1 

Safe – and, or, versus – Sorry: 

How the Federal Trade Commission Approaches Consumer Protection

Commissioner Julie Brill 

Keynote before the 

TACD 16th Annual Forum – The Precautionary Principle in TTIP: Trade Barrier or

Essential for Consumer Protection?

January 26, 2016

Good morning. Thank you to the Transatlantic Consumer Dialogue (TACD) for inviting 

me to address its Annual Forum. Today’s Forum on the Transatlantic Trade and Investment 

Partnership (TTIP) and the precautionary principle addresses issues of great importance to 

consumers, companies, and governments on both sides of the Atlantic. I am pleased to have the 

opportunity to share my thoughts with you from my perspective as a consumer protection official 

at the U.S. Federal Trade Commission (FTC). 

In the U.S. and Europe, discussions of the precautionary principle tend to be framed in 

terms of a battle with the cost-benefit framework. Although the FTC issues some regulations, 

we have a much broader role, including enforcement, policy development, and education. So it 

probably will not surprise you to hear that the FTC’s work does not fit squarely under either 

framework. Instead, I believe the FTC successfully blends and balances elements of both 

approaches. I would like to spend most of my time explaining how we achieve this balance in 

both enforcement and regulation, once I provide you with a little more background on my 

understanding of the central terms of this debate. 

But first, a caveat. Although “trade” is our middle name, the Federal Trade Commission 

(FTC) does not lead international trade policy for the United States. We do not develop or 

negotiate U.S. positions in trade agreements. The FTC has technical expertise to offer as input to 

the agencies that negotiate on behalf of the United States, but we do not lead these negotiations. 

Working Definitions of the Precautionary Principle and Cost-Benefit Analysis

Let me begin with a few observations on the precautionary principle and cost-benefit 

analysis in general. In my view, casting these frameworks in stark, binary terms is not 

particularly helpful. Policy choices in most situations are not nearly so sharply defined. We will 

miss a lot of the nuance that is central to the FTC’s consumer protection role if we insist that 

cost-benefit analysis and the precautionary principle are separate and irreconcilable outlooks. 

One thing that we will miss is the wide variety under each label. There is no single, 

agreed-on definition of the precautionary principle, for example. Scholars have counted 19 

different statements of the precautionary principle.1 Putting a given statement of the principle 

 1 See Calum Turvey, Eliza M. Mojduszka, and Carl E. Pray, The Precautionary Principle, the Law of 

Unintended Consequences, and Biotechnology, available at

http://www.economia.uniroma2.it/conferenze/icabr2005/papers/Turvey_paper.pdf (last visited Jan. 27, 2016). 
2 

into action requires wrestling with some of the same challenges that surround cost-benefit 

analysis. 

TACD’s articulated version of the precautionary principle states that it “is about taking 

preventative policy measures when there is a reasonable suspicion of harm, even if scientific 

evidence is lacking.”2

 Applying this principle in practice would require policymakers and others 

to identify specific – but not necessarily quantifiable – harms, as well as to identify some 

threshold of suspicion and of severity at which the precautionary principle ought to kick in. 

Cost-benefit analysis has a more settled definition, at least in U.S. administrative law,3

but there is no single method or formula for doing it.4 Indeed, the U.S. framework makes room 

for questions that many precautionary proponents would want to address in regulations. 

Qualitative costs and benefits – including the protection of privacy and other intangible values – 

have been an explicit part of cost-benefit analysis in the United States for more than 20 years.5

 

President Obama affirmed their importance, declaring “values that are difficult or impossible to 

quantify, including equity, human dignity, fairness, and distributive impacts” to be integral to 

cost-benefit analyses.6

 And there is a vigorous, ongoing debate in the U.S. over how best to 

incorporate costs and benefits that are difficult to quantify because they relate to qualitative 

values or are simply too uncertain to estimate with reasonable confidence.7

The Organization for Economic Cooperation and Development (OECD) has endorsed 

similar approaches to consumer policy making in its 2014 OECD Recommendation on Consumer 

Policy Decision Making.

8

 There, the OECD recommended a six-step process that policy makers 

can use to determine what policy measures could or should be taken to improve outcomes for 

consumers in a variety of contexts – including in “rapidly-changing, increasingly complex and 

information-intensive markets.”9

 2

 Trans-Atlantic Consumer Dialogue, Final Program for “The Precautionary Principle in TTIP: Trade Barrier or 

Essential for Consumer Protection?”, available at http://tacd.org/event/2016-annual-forum/ (last visited Jan. 27, 

2016). 3

 The governing framework in the U.S. requires agencies to “assess all costs and benefits of available regulatory 

alternatives, including the alternative of not regulating.” Exec. Order 12866, Regulatory Planning and Review, § 

1(a) (signed Sept. 30, 1993), available at http://www.archives.gov/federal-register/executive-orders/1993-

clinton.html. 4 See Office of Management and Budget Circular A-4 on Regulatory Analysis, § A (Sept. 17, 2003), available 

at https://www.whitehouse.gov/omb/circulars_a004_a-4/ (“You will find that you cannot conduct a good regulatory 

analysis according to a formula.”). 5 See EO 12866, supra note 3, at § 1(a) (requiring consideration of “qualitative measures of costs and benefits 

that are difficult to quantify, but nevertheless essential to consider”). See also OMB Circular A-4, supra note 4, at § 

B (“Thus, you should try to explain whether the action is intended to address a significant market failure or to meet 

some other compelling public need such as improving governmental processes or promoting intangible values such 

as distributional fairness or privacy.”). 6

 Exec. Order 13563, Improving Regulation and Regulatory Review, § 1(c) (signed Jan. 18, 2011), available at

https://www.archives.gov/federal-register/executive-orders/2011.html. 7 See generally California Law Review symposium on “The Limits of Quantification”, available at

http://www.californialawreview.org/1the-limits-of-quantification/ (last visited Jan. 27, 2016). 8 See OECD, Recommendation on Consumer Policy Decision Making (Mar. 2014), available at

http://www.oecd.org/sti/consumer/Toolkit-recommendation-booklet.pdf. 9 Id.
3 

As part of its broad based policy-making framework, the OECD highlighted the 

importance of using a cost-benefit analysis that takes into account both quantifiable factors and 

qualitative issues such as community standards and ethical considerations.10 It also recommends 

looking at the effects that the options under evaluation could have on competition and other 

policy areas such as the environment and health and safety. The OECD also recognized that not 

every action by government requires a detailed analysis: for example, an immediate product ban 

following a death or serious injury to consumers would not necessarily require a cost-benefit 

analysis.

Of course, as the OECD also recognized, the success of any policy making approach in 

promoting and protecting consumer interests depends “critically on the interpretation, 

implementation and enforcement of those policies by enforcement authorities.”11

Costs, Benefits, and Values in Consumer Protection Rulemaking

So let me begin with the FTC’s outlook on consumer protection rulemaking. The FTC is 

first and foremost an enforcement agency – indeed, we are the leading consumer protection and 

competition enforcement agency in the U.S. However, Congress has given us specific authority 

to promulgate rules in discrete areas of critical importance to consumers. As an independent 

agency, the FTC is not bound by the requirements of cost-benefit analysis that apply to agencies 

that are part of the president’s administration.12 But the FTC conducts its rulemakings with the 

same level of attention to costs and benefits that is required of other agencies. We build 

extensive records from public workshops and formal written comments from the public to inform 

these assessments. And we review all regulations at least every ten years to determine whether 

any changes are warranted or whether they are still needed at all. 

Some of our most important privacy regulations involve harms that are qualitative in 

nature. Let me give you a couple of examples. The Children’s Online Privacy Protection Act 

(COPPA) creates strong protections for information collected online from children under the age 

of 13.13 These protections are based on a recognition that children are less capable than adults of 

understanding the terms of data collection and use, making stronger protections on data 

collection and use as well as data security appropriate to keep children safe and secure online. In 

the most recent review of the COPPA Rule – which the FTC conducted five years ahead of 

 10 See id. § II.6.v. 11 See OECD, Consumer Policy Toolkit 101 (July 2010), available at

http://www.oecd.org/sti/consumer/consumer-policy-toolkit-9789264079663-en.htm. 12 See Statement of the Federal Trade Commission on the FTC’s Regulatory Reform Program: Twenty Years of 

Systematic Retrospective Rule Reviews & New Prospective Initiatives To Increase Public Participation and Reduce 

Burdens On Business Before the Subcommittee on Oversight and Investigations of the Committee on Energy and 

Commerce, U.S. House of Representatives, at 1 (July 7, 2011), available at https://www.ftc.gov/publicstatements/2011/07/prepared-statement-federal-trade-commission-ftcs-regulatory-reform-program (Through 

Executive Order 13563, the President recently directed all Executive Branch agencies to engage in a regulatory 

review process. While the FTC, as an independent agency, is not bound by this Order, it fully supports the Order’s 

goals.”). 13 See 15 U.S.C. §§ 6501-6506. 
4 

schedule to address rapid changes in technology14 – the FTC strengthened the Rule in a few 

significant ways. For example, we included a broader range of identifiers in the definition of 

“personal information,”15 required just-in-time notice for obtaining parental consent,16 included 

among covered services ad networks and other third parties that know they are collecting 

information from children,17 and required companies to delete children’s information when it is 

no longer needed.18 The FTC carefully considered arguments that commenters raised about costs 

and reasonably available technologies, but we balanced those arguments against the privacy 

protections that important benefits of insuring strong protection for children, as envisioned by 

Congress.19 More than two years after the revised Rule went into effect, the result has been a set 

of strong standards with which companies can comply and an explosion in the number of apps 

and other online services directed toward children. 

The FTC also developed the Do Not Call Rule under its authority in the Telemarketing 

and Consumer Fraud Prevention Act.20 Much of the attention that Do Not Call receives these 

days is about the monetary judgments that the FTC has obtained against violators – more than 

one billion dollars, and counting21 – and the technological solutions, such as NoMoRobo,22 that 

are being developed to help consumers to avoid the pernicious calls that evade the law. But it is 

important to remember that the Do Not Call Rule was aimed at stopping a very simple and 

compelling consumer harm: the privacy invasion from unwanted telemarketing calls.23 Of 

 14 See FTC, Request for Comment on Federal Trade Commission’s Implementation of the Children’s Online 

Privacy Protection Rule, 75 FR 17089, 17089 (Apr. 5, 2010), available at https://www.ftc.gov/policy/federalregister-notices/request-public-comment-federal-trade-commissions-implementation-rule (“[T] the Commission 

believes that changes to the online environment over the past five years, including but not limited to children’s 

increasing use of mobile technology to access the Internet, warrant reexamining the Rule at this time.”). 15 See FTC, Children’s Online Privacy Protection Rule: Final Rule Amendments To Clarify the Scope of the 

Rule and Strengthen Its Protections For Children's Personal Information, 78 FR 3972, 3978-83, available at

https://www.ftc.gov/policy/federal-register-notices/childrens-online-privacy-protection-rule-final-rule-amendments

(explaining decision to include screen names, a wider range of persistent identifiers, geolocation information, and 

other categories of information in the definition of “personal information”) [“2013 COPPA Rule Amendments”]. 16 Id. at 3984-85. 17 Id. at 3978-79. 18 See id. at 3995; 16 CFR § 312.10. 

19 See, e.g., 2013 COPPA Rule Amendments, supra note 15, at 3975-78 (discussing decision to make operators 

and child-directed services strictly liable for third parties’ collection of children’s information through their 

services). 20 See Do Not Call Registry Act of 2003, Pub. L. 108-82, available at https://www.congress.gov/bill/108thcongress/house-bill/3161/text/pl (codified at 15 U.S.C. § 6151); Do Not Call Implementation Act of 2003, Pub. L. 

108-10, available at https://www.congress.gov/bill/108th-congress/house-bill/395/text/pl (codified at 15 U.S.C. § 

6152 et seq.). 21 The FTC has collected $53 million of the more than $1 billion in equitable monetary relief and $49 million of 

the $144 million in civil penalties obtained in telemarketing-related judgments. 22 See FTC, Press Release, FTC Announces Robocall Challenge Winners (Apr. 2, 2013), available at

https://www.ftc.gov/news-events/press-releases/2013/04/ftc-announces-robocall-challenge-winners. 23 See FTC, Statement on the Do Not Call Amendments to the Federal Trade Commission’s Telemarketing 

Sales Rule Before the Subcommittee on Commerce, Manufacturing, and Trade of the Committee on Energy and 

Commerce, U.S. House of Representatives (Jan. 8, 2003), at 8, available at https://www.ftc.gov/publicstatements/2003/01/prepared-statement-federal-trade-commission-telemarketing-sales-rule (“These amendments to 

the TSR will greatly benefit American consumers, allowing them to continue receiving the telemarketing calls they 

want, while empowering them to stop unwanted intrusions into the privacy of their homes.”). 
5 

course, one could estimate the cost to consumers in terms of the time they spent dealing with 

these calls instead of doing something else, like working or eating dinner with their families. But 

those estimates account for a small fraction of the frustration, inconvenience, and overall sense 

of invasion that consumers suffer as a result of unwanted calls.24

Costs, Benefits, and Values in Consumer Protection Enforcement 

The FTC combines our broad mandate to protect consumers with a rigorous, empirical 

approach to enforcement matters and a need to meet exacting legal standards. Section 5 of the 

FTC Act – the fountainhead of our enforcement authority – prohibits “unfair or deceptive acts or 

practices in or affecting commerce.”25 In our cases brought under our deception authority, we 

address the broad, public harm to consumers and the marketplace that arises when companies 

misrepresent or make false statements about their goods and services, or fail to disclose material 

facts about them. Truthful information is so fundamental to consumer markets that we can bring 

deception cases based on a company’s representations in an advertisement, for example, without 

alleging that any consumers even saw the ad in question. 

In our enforcement actions to stop “unfair” practices, we must prove that a practice is 

likely to result in consumers suffering “substantial injury”.26 Such harm very well may be 

qualitative, as many of the FTC’s privacy and data security cases illustrate. 

We must also prove that the consumer harm from the practice we believe is “unfair” is 

“not avoidable by consumers” and is “not outweighed by countervailing benefits to consumers or 

competition.”27 In other words, a form of cost-benefit balancing test is written into the basic 

unfairness statute that we enforce. This test does not require the FTC to consider only 

quantifiable harms, though in many cases we can make a good estimate of the amount of 

consumer harm in terms of dollars and cents. In other cases, however, the harm to consumers – 

and the lack of benefits – is both qualitative and extremely clear. 

A few examples from the dozens of privacy and data security cases that the FTC has 

brought will illustrate this point. Consider our case against Facebook. One of the practices that 

caused the FTC to take action was that Facebook overrode users’ privacy settings and exposed 

consumers’ information to a broader audience than they intended when they provided it to 

Facebook.28 The FTC alleged that these disclosures could lead to substantial harm, namely 

“threats to [consumers’] health and safety” and “unauthorized revelation of their affiliations.”29 

Consumers did not have a chance to opt in to this change, nor did they enjoy a clear benefit from 

having information that they intended to keep private or share with one audience suddenly be 

shared more broadly.30

 24 See id. 25 15 U.S.C. § 45(a). 

26 15 U.S.C. § 45(n). 

27 15 U.S.C. § 45(n). 

28 See Facebook, Inc., C-4365 (F.T.C. July 27, 2012), Complaint ¶¶ 22-29, available at

https://www.ftc.gov/sites/default/files/documents/cases/2012/08/120810facebookcmpt.pdf. 29 Id. ¶ 26. 30 See id. ¶ 29. 
6 

The FTC has also taken action against companies for unfairly collecting information. For 

example, the FTC brought an action against a firm that developed software for rent to own 

companies to install on computers they offered to consumers, to disable the computer if the 

consumer failed to make timely payments, or the computer was stolen.31 An add-on feature for 

the software, called “Detective Mode”, allowed the rent-to-own companies to log keystrokes and 

capture screenshots of confidential and personal information such as user names and passwords, 

social media interactions and transactions with financial institutions.32 It also allowed the rent to 

own companies to take pictures of anyone within view of the computer’s webcam, all without 

even alerting consumers to the existence of the software.33 We believed that collecting this 

deeply personal information was harmful to consumers, unavoidable, and provided them with no 

benefit at all – and therefore unfair.34 

In addition to enforcing against “deceptive” or “unfair acts using our Section 5 authority, 

we also enforce many other statutes, some of which have the express purpose of protecting 

values that are hard to quantify. For example, the purpose of the Fair Credit Reporting Act is to 

“insure that consumer reporting agencies exercise their grave responsibilities with fairness, 

impartiality, and a respect for the consumer’s right to privacy.”35 Along similar lines, the Fair 

Debt Collection Practices Act prohibits debt collectors from “harass[ing], oppress[ing], or 

abus[ing]” consumers who owe debts.36

These laws and others – as well as the FTC’s efforts to enforce them – reflect a deep 

concern in the United States with protecting consumers’ dignity, privacy, and social 

relationships. Our enforcement actions can deliver relief – including monetary relief – to 

consumers who are harmed by scams and other illegal practices. Our enforcement actions also 

have broader, preventive effects. They deter others who are considering engaging in similar 

conduct. And they send a signal to the marketplace that the FTC is watching trends in business 

models and technology. 

I know that many of you are concerned about the role that personal data flows might play 

in TTIP. To reiterate what I said at the outset of my remarks, the FTC does not play a role in 

deciding whether data flows are in or out of TTIP. What I will say, however, is that the FTC – 

and many other state and federal agencies – and the laws that we enforce have established a 

strong tradition in the United States of recognizing and protecting a broad range of consumer 

privacy interests. The FTC’s commitment to these protections shows in the nearly 100 privacy 

 31 See FTC, Press Release, Aaron’s Rent-To-Own Chain Settles FTC Charges That It Enabled Computer Spying 

by Franchisees (Oct. 22, 2013), available at https://www.ftc.gov/news-events/press-releases/2013/10/aarons-rentown-chain-settles-ftc-charges-it-enabled-computer. 32 Aaron’s, Inc., Case No. 4442 (F.T.C. Mar. 10, 2014), at ¶ 5 (complaint), available at

https://www.ftc.gov/system/files/documents/cases/140311aaronscmpt.pdf. 33 DesignerWare, LLC, C-4390 (F.T.C. Apr. 11, 2013), at ¶ 14 (complaint), available at

http://www.ftc.gov/sites/default/files/documents/cases/2013/04/130415designerwarecmpt.pdf . The Commission 

also settled an action against the rent-to-own company that used the software and its franchisees. 34 See id. ¶ 16. 35 15 U.S.C. § 1681(a)(4). 

36 15 U.S.C. § 1692d. 
7 

and data security cases that we have brought against companies large and small. It shows in the 

39 Safe Harbor cases that we brought before the Schrems decision. It shows in the hundreds of 

other cases we have brought to enforce consumers’ rights and dignity under other laws, like the 

Fair Credit Reporting Act, the Fair Debt Collection Practices Act, and the Children’s Online 

Privacy Protection Act. And it shows in our commitment to cooperate with enforcement 

agencies in Europe and other regions. These are unsettled times in transatlantic privacy, but the 

FTC is committed to building on the progress that we have made on our own and in cooperation 

with others. 

* * * * * * 

Consumer protection in one country, with its own legal framework and traditions, is a 

vast undertaking, particularly when technologies and business models are rapidly changing. 

Providing effective consumer protections in a world of global services and personal data flows is 

even more challenging – but also essential to this system of commerce. I believe the FTC sets a 

standard for combining strong, effective enforcement with a relentless effort to examine markets 

and understand the effects of its actions. I hope and expect that our record will be part of the 

foundation of consumer protections in the transatlantic economy as TTIP and the many other 

issues brewing at the moment reach their resolutions. 

Thank you.