Federal Trade Commission

Privacy Impact Assessment

 

Twitter

May 2019 
2

SECTION 1.0 – SPECIFIC PURPOSE OF THE FTC’S USE OF TWITTER

1.1 – What is the specific purpose of the agency’s use of Twitter, and how does that use fit 

with the agency’s broader mission?

The Federal Trade Commission (FTC or Commission) uses Twitter, a microblogging website 

(i.e., a blog consisting of short posts or messages limited to 280 characters), to disseminate 

information to the public. See the social media web page on FTC.gov for a list of active FTC 

social media accounts, including Twitter accounts. 

Twitter allows the FTC to promote information, tips, and resources to consumers and other 

people who may not be regular visitors to FTC websites. Information (“tweets”) posted to FTC 

Twitter accounts is generally content that already exists on FTC.gov and FTC.gov/espanol or is 

relevant information from the Bureaus of Consumer Protection, Competition, and Economics, as 

well as other offices and staff of the FTC.

Typical tweets may include, but are not limited to, consumer and business tips and information 

as well as photos, news articles and short videos. The Office of Public Affairs (OPA) approves 

the content of all @FTC, @laFTC, and @MilConsumer tweets, including, but not limited to, 

press releases, speeches, and information from the Bureaus of Consumer Protection, 

Competition, and Economics, as well as other offices of the FTC. 

Tweets from agency accounts (@FTC, @LaFTC, and @MilConsumer) that reflect the opinions 

of individual Commissioners, the Chair or other FTC staff members are attributed appropriately. 

Tweets from the Chair, Commissioners, and Chief Technologist may not necessarily represent 

the views of the Commission or other individual Commissioners. 

All official FTC Twitter accounts are verified by Twitter (as indicated by the blue checkmark on 

account profiles), documented in the federal government’s Social Media Registry, and also 

linked from the agency’s Social Media webpage. 

All FTC Twitter profiles are public, so anyone, including visitors who are not registered Twitter 

users, can visit the accounts and read the agency’s tweets. In contrast, only registered users can 

post tweets on Twitter. Tweets from other users do not show up in the FTC’s home streams 

unless retweeted by an FTC account. 

Tweets/Retweets

The Commission promotes FTC resources to the public. These tweets will all appear in reverse 

chronological order in the FTC’s profile pages. Additionally, any Twitter users who “follow” an 

FTC account will receive agency tweets in their Twitter “stream” also known as the “timeline.” 

In turn, users may share the FTC’s resources with their network of Twitter followers (generally 

done by sending out the same tweet and giving credit to the FTC’s original tweet, called a 

“retweet” and abbreviated as RT) and others can do the same, providing a viral marketing 

component to the Commission’s outreach and education efforts. A retweet of a non-government 

account posting by an FTC account does not equal an endorsement.
3

Follows/Following

Anyone can follow FTC Twitter accounts as they are not private and do not require permission to 

follow. The @FTC and @LaFTC accounts will only follow other government agencies and 

leadership. The @MilConsumer account may follow other government accounts and partners of 

the Military Consumer Protection campaign. Commissioners and the Chief Technologist may 

follow other users, such as reporters, but any such following does not equal an endorsement by 

the Commission or any individual Commissioner. 

Mentions

If a registered user posts a tweet that includes an FTC’s account handle, this is called a mention. 

The tweet will appear in the user’s profile and home stream as well as the timelines of all 

followers of that user. Additionally, that tweet will show up in the notifications/mentions stream 

of the FTC account. 

If a user posts a tweet that starts with a mention of a specific FTC Twitter account (e.g., @FTC), 

it will only show up in the home streams of users who follow both that user and the FTC 

account. However, all public tweets (meaning the account is not locked or protected) are 

searchable by the public on Twitter’s website (or other third party sites linked to Twitter), thus 

anyone can search for mentions of FTC Twitter accounts. 

Public tweets may also be picked up by other search engines (e.g., Bing, Google, Yahoo!), 

aggregator sites, or applications outside of Twitter. The FTC cannot delete tweets sent by other 

users even if they mention an FTC account, but the FTC can block Twitter users or other 

messages (see below) that are deemed as harassing toward the FTC. Additionally, “spam” style 

Twitter accounts can be reported, and Twitter can investigate and delete the account if necessary.

Direct Messages

Private messages between registered Twitter users are called “Direct Messages.” These messages 

are stored in a “Direct Message stream” accessible only to the registered Twitter user. Only 

another registered user whom you follow can send you a direct message (and you must follow 

them to send them one back). The @FTC, @LaFTC, and @MilConsumer accounts may engage 

in Direct Messages with other government accounts that are mutual followers of these FTC 

accounts. Similarly, Direct Message activity may result between Commissioners or the Chief 

Technologist and other Twitter accounts that are mutual followers. In all cases, account users 

shall be required to manage such communications, if any, to ensure that the FTC is able to 

comply with potentially applicable legal obligations (e.g., Freedom of Information Act requests, 

e-discovery litigation holds, duty to preserve, copy, retain or destroy under Federal records law). 

Interactive Twitter Events

The FTC may user Twitter to promote events or answer questions in real-time. See the FTC’s 

Twitter Chats and Interactive Twitter workshops for more information about how these events 

work. 
4

1.2 – Is the agency’s use of Twitter consistent with all applicable laws, regulations, and 

polices?

The President’s January 21, 2009 memorandum on Transparency and Open Government and the 

OMB Director’s December 8, 2009 Open Government Directive call on federal departments and 

agencies to harness new technologies to engage with the public. Twitter has over 250 million 

active users. Using tools like Twitter helps the FTC to communicate with consumers on 

platforms where they’re active, which in turns helps the FTC meet the federal guidance outlined 

in the directive and memorandum, including the goals of transparency, participation and 

collaboration. 

With respect to the information that the FTC will disseminate through its Twitter accounts, the 

FTC Act authorizes the FTC to prevent unfair and deceptive acts and practices in interstate 

commerce and, in furtherance of this mission, to gather, compile, and make information 

available in the public interest. See 15 U.S.C. 45, 46(a), (f). 

Per federal guidance, consumers who visit Twitter or other third-party websites by clicking on a 

link on the FTC website receive an exit script or similar notice advising them that the FTC’s 

privacy policy does not apply on that third-party website. Additionally, notices are placed as 

appropriate on each FTC account informing visitors that Twitter’s privacy policy governs on the 

site. 

SECTION 2.0 – IS THERE ANY PII THAT IS LIKELY TO BECOME AVAILABLE TO 

THE AGENCY THROUGH THE USE OF TWITTER?

2.1 – What PII will be made available to the FTC? 

Twitter requires users to provide their first name, last name, a valid email address, and a 

password, with the option to provide additional information in their biography when they register 

an account. Even though some of this information may be accessible to the FTC, depending on a 

Twitter user’s privacy settings (users can protect their tweets by using a private account setting), 

the FTC does not routinely collect, disseminate, or maintain any of the information provided to 

Twitter. 

The FTC may, however, read, review, or rely upon information that individuals make available 

to the public or to the FTC on Twitter, as authorized or required by law. The privacy impact of 

the FTC’s use of this platform is low, as the FTC does not routinely use Twitter to solicit, 

collect, maintain, or disseminate PII from members of the public. In specific circumstances, the 

FTC may collect limited information (e.g. usernames or handles) about members of the public 

(e.g., if messages or posts directed to the FTC or its employees on Twitter are deemed as 

threatening or violent, or where the content may reveal some other potential law enforcement 

violation). The FTC may also occasionally produce reports or summaries of its use of this social 

media platform that include PII posted publicly (i.e., usernames): for instance, it may do so if 

needed to comply with social media records retention guidelines from the National Archives and 

Records Administration (NARA). In such instances, the collection of PII in these summaries will 

be reduced as much as is feasible. 
5

The FTC routinely monitors FTC-related keywords on Twitter and other third-party applications 

in an effort to determine what kind of public attention the FTC is generating online. The FTC 

does this manually and via automated social media management tools. Generally, comments that 

the FTC may collect or maintain as part of such review would be collected and/or maintained 

without the individual Twitter handle that identifies them. The Office of Public Affairs may elect 

to include Twitter handles in the following instances: 

- Twitter handles of news organizations, journalists, and influential blogs and bloggers 

may be collected and distributed for use in media clips to lend credibility to tweets; 

- Use of Twitter handles may be collected and maintained as an official record during 

interactive Twitter chats or other live events hosted by the FTC; and

- When answering questions directed to official FTC accounts (which are verified by 

Twitter and denoted in the appendix of this PIA), the FTC may collect and maintain 

comments, including the Twitter handles of those users who posted the questions. 

In the instances listed above, the FTC intends to keep a record of the information (generally a 

screen shot of the comment saved as a PDF electronically and on paper), but does not intend to 

collect or maintain the records in any type of database from which the records will be retrieved 

specifically by a Twitter handle, or any other personal identifier. The FTC does not strive to 

collect every tweet about the agency – only tweets of significance to the Commission’s missions.

Although the FTC does not collect information other than comments with their corresponding 

Twitter handles from users who discuss the FTC online, users should be aware that the United 

States Library of Congress, through separate arrangement with Twitter, is maintaining an 

electronic archive of all public tweets, and intends to make them publicly available within a sixmonth window from the date of the tweet. The FTC understands that private account information 

(private profiles or direct messages) will not be part of the Library of Congress archive nor will 

links or photos associated with those tweets. In addition, as noted earlier, a user’s public tweets 

will also be accessible to the public through Twitter itself and through other, non-Governmental 

search engines, aggregators, and applications. In addition, PII may be collected through Twitter 

in the form of Direct Messages, if any, between an FTC account and another Twitter account, 

where the accounts are mutual followers (e.g., DMs between a Commissioner or the Chief 

Technologist and the individual user of a Twitter account that is a mutual follower). 

Users interested in more information about Twitter’s privacy policy can review it online. 

Finally, the FTC may collect general analytics from Twitter on a regular basis including the 

numbers of followers, number of retweets, etc. The Twitter analytics tool automatically makes 

other information available to the FTC, including sex, location, interests, and other handles the 

FTC’s followers follow; however, this information is only available to the FTC in aggregate 

form. 
6

2.2 – What are the sources of PII?

The FTC does not have access to the information that Twitter collects to register for the site. The 

FTC does have access to information that users post to their public profiles. This includes name 

(real or pseudonym), Twitter handle, location, and any additional information they post in their 

biography. The sources of PII in any Direct Messages between an FTC and non-FTC account 

that is a mutual follower, as described above, would be the author of the DM. 

2.3 – Do the FTC’s activities trigger the Paperwork Reduction Act (PRA) and, if so, how 

will the agency comply with the statute? 

Per the OMB memorandum, Social Media, Web-Based Interactive Technologies, and the 

Paperwork Reduction Act, the FTC’s use of Twitter as outlined in Section 1.1 is not a web-based 

interactive technology that would trigger the PRA. 

SECTION 3.0 THE FTC’S INTENDED OR EXPECTED USE OF PII

Section 3.1 – Generally, how will the agency use the PII described in Section 2.0?

The FTC collects Twitter handles and comments in the examples outlined in Section 2.1. This 

includes tweets mentioning or directed at the FTC, regardless of whether they use an FTC 

account handle or not. Twitter handles or tweets relevant to the agency may be collected as part 

of the agency’s daily clips to highlight the FTC in the news or in blogs. Additionally, interactions 

with the FTC through interactive chats and events or general comments on Twitter may generate 

new records, for which the FTC may choose to collect comments and Twitter handles. DMs, if 

any, would be generally used only for informal communications, as FTC account users would 

normally re-direct and conduct any necessary formal communications through more official 

channels (e.g., FTC e-mail or correspondence). 

Section 3.2 – Provide specific examples of the types of uses to which the PII may be subject.

When answering questions from consumers that generate new agency records or hosting 

interactive Twitter chats or other live events, the FTC may collect comments and Twitter handles

as agency records. The FTC routinely searches Twitter for agency mentions (including those 

who do and do not use FTC Twitter handles in their tweets) as part of its media research. If these 

tweets meet the criteria outlined in Section 2.1, the FTC may collect a Twitter handle.

In accordance with OMB memorandum M-10-22, Guidance for Online Use of Web 

Measurement and Customization Technologies, the FTC uses some analytical data from Twitter 

to measure the overall number of followers, number of retweets, and similar statistical 

information to evaluate the effectiveness of the FTC’s Twitter accounts. The FTC will not will 

not collect any PII that is unnecessary (see Sec. 2.1).
7

SECTION 4.0 SHARING OR DISCLOSING OF PII

Section 4.1 – With what entities or persons inside or outside the agency will the PII be 

shared, and for what purposes will the PII be disclosed?

PII posted on Twitter is available publicly. See also 2.1 above, since in limited instances, PII

posted on Twitter may need to be specifically provided to others at the agency, to other law 

enforcement agencies, or to NARA. 

Twitter requires a minimum amount of PII collection in order for users to register profiles on the 

site. This information is outlined in Section 2.0. The FTC does not collect or maintain PII that 

Twitter collects from registered users, particularly those who engage with the FTC via

mentioning, following or unfollowing of FTC accounts, or other Twitter-permitted activities.

Only approved staff members have access to administer FTC Twitter accounts. Generally, all the 

PII available to the FTC through user engagement such as following, unfollowing or mentioning

is also publicly available to anyone visiting Twitter.com. 

Section 4.2 – What safeguards are in place to prevent expansion of use beyond those 

authorized under law and described in this PIA?

Only approved FTC staff members have access to manage the FTC’s Twitter accounts. Each 

staff member responsible for managing a social media account must sign and comply with the 

Commission’s internal Rules of Behavior, prior to beginning account administration. 

The FTC’s Twitter accounts are registered using official FTC email accounts. Administrators are 

not permitted to use personal accounts to manage FTC Twitter accounts. Furthermore, FTC staff 

are directed to use official government devices to manage accounts when possible.

Finally, Twitter users can determine what additional information of theirs is made publicly 

available, beyond the standard information required by Twitter to create an account. Users can 

also control whether their tweets are public or not. The FTC does not collect tweets or handles of 

private accounts. 

SECTION 5.0 - MAINTENANCE AND RETENTION OF PII

Section 5.1 – How will the FTC maintain the PII, and for how long?

If the FTC collects a Twitter handle and comment as part of its media research or an interactive 

FTC Twitter event, they are retained and disposed of in accordance with applicable FTC policies 

and procedures and schedules issued or approved by the National Archives and Records 

Administration (NARA). If the FTC collects general comments and Twitter handles directed at 

the agency, they are also retained and disposed of in accordance with applicable schedules issued 

or approved by NARA.
8

Section 5.2 – Was the retention period established to minimize privacy risk?

In general, this does not apply, as the FTC does not routinely use Twitter to solicit, collect, 

maintain, or disseminate PII from members of the public. In the limited instances in which the 

FTC does so (see 2.1 above), any PII collected will be retained and disposed of in accordance 

with NARA’s General Records Schedule (GRS) 6.4, item 020, Public Comments and 

Communications Not Requiring Formal Action, or other records schedules that may apply. In 

addition, per the FTC’s own privacy policy, the FTC does not collect any information including 

PII that is unnecessary. For engagement purposes on FTC Twitter accounts, the FTC does not 

collect or maintain any PII beyond a Twitter handle, which minimizes potential privacy risks.

SECTION 6.0 – HOW THE AGENCY WILL SECURE PII

Section 6.1 – Will the FTC’s privacy and security officials coordinate to develop methods of 

securing PII?

In general, this does not apply: the FTC is only capturing Twitter handles and other tweet 

content, which, though it may be PII, is publicly available information. See also Section 2.1. 

However, privacy and security officials routinely coordinate to develop methods to secure all 

agency PII. 

SECTION 7.0 – IDENTIFICATION AND MITIGATION OF OTHER PRIVACY RISKS

Section 7.1 – What other privacy risks exist, and how will the agency mitigate those risks?

Twitter is a third-party service that uses persistent tracking technologies. In an effort to help 

consumers understand how their information is used by Twitter, the FTC posts notices on its 

Twitter accounts indicating that Twitter’s policy applies on these sites. Per federal guidance, 

consumers who visit Twitter or other third-party websites by clicking on a link on the FTC 

website receive an exit script or similar notice advising them that the FTC’s privacy policy does 

not apply on that third-party website. An example of an FTC exit script for Twitter is available 

here. Additionally, notices are placed as appropriate on each FTC account informing visitors that 

Twitter’s privacy policy governs on the site. 

Twitter has a Federal Compatible Terms of Service agreement available via digital.gov. 

As much as possible, the FTC uses information that is already publicly available on other FTC 

websites, thus consumers do not need to visit the agency’s Twitter accounts to find comparable 

information. 
9

SECTION 8.0 – CREATION OR MODIFICATION OF A SYSTEM OF RECORDS

Section 8.1 – Will the FTC’s activities create or modify a “system of records” under the 

Privacy Act of 1974?

No. The FTC does not collect PII or Twitter handles in a manner that would require the FTC to 

create or modify a system of records under the Privacy Act of 1974.