account. 

Twitter allows the FTC to promote information, tips, and resources to consumers and 

organizations that may not be regular visitors to FTC websites. Information (“tweets”) posted to 

FTC Twitter accounts is generally content that already exists on FTC.gov and FTC.gov/espanol 

or is relevant information from the Bureaus of Consumer Protection, Competition, and 

Economics, as well as other offices of the FTC, and including the Commissioners and Chief 

Technologist. 

Typical tweets may include, but are not limited to, consumer and business tips and information 

as well as links to photos, news articles and short videos. OPA approves the content of all @FTC 

and @laFTC tweets, including, but not limited to, press releases, speeches, and information from 

the Bureaus of Consumer Protection, Competition, and Economics, as well as other offices of the 

FTC. Tweets that reflect the opinions of individual Commissioners, the Chairman or other FTC 

staff members are attributed appropriately. Tweets from @JulieBrillFTC and @Josh_WrightFTC 

are sent by the Commissioners. Tweets from @TechFTC are sent by the agency’s Chief 

Technologist, and although the latter accounts are official FTC accounts, tweets do not represent 

the opinions of the Commission. 

Tweets/Retweets 

The Commission promotes FTC resources to the public. These tweets will all appear in reverse 

chronological order in the FTC’s profile pages. Additionally, any Twitter users who indicate that 

they “follow” an FTC account will receive that information in their Twitter “stream” called the 

2 
 

 

timeline. In turn, users may share the FTC’s resources with their network of Twitter followers 

(generally done by sending out the same tweet and giving credit to the FTC’s original tweet, 

called a “retweet” and abbreviated as RT) and others can do the same, providing a viral 

marketing component to the Commission’s outreach and education efforts. 

Mentions 

If a registered user posts a tweet that includes the FTC’s account handles (@FTC, @laFTC, 

@JulieBrillFTC, @MOhlhausenFTC, @Josh_WrightFTC and/or @TechFTC), this is called a 

mention. The tweet will appear in the user’s profile and home stream as well as the timelines of 

all followers of that user. Additionally, that tweet will show up in the interactions stream of the 

FTC account. 

If a user posts a tweet with @FTC, @laFTC, @JulieBrillFTC, @MOhlhausenFTC, 

@Josh_WrightFTC, or @TechFTC at the beginning of the tweet, it will only show up in the 

home streams of users who follow both that user and the FTC account. However, all public 

tweets (meaning the account is not locked or protected) are searchable by anyone on Twitter’s 

website (or other third party sites linked to Twitter) so anyone can do a search of mentions of 

@FTC, @laFTC, @JulieBrillFTC, @MOhlhausen,@Josh_WrightFTC or @TechFTC on 

Twitter. 

Public tweets may also be picked up by other search engines (e.g., Bing, Google, Yahoo!) or 

aggregator sites or applications outside of Twitter. The FTC cannot delete tweets sent by other 

users even if they mention an FTC account, but the FTC can block Twitter users or other 

messages (see below) being received from accounts that are deemed as harassing toward the 

FTC. Additionally, “spam” style Twitter accounts can be reported and Twitter will investigate 

and delete the account if necessary. 

Direct Messages 

Private messages between registered Twitter users are called “Direct Messages”. These messages 

are stored in a “Direct Message file” accessible only to the registered Twitter user. Only another 

registered user whom you follow can send you a direct message (and you must follow them to 

send them one back). 

1.2 – Is the agency’s use of Twitter consistent with all applicable laws, regulations, and 

polices? 

The President’s January 21, 2009 memorandum on Transparency and Open Government and the 

OMB Director’s December 8, 2009 Open Government Directive call on federal departments and 

agencies to harness new technologies to engage with the public. Twitter has over 200 million 

active users. Using tools like Twitter helps the FTC to communicate with consumers on 

platforms where they’re active, which in turns helps the FTC meet the federal guidance outlined 

in the directive and memorandum including the goals of transparency, participation and 

collaboration. 

With respect to the information that the FTC will disseminate through its Twitter accounts, the 

FTC Act authorizes the FTC to prevent unfair and deceptive acts and practices in interstate 

3 
 

 

 

 

 

commerce and, in furtherance of this mission, to gather, compile, and make information 

available in the public interest. See 15 U.S.C. 45, 46(a), (f). 

Per federal guidance, the FTC includes exit scripts/and other notices to consumers when linking 

to Twitter from FTC websites who opt to visit a third-party site where the FTC’s privacy policy 

does not apply. An example of an FTC exit script for Twitter is available here. Additionally, 

notices are placed as appropriate on each FTC account informing visitors that Twitter’s privacy 

policy governs on the site. 

SECTION 2.0 – IS THERE ANY PII THAT IS LIKELY TO BECOME AVAILABLE TO 

THE AGENCY THROUGH THE USE OF TWITTER? 

2.1 – What PII will be made available to the FTC? 

Twitter requires users to provide their first name, last name, a valid email address, and a 

password, with the option to provide additional information in their biography when they register 

an account. Even though some of this information may be accessible to the FTC, depending on a 

Twitter user’s privacy settings (users can protect their tweets by a private account setting), the 

FTC does not intend to collect, disseminate, or maintain any of the information provided to 

Twitter. 

The FTC may, however, read, review, or rely upon information that individuals make available 

to the public or to the FTC on Twitter, including tweets that may appear on the @FTC, @laFTC, 

@JulieBrillFTC, @MOhlhausenFTC, @Josh_WrightFTC or @TechFTC interactions pages, as 

authorized or required by law (e.g., if there is evidence of a law violation). 

The FTC routinely monitors FTC-related keyword on Twitter and other third-party applications 

in an effort to determine what kind of public attention the FTC is generating online. Generally, 

comments that the FTC may collect or maintain as part of such review would be collected and/or 

maintained without the individual Twitter handle that identifies them. The Office of Public 

Affairs may elect to include Twitter handles in the following instances: 

- Twitter handles of news organizations, journalists, and influential blogs and bloggers 

may be collected and distributed for use in daily news clips to lend credibility to tweets; 

- Use of Twitter handles may be collected and maintained as an official record during 

interactive Twitter chats or other live events hosted by the FTC; and 

- When answering questions directed to @FTC, @laFTC, @JulieBrillFTC, 

@MOhlhausenFTC, @Josh_WrightFTC, or @TechFTC, the FTC may collect and 

maintain comments, including the Twitter handles of those users who posted the 

questions. 

In the instances listed above, the FTC intends to keep a record of the information (generally a 

screen shot of the comment saved as a PDF electronically and on paper), but does not intend to 

collect or maintain the records in any type of database from which the records will be retrieved 

4 
 

 

specifically by a Twitter handle. The FTC does not strive to collect every tweet about the agency 

– only tweets of significance to the Commission’s missions. 

Although the FTC does not collect information other than comments with their corresponding 

Twitter handles from users who discuss the FTC online, users should be aware that the United 

States Library of Congress, through separate arrangement with Twitter, is maintaining an 

electronic archive of all public tweets, and intends to make them publicly available within a sixmonth window from the date of the tweet. The FTC understands that private account information 

(private profiles or direct messages) will not be part of the Library of Congress archive nor will 

links or photos associated with those tweets. In addition, as noted earlier, a user’s public tweets 

will also be accessible to the public through Twitter itself and through other, non-Governmental 

search engines, aggregators, and applications. 

Users interested in more information about Twitter’s privacy policy should review it online. 

Finally, the FTC may collect general analytics from Twitter on a regular basis including the 

numbers of followers, number of retweets, etc. The Twitter analytics tool automatically makes 

other information available to the FTC, including sex, location, interests, and other handles the 

FTC’s follower’s follow; however, the FTC does not plan to collect or track any of this 

additional information. 

2.2 – What are the sources of PII? 

The FTC does not have access to the information that Twitter collects to register for the site. The 

FTC does have access to information that users post to their public profiles. This includes name 

(real or pseudonym), Twitter handle, location, and any additional information they post in their 

biography. 

2.3 – Do the FTC’s activities trigger the Paperwork Reduction Act (PRA) and, if so, how 

will the agency comply with the statute? 

Per the OMB memorandum, Social Media, Web-Based Interactive Technologies, and the 

Paperwork Reduction Act, the FTC’s use of Twitter as outlined in Section 1.1 is not a web-based 

interactive technology that would trigger the PRA. 

SECTION 3.0 THE FTC’S INTENDED OR EXPECTED USE OF PII 

Section 3.1 – Generally, how will the agency use the PII described in Section 2.0? 

The FTC collects Twitter handles and comments in the examples outlined in Section 2.1. This 

includes tweets mentioning or directed at the FTC, regardless of whether they use an FTC 

account handle or not, which may be collected as part of the agency’s daily clips to highlight the 

FTC in the news or in blogs. Additionally, interactions with the FTC through interactive chats 

and events or general comments on Twitter may generate new records, for which the FTC may 

choose to collect comments and Twitter handles. 

5 
 

 

 

 

Section 3.2 – Provide specific examples of the types of uses to which the PII may be subject. 

When answering questions from consumers that generate new agency records, hosting interactive 

Twitter chats or other live events, the FTC may collect comments and Twitter handles as agency 

records. The FTC routinely searches Twitter for agency mentions (including those who and do 

not use FTC Twitter handles in their tweets) as part of its Daily Clips packet. If these tweets 

meet the criteria outlined in Section 2.1, the FTC may collect a Twitter handle. 

In accordance with OMB memorandum M-10-22, Guidance for Online Use of Web 

Measurement and Customization Technologies, the FTC uses some analytical data from Twitter 

to measure the overall number of followers, number of retweets, and similar statistical 

information to evaluate the effectiveness of the FTC’s Twitter accounts. The Twitter analytics 

tool automatically makes other information available to the FTC, including sex, location, 

interests, and what other handles the FTC’s follower’s follow; however, the FTC does not plan to 

collect or track any of this additional information. The FTC will not collect any PII beyond 

Twitter handles (see Sec. 2.1). 

SECTION 4.0 SHARING OR DISCLOSING OF PII 

Section 4.1 – With what entities or persons inside or outside the agency will the PII be 

shared, and for what purposes will the PII be disclosed? 

Twitter requires a minimum amount of PII collection in order for users to register profiles on the 

site. This information is outlined in Section 2.0. The FTC does not collect or maintain PII that 

Twitter collects from registered users, particularly those who engage with the FTC via Twitter 

including mentioning, following or unfollowing FTC accounts. 

Only approved staff members have access to administer FTC Twitter accounts. Generally, all the 

information available to the FTC through user engagement such as following, unfollowing or 

mentioning is also publicly available to anyone visiting Twitter.com. 

Section 4.2 – What safeguards are in place to prevent expansion of use beyond those 

authorized under law and described in this PIA? 

Only approved FTC staff members have access to manage the FTC’s Twitter accounts. Each 

staff member responsible for managing a social media account must sign and comply with the 

Commission’s internal Rules of Behavior, prior to beginning account administration. This form 

is required and compliance is monitored through the FTC’s Social Media Task Force. 

The FTC’s Twitter accounts are registered using official FTC email accounts. Administrators are 

not permitted to use personal accounts to manage FTC Twitter accounts. Furthermore, FTC staff 

are directed to use official government devices to manage accounts when possible. 

6 
 

 

 

 

 

Consumers do not have to be registered users of Twitter to see FTC tweets. Furthermore, Twitter 

is a third-party site and FTC Twitter accounts generally contain comparable information that is 

available on the FTC’s primary official sources of information, including FTC.gov, 

OnGuardOnline.gov, and NCPW.gov and other resources. 

Finally, Twitter users determine what information is publicly available about them beyond 

standard information required by Twitter. Users control whether their tweets are public or not. 

The FTC does not collect tweets or handles of private accounts. 

SECTION 5.0 - MAINTENANCE AND RETENTION OF PII 

Section 5.1 – How will the FTC maintain the PII, and for how long? 

If the FTC collects a Twitter handle and comment as part of its daily clips packet or an 

interactive FTC Twitter event, they are retained and disposed of in accordance with applicable 

schedules issued or approved by the National Archives and Records Administration (NARA). If 

the FTC collects general comments and Twitter handles directed at the agency, they are also 

retained and disposed of in accordance with applicable schedules issued or approved by NARA 

Section 5.2 – Was the retention period established to minimize privacy risk? 

Per the FTC’s own privacy policy, the FTC does not collect any information including PII that is 

unnecessary. For engagement purposes on FTC Twitter accounts, the FTC does not collect or 

maintain any PII beyond a Twitter handle, which minimizes any privacy risks. 

SECTION 6.0 – HOW THE AGENCY WILL SECURE PII 

Section 6.1 – Will the FTC’s privacy and security officials coordinate to develop methods of 

securing PII? 

Not applicable since the FTC is only capturing Twitter handles, which is publicly available 

information. See Sections 2.0 and 5.0. 

SECTION 7.0 – IDENTIFICATION AND MITIGATION OF OTHER PRIVACY RISKS 

Section 7.1 – What other privacy risks exist, and how will the agency mitigate those risks? 

Twitter is a third-party service that uses persistent tracking technologies. In an effort to help 

consumers understand how their information is used by Twitter, the FTC posts notices on its 

Twitter accounts indicating that Twitter’s policy applies on these sites. Furthermore, the FTC 

informs consumers who link to FTC Twitter accounts from official agency websites, that they 

are leaving FTC sites where the Commission’s privacy policy no longer applies. 

7 
 

 

 

 

 

 

 

At this time, the Government Services Administration (GSA) does not feel that Twitter’s 

standard Terms of Services (ToS) agreement requires a specific government ToS. If this changes, 

the FTC will follow GSA’s lead and get a signed agreement in place. 

As much as possible, the FTC uses information that is already publicly available on other FTC 

websites, thus consumers do no need to visit the agency’s Twitter accounts to find comparable 

information. 

The FTC routinely reviews Twitter’s privacy policies for any changes that may affect the FTC’s 

use of Twitter and will updates its privacy policies as necessary to reflect any changes. 

SECTION 8.0 – CREATION OR MODIFICATION OF A SYSTEM OF RECORDS 

Section 8.1 – Will the FTC’s activities create or modify a “system of records” under the 

Privacy Act of 1974? 

The FTC does not collect PII or Twitter handles in a manner that would require the FTC to create 

or modify a system of records under the Privacy Act of 1974. 

Prepared for the Business Owners of the System by: 

_________________________________ Date: __________ 

Cheryl Hackley 

Social Media Strategist 

Review: 

__________________________________ Date: __________ 

Alex Tang 

Office of the General Counsel 

__________________________________ Date: __________ 

Peter B. Miller 

Chief Privacy Officer 

__________________________________ Date: __________ 

Jeffrey Nakrin 

Director, Records and Fillings 

8 
__________________________________ 

Jeffrey Smith 

Information Assurance Manager 

Date: __________ 

Approved: 

__________________________________ 

Jeffrey Huskey 

Chief Information Officer 

Date: __________ 

9