United States of America 

FEDERAL TRADE COMMISSION 

WASHINGTON, D.C. 20580

 Jessica L. Rich 

 Office of the Director 

Bureau of Consumer Protection 

April 22, 2016 

Marlene H. Dortch 

Secretary 

Federal Communications Commission 

445 12th Street, SW 

Washington, DC 20554 

 Re: Expanding Consumers’ Video Navigation Choices, MB Docket No. 16-42 

Commercial Availability of Navigation Devices, CS Docket No. 97-80 

Comment of the Director of the Bureau of Consumer Protection of the 

Federal Trade Commission 

Dear Secretary Dortch: 

As the Director of the Federal Trade Commission’s Bureau of Consumer Protection, I 

submit this comment to assist the Federal Communications Commission (“FCC”) in evaluating 

the consumer privacy implications of its proposed set-top box rulemaking.1

 The FCC proposes 

to require cable and satellite television service providers to obligate third-party manufacturers to 

certify that their set-top boxes comply with certain privacy requirements applicable to cable and 

satellite providers pursuant to the Communications Act. In this comment, I recommend that, if 

the FCC adopts the proposed rule, cable and satellite companies should require these 

certifications to be conveyed to consumers, in order to facilitate FTC enforcement against thirdparty set-top box manufacturers under the jurisdiction of the FTC.2

 The FTC’s ability to enforce 

promises made by these entities serves as an important backstop to ensure that they are abiding 

by the required consumer privacy protections. 

I. Background 

On March 16, 2016, the FCC proposed a rule intended to make it easier for companies 

other than cable and satellite television providers (known as multichannel video programming 

distributors, or “MVPDs”) to sell set-top boxes that can be used with consumers’ cable and 

satellite television services. The vast majority of consumers currently get their set-top boxes 

through their MVPDs, such as Comcast and DirecTV, and not through third parties that operate 

                                                            

1

 Expanding Consumers’ Video Navigation Choices; Commercial Availability of Navigation Devices, 81 Fed Reg. 

14033 (March 16, 2016). The FCC’s Notice of Proposed Rule Making (“NPRM”) was adopted and released on 

February 18, 2016 and published in the Federal Register on March 16, 2016. On March 17, 2016, the FCC extended 

by seven days the period in which parties could submit initial comments. 

2

 I understand that the goal of the NPRM is to enhance competition among set-top box providers. The FTC has a 

dual mission to protect consumers and promote competition. This comment, however, is limited to the NPRM’s 

consumer protection implications as they relate to consumer privacy and to the FTC’s authority to enforce privacy 

promises. 
2 

set-top boxes using the FCC’s current interoperability standard. The proposed rule seeks to 

make it easier for current set-top box manufacturers like TiVo, as well as other manufacturers 

that may seek to offer set-top boxes, such as Amazon, Apple, Google, and Roku, to create 

compatible devices. 

In its Notice of Proposed Rulemaking (“NPRM”), the FCC observes that the consumer 

protection statutes that govern MVPD-provided set-top boxes do not apply to set-top boxes 

provided by third parties.3

 The NPRM proposes to address this discrepancy by requiring 

MVPDs to provide television subscription information to those third-party set-top box 

manufacturers that “certify” to MVPDs that their devices comply with the consumer protection 

requirements that apply to MVPD-provided set-top boxes.4 MVPDs would be required to 

provide television service information to any set-top boxes sold by third parties that certify 

compliance, and would be prohibited from providing information to any set-top boxes sold by 

third parties that fail to certify compliance.5

 The NPRM seeks comment on this proposal, 

including whether such a program could be effective and how it should be structured.6

In this comment, I propose that if the FCC adopts the rule, MVPDs should require that 

third-party set-top box manufacturers represent to consumers, as well as to MVPDs, that their 

products comply with the cable and satellite statutory privacy provisions.7 Such a representation 

would be analogous to manufacturers voluntarily committing to a privacy code of conduct. The 

FTC has long advocated for the use of meaningful codes of conduct, and the FTC has wellestablished authority to enforce such codes of conduct under the FTC’s Section 5 authority to 

prohibit deceptive practices.8

 Section II provides background on the FTC’s enforcement and 

advocacy regarding industry codes of conduct. Section III offers suggestions on how to structure 

an obligation to commit to a code of conduct in a manner that would permit enforcement under 

the FTC Act. 

II. The Federal Trade Commission’s Privacy Program 

The FTC is an independent agency charged by Congress with promoting consumer 

protection and competition in the marketplace. As the primary federal agency protecting 

consumers from unfair and deceptive privacy and data security practices, the FTC engages in 

extensive enforcement, policy, and consumer and business education initiatives. Privacy has 

                                                            

3

 Set-Top Box NPRM at 14045-6 (citing 47 U.S.C. §§ 338(i) (satellite privacy), 551 (cable privacy), 303a 

(children’s programing); 47 C.F.R. § 25.701(e) (children’s programming); 47 C.F.R. Pt. 11 (emergency alerts)). 

Although the focus of this comment is consumer privacy, its suggestions apply equally to enforcement of promises 

regarding emergency alerts and children’s programming. 

4 Id. at 14045, 14051 (proposing Section 76.1200(l)). 5 Id. at 14051 (proposing Section 76.1211(a)). 6 Id. at 14045-6. 7

 The comment does not offer an opinion on whether these public commitments would render the business-tobusiness certifications irrelevant, or whether that certification process could parallel the public commitments. 8

 For example, in a 2012 report, the FTC committed to promote industry self-regulation through enforceable codes 

of conduct, which the FTC could enforce against companies that “fail[] to abide by the self-regulatory programs 

they join.” See Protecting Consumer Privacy in an Era of Rapid Change: Recommendations for Businesses and 

Policy Makers at 14 (Mar. 2012), available at https://www.ftc.gov/sites/default/files/documents/reports/federaltrade-commission-report-protecting-consumer-privacy-era-rapid-changerecommendations/120326privacyreport.pdf.
3 

been a critical part of the FTC’s consumer protection mission for 45 years and continues to be 

central to its mission today. 

A. Enforcement 

The FTC is first and foremost a civil law enforcement agency. The FTC’s primary law 

enforcement tool, the FTC Act, prohibits unfair and deceptive acts or practices in or affecting 

commerce.9

 A representation, omission, or practice is deceptive if it is material and likely to 

mislead consumers acting reasonably under the circumstances.10 An act or practice is unfair if it 

causes, or is likely to cause, substantial injury that is not reasonably avoidable by consumers or 

outweighed by countervailing benefits to consumers or competition.11 The FTC also enforces 

sector-specific statutes that protect information relating to health, credit and other financial 

matters, and children’s online information, and has issued regulations implementing each of 

these statutes. 

The FTC began its online privacy enforcement program nearly two decades ago.12 In 

recent years, the FTC has brought enforcement actions against companies such as Microsoft, 

Facebook, Google, Equifax, HTC, Snapchat, and Wyndham.13 The FTC has also brought many 

cases enforcing privacy promises claiming compliance with industry codes of conduct. 

Specifically, when a company makes a representation to comply with a particular code or set of 

principles, but fails to do so, this could constitute a deceptive practice under Section 5 of the 

FTC Act.14 The following examples illustrate the FTC’s enforcement experience with privacyrelated industry codes of conduct. 

First, the FTC has brought cases against companies that offer “privacy seals” or 

certifications for other companies’ privacy practices. In 2014, the FTC settled charges that 

TRUSTe, a major provider of privacy certifications for online businesses, falsely represented that 

it conducted annual validations of websites with the TRUSTe seal.15 The FTC’s complaint 

alleged that for over six years and in over 1,000 instances, TRUSTe failed to conduct annual recertifications of companies holding TRUSTe privacy seals, despite providing information on its 

website that companies holding TRUSTe Certified Privacy Seals receive recertification every 

year. The order prohibits misrepresentations, requires monitoring, and mandated $200,000 of 

disgorgement. In 2010, the FTC settled charges against ControlScan, a company that purported 

                                                            

9 See id. 10 See FTC Policy Statement on Deception at 1 (appended to Cliffdale Assocs., Inc., 103 F.T.C. 110, 174 (1984)), 

available at https://www.ftc.gov/public-statements/1983/10/ftc-policy-statement-deception. 11 15 U.S.C. § 45(n). 

12 Geocities, No. C-3850 (FTC Feb. 12, 1999), available at https://www.ftc.gov/enforcement/casesproceedings/982-3015/geocities. 13 See generally FTC, Privacy and Security Cases, https://www ftc.gov/tips-advice/business-center/legalresources?title=&type=case&field consumer protection topics tid=245. 14 The FTC’s privacy enforcement activity also has extended to the types of technologies implicated by the NPRM.

In 2001, at the request of members of Congress, the FTC inquired into the data collection and sharing practices of 

TiVo, and ultimately decided to close the investigation. See Letter from FTC Chairman Robert Pitofsky regarding 

TiVo Investigation (May 11, 2001), available at

https://www.ftc.gov/system/files/documents/public statements/944143/010511tivoinvestigationltr.pdf. 15 In the Matter of TRUSTe, Inc., Dkt. No. C-4512 (Nov. 17, 2014), available at

https://www ftc.gov/enforcement/cases-proceedings/132-3219/true-ultimate-standards-everywhere-inc-truste-matter. 
4 

to certify the privacy and security of online retailers and certain other websites.16 ControlScan 

offered a variety of privacy and security seals for display on websites. Consumers could click on 

the seals to discover exactly what assurances each seal conveyed. The FTC alleged that 

ControlScan deceived consumers about how often it actually monitored the sites that displayed 

its seals and the steps it took to verify the sites’ privacy and security practices. The order bars 

such misrepresentations, required the company to take down its seals, and includes an over-

$850,000 judgment for disgorgement against the company and its founder. 

Second, international data-transfer agreements permitting the global transfer of data – 

including the recently negotiated Privacy Shield Framework and its predecessor, the U.S.-EU 

Safe Harbor Framework – are also founded on the enforceability of promises to comply with 

codes of conduct. For example, the Privacy Shield, once finalized, will allow companies to 

export data collected in the EU to the United States if they commit to the code of conduct and 

certify compliance. These representations are enforceable under the FTC Act, pursuant to the 

prohibition on deceptive statements,17 and strengthen the privacy protections provided to EU 

citizens in the United States.18 The FTC has brought 39 cases involving alleged deceptive claims 

regarding a firm’s compliance with the Safe Harbor Framework, and has committed to 

vigorously enforce the Privacy Shield Framework going forward. 

Finally, in a case against Google – which the FTC settled for $22.5 million – the FTC 

alleged that Google provided deceptive instructions for opting out of third-party cookies on 

Apple’s Safari browser.19 The complaint alleged that Google’s deceptive opt-out instructions 

contradicted its promise to abide by the Network Advertising Initiative’s (“NAI”) code of 

conduct, which requires truthful disclosure of data practices. The FTC’s complaint alleged, 

among other things, that Google’s representation of compliance with the NAI code was 

deceptive. 

B. Policy and Education 

The FTC has long encouraged industry to establish strong, enforceable codes of 

conduct.20 In addition, the FTC has written reports and hosted a variety of workshops to discuss 

policy solutions to address privacy and technological issues similar to those raised by the NPRM. 

                                                            

16 FTC v. ControlScan, Civ. No. 1:10-cv-0532 (N.D.Ga. Feb. 25, 2010), available at

https://www ftc.gov/enforcement/cases-proceedings/072-3165/federal-trade-commission-plaintiff-v-controlscan-inc. 17 See supra n.11. 18 See Letter from Chairwoman Edith Ramirez to Commissioner Věra Jourová, at 1-2 (Feb. 23, 2016). 19 The $22.5 million penalty against Google arose from the fact that the complaint alleged violations of a prior 

consent decree. For initial violations of the FTC Act, the FTC lacks civil penalty authority, but is able to pursue 

equitable remedies, including disgorgement. A company that fails to comply with an FTC order is subject to a civil 

penalty of up to $16,000 per violation, or $16,000 per day for a continuing violation. See 15 U.S.C. § 45(l); 16 

C.F.R. § 1.98(c). 

20 See, e.g., Prepared Statement of the FTC on Emerging Threats in the Online Advertising Industry, Before the 

Comm. On Homeland Security and Governmental Affairs, Permanent Subcomm. on Investigations, 113th Cong. at 2 

(May 15, 2014), available at

https://www.ftc.gov/system/files/documents/public statements/309891/140515emergingthreatsonline.pdf; 

Testimony of the FTC on the Use of Facial Recognition Technology by Governments and the Private Sector Before 

the Senate Comm. on the Judiciary Subcomm. on Privacy, Technology, and the Law, 112th Cong. (July 18, 2012), 

available at https://www.ftc.gov/sites/default/files/documents/public statements/prepared-statement-federal-tradecommission-use-facial-recognition-technology-governments-and/120718facialrecognition.pdf. 
5 

In February 2013, for example, the FTC published a staff report encouraging clear and 

conspicuous privacy disclosures on mobile devices.21 In January 2015, the FTC published a staff 

report on the Internet of Things that encouraged the development of industry codes of conduct.22 

In November 2015, the FTC held a workshop on cross-device tracking to examine how 

companies are able to link the activities of a single consumer across devices, including 

computers, smartphones, and televisions.23 And later this year, the FTC will host a workshop on 

“smart” TVs, which will bring together industry, academic, government, and consumer 

protection experts to explore the privacy implications of pervasive tracking of consumers’ media 

consumption.24 

Finally, the FTC engages in extensive outreach efforts to provide business guidance and 

consumer education about privacy and data security. The FTC has distributed millions of copies 

of education materials for consumers and businesses to address security and privacy.25 The FTC 

also develops and maintains several popular web-based resources for consumers and businesses 

to learn more about privacy and security.26 For example, earlier this month, the FTC launched 

an online tool that health apps can use to determine what laws and regulations govern their 

activities, which the FTC developed in coordination with other federal agencies.27

III. Suggestions Regarding the Proposed Certification Program 

I support the FCC’s efforts to protect consumer privacy in connection with its proposal to 

expand the market for set-top boxes. The FCC’s proposal that cable and satellite companies 

require third-party set-top box manufacturers to certify compliance with the same protections 

applicable to cable and satellite companies will provide valuable privacy protections for 

                                                            

21 FTC Staff Report, Mobile Privacy Disclosures: Building Trust Through Transparency 15-16 (February 2013), 

available at https://www.ftc.gov/sites/default/files/documents/reports/mobile-privacy-disclosures-building-trustthrough-transparency-federal-trade-commission-staff-report/130201mobileprivacyreport.pdf. See also FTC 

Workshop, In Short: Advertising & Privacy Disclosures in a Digital World (May 30, 2012), 

https://www.ftc.gov/news-events/events-calendar/2012/05/short-advertising-privacy-disclosures-digital-world. 22 FTC Staff Report, Internet of Things: Privacy and Security in a Connected World 49 (Jan. 2015) available at

https://www ftc.gov/system/files/documents/reports/federal-trade-commission-staff-report-november-2013-

workshop-entitled-internet-things-privacy/150127iotrpt.pdf; See also FTC Workshop, Internet of Things: Privacy 

and Security in a Connected World (Nov. 19, 2013), https://www ftc.gov/news-events/eventscalendar/2013/11/internet-things-privacy-security-connected-world. 23 FTC Workshop: Cross-Device Tracking (Nov. 16, 2015), https://www.ftc.gov/news-events/eventscalendar/2015/11/cross-device-tracking. 24 Fall Technology Series: Smart TV (Dec. 7, 2016), https://www ftc.gov/news-events/events-calendar/2016/12/falltechnology-series-smart-tv. 25 See Privacy & Data Security Update (2015), available at https://www.ftc.gov/reports/privacy-data-securityupdate-2015. 26 See, e.g., IdentifyTheft.gov (http://www.identitytheft.gov); OnguardOnline.gov (http://www.onguardonline.gov); 

Start with Security: A Guide for Business (https://www ftc.gov/tips-advice/business-center/guidance/start-securityguide-business). 27 FTC, Mobile Health Apps Interactive Tool, available at https://www.ftc.gov/tips-advice/businesscenter/guidance/mobile-health-apps-interactive-tool. The FTC developed the guidance tool in conjunction with the 

Department of Health and Human Service’s Office of the National Coordinator for Health Information Technology, 

the Office for Civil Rights, and the Food and Drug Administration. 
6 

consumers.28 The FTC’s experience in supporting and enforcing privacy codes of conduct 

provides valuable guidance about how the certification approach proposed by the FCC can be 

effective. Requiring third-party set-top box manufacturers to promise that they will comply with 

cable and satellite statutory privacy provisions will be effective only if such promises are 

enforceable. The FTC can enforce manufacturers’ promises by using its Section 5 authority to 

prohibit deceptive practices, as it has done in the types of cases described in Section II.29 

The FCC’s final rule on set-top boxes should require that MVPDs provide access only to 

those third-party set-top boxes that have provided consumer-facing statements promising to 

comply with the privacy obligations that apply to MVPDs.30 The FTC’s deception authority is 

clearly implicated by certifications to consumers. Examples of enforceable statements to 

consumers could include statements within privacy policies, on other portions of a consumerfacing website, on a retail box, on the device itself, or in the user interface of the device. In any 

scenario, the third-party set-top box manufacturers should make a representation to consumers 

that their set-top boxes will offer the same privacy protections that the cable and satellite privacy 

statutes require. 

To help consumers better understand these privacy promises, third-party set-top box 

manufacturers should provide clear and prominent disclosures. The FTC has published several 

reports that provide suggestions for effective disclosure of data practices, all of which emphasize 

the importance of short, easy-to-understand, and just-in-time disclosures.31 Such disclosures 

could include a set-top box privacy “pledge” that would appear on the product package, the 

product specification page, and/or other prominent locations. The pledge could include a link to 

a consumer-friendly website explaining the manufacturers’ obligations under the pledge.32 

MVPDs and third parties could then commit to this pledge. Section 5 liability would be 

triggered if any of the set-top box manufacturers’ practices were inconsistent with any material 

obligations of the pledge. Consumers that are only interested in determining whether a set-top 

box would honor the standard privacy protections could look for the pledge on the box or the 

website. Those consumers with greater interest in understanding the content of the pledge would 

be able to review the terms of the pledge on the consumer-friendly website. 

IV. Conclusion 

If the FCC proceeds with the proposed set-top box rule, the final rule would mandate that 

MVPDs provide data access only to third-party set-top box manufacturers that have certified 

                                                            

28 Because the privacy protections implicated by the proposed certification requirement are the same protections that 

Congress enacted under Cable Communications Policy Act of 1984, the FTC is not commenting on the substance of 

these protections. 

29 The FTC also can enforce the promises that cable and satellite providers make to consumers, including promises 

regarding their data collection, use, and disclosure practices. 

30 The NPRM asks who should be responsible for maintaining a record of certifications, and suggests as possibilities 

a standards body or the FCC itself. For the purpose of FTC Act liability, a repository of certifications would not be 

necessary, provided that the statements are consumer-facing. 31 See supra n.8 at 15-16; n.24 at 39-43. 32 I encourage consumer testing of disclosures, to the extent feasible. The FTC has found testing to be a useful tool 

for developing effective consumer privacy disclosures. See, e.g., Financial Privacy Rule: Interagency Notice 

Research Project (Mar. 2011), available at https://www ftc.gov/tips-advice/business-center/guidance/financialprivacy-rule-interagency-notice-research-project (describing eight-agency research project to develop privacy 

disclosures related to the Gramm-Leach-Bliley Act).