UNITED STATES OF AMERICA

Federal Trade Commission

WASHINGTON, D.C. 20580

Office of Commissioner

Rebecca Kelly Slaughter

1

Disputing the Dogmas of Surveillance Advertising 

National Advertising Division Keynote 2021

Remarks of Commissioner Rebecca Kelly Slaughter1

As Prepared for Delivery

October 1, 2021

Good morning, everyone! Thank you, Mary, for that introduction and for inviting me 

here to deliver these keynote remarks. I’m excited to have a chance to discuss NAD 2021’s 

themes about the future of ad law and, as the organizers put it, “the critical trust and technology 

challenges facing the advertising industry.” As you can imagine, I’ve got plenty of thoughts 

about the state of digital advertising today and about the need for some fundamental reforms of 

the industry. But I don’t want this to be a one-sided conversation, so I’m happy to take questions 

about these remarks and other matters at the FTC. 

As you all know, we’ve been busy these last few months at the agency. We’ve begun the 

work of revitalizing and strengthening our regulatory and enforcement tools and taking our 

statutory obligations and legal authorities more seriously to advance the work of protecting 

consumers and promoting competition. An important part of keeping our work fresh and 

effective is challenging assumptions—whether recently developed or longstanding—about 

everything from market operation, enforcement objectives, and the agency’s strategic approach. 

So, I’d like to frame my remarks today around assumptions—some of which in practice operate 

more like dogmas—that I believe are particularly in need of challenge in the online advertising 

ecosystem.

Specifically, I want to push back against the following erroneous points of conventional 

wisdom that I think tend to undergird legal and policy debate about digital surveillance: (1)

privacy is the key issue; (2) transparency is the key solution; (3) the policy options are limited to 

opt-in or opt-out; (4) surveillance advertising is necessary to support free services; and (5) the 

FTC is toothless absent new federal legislation. All of those statements, which I’ve heard 

repeatedly presented as truisms, are flawed. Today, I want not only to explain why I believe they 

are flawed but also to outline a vision for an ad-supported internet future that is better grounded 

in the realities of today’s markets and the law.

 1 The views expressed in these remarks are my own and do not necessarily reflect the views of the Federal Trade

Commission or any other commissioner.
2

I. It’s Not Just About Privacy

The first assumption I would like to challenge is the idea that “privacy” is the only

concern for consumers in digital markets. Of course, privacy is critically important—I share the 

view that it is a fundamental right. But it is not the only important concept either as a matter of 

law or as a matter of values when it comes to the data economy. I worry that, when we focus 

exclusively or even primarily on “privacy,” we can—either intentionally or unintentionally—

exclude from our gaze other critical issues people face in digital markets.

I may sound like a broken record on this point; I’ve been beating the “not just privacy”

drum for several years.2 And, indeed, our work at the FTC has already moved past narrow 

traditional “privacy” problems like dishonest terms of service for data use. We’ve issued 

guidance on algorithmic bias,3 explored “dark patterns” in user-interface design,4 and gone after 

companies that have sold sensitive information such as Social Security numbers to other 

companies that had no legitimate business need for the information.5

I’m concerned about the harmful effects of a market based around leveraging massive 

amounts of people’s data. I’m especially concerned about harms to civil rights and equal 

opportunity, the proliferation of misinformation, harms to competition, and increasing labor 

exploitation, including through worker surveillance. These concerns go far beyond traditional 

“privacy” issues, and they merit investigation as unfair practices that might violate the FTC Act. 

But they cannot be separated from the traditional privacy problems entirely; all stem from the 

same indiscriminate data collection. I implore us to think about these problems collectively as 

“data abuses” rather than force all these issues under the privacy umbrella. 

I am particular about using the right framing because appropriate identification of a 

problem is key to effective tailoring of solutions. If we are concerned only about privacy—the 

sharing of personal information without knowledge or consent—we may narrowly focus on 

solutions that address only that knowledge and consent, such as burdensome opt-in or opt-out 

frameworks, and not look at the economy and society-wide implications of unfettered data 

collection used to fuel surveillance advertising. 

Instead, I’m interested in seeing us squarely target the business practices that I think are 

the source of so much harm. 

 2 See, e.g., Rebecca Kelly Slaughter, The Near Future of U.S. Privacy Law, Silicon Flatirons, University of 

Colorado Law School (Sept. 6, 2019), 

https://www.ftc.gov/system/files/documents/public_statements/1543396/slaughter_silicon_flatirons_remarks_9-6-

19.pdf.

3 Elisa Jillson, Aiming for truth, fairness, and equity in your company’s use of AI, FTC BUS. BLOG (Apr. 19, 2021),

https://www.ftc.gov/news-events/blogs/business-blog/2021/04/aiming-truth-fairness-equity-your-companys-use-ai.

4 See, e.g., Bringing Dark Patterns to Light: An FTC Workshop (Apr. 29, 2021), https://www.ftc.gov/newsevents/events-calendar/bringing-dark-patterns-light-ftc-workshop.

5 Compl., FTC v. Blue Global, LLC, No. 2:17-cv-02117-ESW (D. Ariz. July 5, 2017), 

https://www.ftc.gov/system/files/documents/cases/ftc_v_blue_global_de01.pdf.
3

II. Notice and Choice Is Not the Answer

That brings me to the second assumption I would like to challenge: that we can solve for 

data abuses by providing consumers with more transparency and control—in other words, more 

notice and choice. For too long, the policy debate around data collection and abuse has hinged on 

the principles of notice and choice and whether corresponding opt-in or opt-out rules should 

govern data collection. The notice-and-consent framework began as a sensible application of 

basic consumer protection principles to privacy—tell consumers what you are doing with their 

data, secure consent, and keep your promises. It also has some intuitive appeal, because it sounds 

like it is providing users with more autonomy. 

Historically, this is how much of the FTC’s data privacy work operated, through cases 

against companies that misled users about what was happening with their data in violation of the 

deception prohibition in the FTC Act. In those cases, a tell-the-truth remedy might seem apropos:

Be honest with users about what you are doing with their data, and you will be fine. But that 

approach simply doubles down on a notice-and-consent universe in which neither notice nor 

consent is meaningful for most users.

Notice is mostly in the form of lengthy click-through contracts. Few consumers can 

dedicate the time and legal parsing required to understand them.6 And choice is illusory at best. 

Users do not actually have bargaining power—even if they could read and understand the 

lengthy terms of contracts they must sign, their options are only to agree and access the service 

or to refuse and be denied access. And, given limited competition in the marketplace, the choice 

to refuse access may not be a viable one. Choice is fallacious in other ways as well: Many sites 

are designed to optimize the number of “opt-ins,” including through dark patterns, where tricks 

are employed by designers or developers to make users do something they otherwise would not 

want to do. In other words, what feels like “choice” may in fact be the product of manipulation.

But, even if we imagined a hypothetical universe in which notice and choice were 

actually meaningful, they would still be problematic because they put all of the burden on users 

to protect their data even though those users have very little control over that data. Companies 

can and do track consumers across their devices and locations, and data about consumers are 

shared, sold, or used for targeting. Much of this happens between and among companies with 

which consumers never choose to interact.7

Notice and choice will not address the broader surveillance practices upon which the 

current digital advertising economy is built. Take, for example, the paradigmatic example of 

overcollection: the gratuitous collection and sharing of geolocation information by the “Brightest 

 6 A widely cited article calculated that it would take a consumer 76 workdays to read all the privacy policies she 

encounters each year. See Alexis C. Madrigal, Reading the Privacy Policies You Encounter in a Year Would Take 76 

Work Days, THE ATLANTIC (Mar. 1, 2012), https://www.theatlantic.com/technology/archive/2012/03/reading-theprivacy-policies-you-encounter-in-a-year-would-take-76-work-days/253851/.

7 See, e.g., John Keegan & Alfred Ng, There’s a Multibillion-Dollar Market for Your Phone’s Location Data, THE 

MARKUP (Sept. 30, 2021), https://themarkup.org/privacy/2021/09/30/theres-a-multibillion-dollar-market-for-yourphones-location-data.
4

Flashlight Free” app.8 The app’s collection of geolocation information had nothing to do with the 

service on offer—activating the camera flash for illumination. Consumers had no reason to think 

their geolocation information would have been sent to advertising networks. The FTC brought a 

case against the app developer based on failure to disclose that collection, but there is no reason 

to think most consumers would have been meaningfully aware of that collection or data transfer 

even if it had been disclosed in the app’s terms of service. 

Why would the flashlight app need or want to collect data totally unrelated to its service? 

Monetization of its users and their data. This is a pattern we see all too often across the digital 

economy. Too many services are about leveraging consumer data instead of straightforwardly 

providing value. For even the savviest users, the price of browsing the internet is being tracked 

across the web.9 Connecting with your community on social media or ordering delivery on your 

phone can mean putting up your geolocation information for sale.10 Studies show that even idle 

smartphones transmit undisclosed amounts and types of information to their manufacturers.11

The practice of nearly unconstrained data collection, retention, and sharing is harmful to 

consumers—whether or not the collection itself has been disclosed in some way. Overcollection 

encourages leveraging huge amounts of data as a surveillance business model and then turning 

those data into products, some of which have: reproduced patterns of discrimination against 

protected classes in areas of key economic opportunities;

12 increased the severity of data 

breaches;

13 and fueled misinformation campaigns.14 There are also less dramatic harms of 

 8 See Press Release, Fed. Trade Comm’n, Android Flashlight App Developer Settles FTC Charges It Deceived 

Consumers (Dec. 5, 2013), https://www.ftc.gov/news-events/press-releases/2013/12/android-flashlight-appdeveloper-settles-ftc-charges-it-deceived.

9 See, e.g., Farhad Manjoo, I Visited 47 Sites. Hundreds of Trackers Followed Me, N.Y. TIMES (Aug. 23, 2019), 

https://www.nytimes.com/interactive/2019/08/23/opinion/data-internet-privacy-tracking.html.

10 See, e.g., Jennifer Valentino-Devries et al., Your Apps Know Where You Were Last Night, and They’re Not 

Keeping It Secret, N.Y. TIMES (Dec. 10, 2018), https://www.nytimes.com/interactive/2018/12/10/business/locationdata-privacy-apps.html.

11 See, e.g., Douglas J. Leith, Mobile Handset Privacy: Measuring The Data iOS and Android Send to Apple And 

Google, Trinity College Dublin (Mar. 25, 2021), https://www.scss.tcd.ie/doug.leith/pubs/apple_google2.pdf (“We 

note that at the bottom of the Google text beside the ‘Usage & Diagnostics’ option it says, ‘Turning off this feature 

doesn’t affect your device’s ability to send the information needed for essential services such as system updates and 

security.’ Our data shows that the ‘essential’ data collection is extensive, and likely at odds with reasonable user 

expectations.”).

12 See, e.g., Yeshimabeit Milner & Amy Traub, Data Capitalism and Algorithmic Racism, DEMOS (May 17, 2021), 

https://www.demos.org/research/data-capitalism-and-algorithmic-racism; Rebecca Kelly Slaughter, Algorithms and 

Economic Justice: A Taxonomy of Harms and a Path Forward for the Federal Trade Commission, 23 Yale J.L. & 

Tech., Yale ISP Digital Future Whitepaper Series (Aug., 2021), 

https://yjolt.org/sites/default/files/23_yale_j.l._tech._special_issue_1.pdf.

13 See, e.g., Whitney Lance, 2020 Sees Huge Increase in Records Exposed in Data Breaches, TECH REPUBLIC (Jan. 

21, 2021), https://www.techrepublic.com/article/2020-sees-huge-increase-in-records-exposed-in-data-breaches/.

14 See, e.g., U.S. Senate Select Committee on Intelligence, Russian Active Measures Campaigns and Interference in 

the 2016 U.S. Election Volume 2: Russia’s Use of Social Media with Additional Views (Nov. 10, 2020), 
5

pervasive data collection. For example, ads in mobile apps and websites drain consumers 

phones’ battery life and may make them pay more in phone bills.15 Lengthy explorations of these 

kinds of harms have been catalogued by consumer advocates,

16 academics,17 and even FTC 

commissioners.18

Just last week, we saw another report that shocked the conscience about the dangerous 

consequences of the surveillance business model. The Wall Street Journal reported that 

Instagram made body image issues worse for one in three teenage girls, fueling eating disorders, 

mental health crises, and self-harm.19 And, even worse, Facebook knew that was the case: The 

statistic came from their own internal research. 

Each of these problems merits investigation as potential violations of the law, especially 

the unfairness prong of the FTC Act. And none of them would be solved by more notice and 

choice. 

Consumers seem to be expressing their dislike with this system in every poll they can. 

According to Consumer Reports, 75 percent of Americans think that the power of platforms is a 

major or moderate problem; most Americans think they are not getting objective and unbiased 

search results when shopping for information online; and 81 percent of Americans are either very 

or somewhat concerned about the amount of data platforms hold on them to build consumer 

profiles.20 A Deloitte survey indicated that an even higher number of Americans, over 90 

percent, agree to the terms and conditions on mobile apps without reading them.21 Pew paints a 

 https://www.intelligence.senate.gov/sites/default/files/documents/Report_Volume2.pdf.

15 Craig Silverman, This Giant Ad Fraud Scheme Drained Users’ Batteries and Data by Running Hidden Video ads 

in Android Apps, BUZZFEED NEWS (Mar. 21, 2019), https://www.buzzfeednews.com/article/craigsilverman/inbanner-video-ad-fraud.

16 See, e.g., Civil Rights and Privacy Letter, Aug. 4, 2021, https://cdt.org/wp-content/uploads/2021/08/2021-08-04-

FTC-civil-rights-and-privacy-letter-Final.pdf.

17 See, e.g., Daniel J. Solove & Danielle Keats Citron, Privacy Harms, GW Law Faculty Publications & Other 

Works (2021), https://scholarship.law.gwu.edu/cgi/viewcontent.cgi?article=2790&context=faculty_publications.

18 See, e.g., Rebecca Kelly Slaughter, Algorithms and Economic Justice, 23 Yale J.L. & Tech., Yale ISP Digital 

Future Whitepaper Series (Aug., 2021), https://yjolt.org/sites/default/files/23_yale_j.l._tech._special_issue_1.pdf.

19 See Georgia Wells, Jeff Horwitz & Deepa Seetharaman, Facebook Knows Instagram Is Toxic for Teen Girls, 

Company Documents Show, WALL ST. J., Sept. 14, 2021, https://www.wsj.com/articles/facebook-knows-instagramis-toxic-for-teen-girls-company-documents-show-11631620739. 

20 Platform Perceptions: Consumer Attitudes on Competition and Fairness in Online Platforms, CONSUMER 

REPORTS (Sept. 24, 2020), https://advocacy.consumerreports.org/wp-content/uploads/2020/09/FINAL-CR-surveyreport.platform-perceptions-consumer-attitudes-.september-2020.pdf. 21 2017 Global Mobile Consumer Survey: US edition, Deloitte, at 12, 

https://www2.deloitte.com/content/dam/Deloitte/us/Documents/technology-media-telecommunications/us-tmt-2017-

global-mobile-consumer-survey-executive-summary.pdf.
6

similar picture: 81 percent of Americans feel as if they have little control over the data 

companies collect and believe the risks of that data collection outweigh the benefits.22

I share that view. We are all surveilled, tracked, targeted—some of our communities 

more than others—and too often our choices are manipulated and limited. This is not the result 

of the expression of informed preferences in a well-functioning marketplace. Large 

intermediaries dominate data markets, and consumers are not able to exercise meaningful choice 

with respect to how their data is collected, used, and shared. Last year, the New York Times ran 

a powerful article by Kashmir Hill, the title of which says it all: “I tried to live without the tech 

giants. It was impossible.”23 As federal enforcers, it is incumbent on us to identify the unfair, 

deceptive, and anticompetitive practices that are harming consumers and to use all of our 

statutory tools to strategically and structurally address illegal conduct.

The pervasive nature of commercial surveillance, its substantial injuries to consumers, its 

unavoidable nature, and the paucity of benefits that outweigh those injuries demonstrate a

fundamental unfairness at the heart of the data economy. 

A data regime built entirely on notice and consent will perpetuate this unfairness because 

it accepts as a baseline the idea that companies are entitled to collect vast amounts of user data as 

long as they are honest about it. 

III. Minimization is a Better Model

That brings me to the next assumption I would like to challenge: the idea that we are 

stuck with notice and consent as a framework, choosing between opt-in and opt-out for different 

types of data. Understanding that the collection itself fuels the panoply of problems under the 

umbrella of “data abuses” helps point to a more effective solution that should be considered: 

bright-line purpose and use restrictions that minimize the data that can be collected and how it 

can be deployed.24 This data minimization approach would turn off the data pump and deprive 

the surveillance-economy engine the fuel it needs to run. 

Fundamentally, data minimization should mean that companies collect only the 

information necessary to provide consumers with the service or product they actually request and

use the data they collect only to provide that service or product.

25 Data minimization should be 

coupled with further use, purpose, sharing, and security requirements to ensure that the 

 22 Americans and Privacy: Concerned, Confused and Feeling Lack of Control Over Their Personal Information, 

PEW RESEARCH CENTER (Nov. 15, 2019), https://www.pewresearch.org/internet/2019/11/15/americans-and-privacyconcerned-confused-and-feeling-lack-of-control-over-their-personal-information/.

23 Kashmir Hill, I Tried to Live Without the Tech Giants. It Was Impossible, N.Y. TIMES (July 31, 2020), 

https://www.nytimes.com/2020/07/31/technology/blocking-the-tech-giants.html.

24 Data minimization is a concept grounded in the Fair Information Practice Principles. See IAPP, Fair Information 

Practice Principles, https://iapp.org/resources/article/fair-information-practices/. 25 See, e.g., Eric Null, Iseuda Oribhabor & Willmary Escoto, Data minimization: Key to protecting privacy and 

reducing harm, ACCESS NOW, May 20, 2021, https://www.accessnow.org/cms/assets/uploads/2021/05/DataMinimization-Report.pdf.
7

information companies can permissibly collect isn’t used to build tools or services that imperil 

people’s civil rights, economic opportunities, or personal autonomy.

Minimization is not a new concept, and I will be the first to acknowledge that the term 

comes with some baggage from its alternative life in the national security space. As some of you 

may know, before being appointed to the FTC I worked in the Senate as Senator Schumer’s 

Chief Counsel. In addition to the consumer and competition issues I continue to work on today, I

worked on a whole range of matters that come before the Senate as well—including national 

security surveillance and the end of the NSA’s bulk collection program. In that sphere, data can 

be collected only pursuant to standards such as “reasonable articulable suspicion” for certain 

investigations, without which collection is unlawful. Additional processing, analysis, 

dissemination, and retention of the information must also be minimized. That means those 

agencies are largely prevented from collecting or disseminating U.S. person information that 

isn’t related to an investigation; they must promptly destroy records they acquire that don’t 

contain relevant intelligence information; and information that is relevant can be retained only 

for a limited time prescribed by law.26

Now, I know there are limits to this metaphor and that important work is still being done 

to reform and oversee these programs. And we don’t have to use the word minimization, because 

perhaps it is too weighed down with its failure to live up to its promise in the national security 

space; we could talk instead about “purpose and use limitations.” But for now I’m going to stick 

to minimization, not only because “purpose and use limitations” is a mouthful. The concept of 

minimization is a valuable one, reflecting important understandings that can translate to the 

commercial space. Among those: Collectors of information hold enormous power. Without 

oversight, abuse is nearly inevitable. Data collection must have limits. Data should only be 

collected for discrete and specific purposes. We should be extremely skeptical about secondary 

uses of data—that is, uses beyond the purpose for which the data was collected. Collection and 

use limitations can help protect people’s rights. 

These lessons translate beyond the national security space into the commercial sphere. 

And, for the reasons discussed above, we should care about protection beyond traditional notions 

of privacy, because data can be abused in other ways. We should approach commercial 

surveillance and use of our data with the same seriousness that we have in the national security 

environment. It should not be necessary to trade one’s data away as the cost of full participation

in society and the modern information economy.

Instead, the collection, retention, and sharing of personal information should be tightly 

linked to a specific and particular purpose. Commercial law for the most part hasn’t taken this 

 26 See Minimization Procedures used by the National Security Agency in Connection with Acquisitions of Foreign 

Intelligence Information Pursuant to Section 702 of the Foreign Intelligence Surveillance Act of 1978, as Amended, 

https://www.dni.gov/files/documents/Minimization%20Procedures%20used%20by%20NSA%20in%20Connection

%20with%20FISA%20SECT%20702.pdf.
8

idea of data minimization seriously, though COPPA has a minimization provision,27 as does 

GDPR.

28 But the concept can be extended more broadly. 

Consumers ought to be able to make sensible decisions about the products they want to 

use and companies should ask them only for the data required to provide the products and 

services they actually ask for—not additional data to build consumer profiles. There also ought 

to be strict limits on how that information is shared and for how long and under what conditions 

it’s stored.

Additional limitations on how data are used can also prevent abuse. Our personal 

information should not be used by companies to exacerbate economic inequality or segregation, 

further marginalize workers or deepen other disparities, whether intentional or not. Just as the 

government’s use of huge datasets to build profiles of citizens violates civil rights and liberties,

29

widespread commercial collection can imperil freedom. And minimizing commercial data 

collection is inherently protective of civil liberties, too: Governments can’t acquire information 

on Americans that no one collected in the first place. 

A minimization framework would not outright ban surveillance advertising, but it would 

effectively disable it. If companies cannot indiscriminately collect data, advertising networks 

could not build microtargeting profiles. Without the monetization aspect of microtargeting, the 

incentive to indiscriminately collect data falls away. 

Finally, a minimization approach could facilitate compliance by establishing bright-line 

rules around what data can be collected and how it can be used. That will allow us to move past 

the compliance exercise of interminable and unreadable click-through terms of service contracts 

that give the illusion of meaningful notice and consent. 

Of course, addressing the myriad concerns posed by the surveillance economy requires a 

multifaceted approach. Corporate self-dealing is also a serious problem in the data ecosystem,

and, as long as key digital markets are controlled by just a few large, data-hungry online 

platforms, both consumers and prospective entrants are at their mercy. As Public Knowledge’s 

Charlotte Slaiman discussed in her recent Senate Judiciary testimony, decisions by gatekeepers 

such as Facebook can have dramatic effects on publishers, as happened in Facebook’s “pivot to 

video.”30 Similarly, Google’s decision to block third-party cookies in Chrome while launching a 

privacy sandbox could mean an even stronger grip by the company on the internet advertising 

 27 See Fed. Trade Comm’n, Complying with COPPA: Frequently Asked Questions, (July 2020), 

https://www.ftc.gov/tips-advice/business-center/guidance/complying-coppa-frequently-asked-questions-0.

28 Article 5(1)(c) of the European Union’s General Data Protection Regulation, https://gdpr-info.eu/art-5-gdpr/.

29 See, e.g., Tim Lau, Predictive Policing Explained, BRENNAN CENTER FOR JUSTICE (Apr. 1, 2020), 

https://www.brennancenter.org/our-work/research-reports/predictive-policing-explained.

30 See Charlotte Slaiman, Testimony of Charlotte Slaiman, Competition Policy Director, Public Knowledge, Before 

the United States Senate Committee on the Judiciary, Subcommittee on Competition Policy, Antitrust, And 

Consumer Rights for the Hearing on Big Data, Big Questions: Implications for Competition and Consumers 5– 6, 

(Sept. 21, 2021), https://www.judiciary.senate.gov/imo/media/doc/Slaiman%20Testimony.pdf.
9

market despite its purported intention of protecting user privacy.31 But minimization can be an 

important tool in the solutions toolbox.

IV. Limiting Surveillance Will Not Break the Internet

I suspect that the reason so much of our attention has been focused on legal and policy 

remedies that do not address the underlying surveillance business model is a sense that the 

business model is necessary for the survival of the many ad-supported businesses that populate 

our digital economy. This is another myth that merits busting.

Let me be very clear: I am not challenging the business model of ad-supported services. 

We have a rich tradition in this country of services being provided for free to consumers in 

exchange for their eyes and ears on advertising; television, radio, and newspapers are front of 

mind in that category. The difference between traditional ad-supported models and the current 

surveillance model is that the new model trades consumer data for a service, not just their 

attention. And those data are, in turn, used to fuel broader surveillance systems. 

Advertising is necessary, and it should give consumers clear and accurate information 

about the products and services that they may want to buy or use. But no part of that goal 

requires siphoning consumer data, building extensive profiles on them, or selling that 

information to even less regulated third parties. 

There is a better future for the ad-supported internet. One that respects people’s rights 

and doesn’t exacerbate already worsening social inequalities. Good advertising serves a real 

purpose; it existed before pervasive tracking and behavioral advertising and will exist after it.

Good advertising can be targeted; of course an advertiser wants to make sure her product reaches 

the target audience efficiently. But targeting can be done contextually, triggered by the content to 

which an ad is attached, or even through broad and general categories. These types of targeting 

do not raise the same concerns that surveillance advertising does. 

If surveillance advertising went away, would consumers really lose access to clear and 

accurate information? Or could the internet be a better place?

The New York Times’ experience in Europe may be unique, but it’s certainly worth 

considering. According to news reports, in order to comply with GDPR, the Times blocked

open-exchange ad buying on its European pages and followed that by blocking behavioral 

targeted advertising and didn’t see ad revenues drop. We can’t generalize the experience of one 

of the world’s most famous publications, but it shows that non-tracked ads can work to ensure a 

vibrant internet.

There’s good news for smaller publishers too. A 2019 study showed that behavioral 

advertising only led to around a 4% revenue increase to publishers over non-cookie based 

advertising. This study belies advertiser claims that regulation of the data ecosystem—turning 

off the data spigot—will harm a vibrant publishing marketplace online.

32 If the evidence holds 

 31 Id. 32 See Veronica Marotta, Vibhanshu Abhishek & Alessandro Acquisti, Online Tracking and Publishers’ Revenues:
10

that data regulation merely shaves off low single-digit revenues for online publishers, then we 

really must consider the balance of fairness in ending an abusive system on one side and 

marginal reductions in revenue on the other. It’s also not clear to me that we can get a reliable 

analysis of the value of surveillance advertising in a universe where some advertisers are using it 

and some are not because the control group distorts the field. In other words, if we are 

considering a model where behavioral microtargeting is not available to any advertisers, all 

advertising would be on a level contextual playing field. 

V. The FTC Can Lead the Way Forward on Data Minimalism

So how do we get from the market morass we have today to a brighter data future? This 

brings me to the final myth I’d like to bust, which is that federal legislation is necessary to 

effectuate any of the changes I’ve floated. To be clear, federal legislation would be great; I have 

long supported federal privacy (or, as I would prefer, data abuse) legislation that would set forth 

clear rules of the road, explicitly empower the FTC to police abuses and adapt to changing 

market conditions, and impose real penalties for failure to comply. But in the absence of federal 

legislation, we cannot sit idly by. The FTC does have tools, albeit imperfect ones, to tackle data 

abuses. 

First, we can target for enforcement unfair practices that exploit the fundamental 

asymmetry between individuals and corporations in this system. As a reminder, our standard for 

proving conduct is unfair under Section 5 is that (1) it causes or is likely to cause substantial 

injury, (2) the injury is not reasonably avoidable by consumers, and (3) the injury is not 

outweighed by benefits to consumers or to competition.33 In addition to targeting unfair conduct 

with respect to data, we can also ensure that we are tailoring remedies to get to the root causes of 

the illegal conduct. For example, we could pursue minimization terms in our orders, including 

limitations on collection of data and requirements of deletion.

But one-off enforcement cases have their limits in disciplining the market and 

fundamentally changing business practices. Promulgating clear rules in this area would be 

beneficial to consumers and businesses alike. Although it is much maligned, the FTC does have 

rulemaking authority under Section 18 of the FTC Act to address prevalent conduct that is unfair 

or deceptive. The process begins with an advance notice of proposed rulemaking, which asks 

important questions and builds an evidentiary record off of which a rule or several rules can be 

developed. 

I have frequently heard arguments from industry representatives and even some of my 

colleagues that rulemaking in the data space would be inappropriate for the FTC, because it 

necessarily involves value judgments that are better left to Congress. This argument rings hollow 

with me. First of all, by choosing not to act, we are exercising a value judgment that the market 

is working absent intervention. Second, it is incumbent upon us to use the tools Congress 

explicitly gave us—which include rule-writing authority—to carry out our statutory mission. To 

 An Empirical Analysis 7 (May 2019), https://weis2019.econinfosec.org/wpcontent/uploads/sites/6/2019/05/WEIS_2019_paper_38.pdf.

33 15 U.S.C. § 45(n). 
11

do otherwise would be ignoring the will of Congress. And, finally, that argument is premised on 

the mistaken assumption that we can, by “regulatory fiat,” as one of my colleagues has said,

make illegal conduct that is otherwise within the bounds of the law. Not so. We can only write 

rules that address conduct that already violates the FTC Act; the benefit of rulemaking is to 

provide clarity to the markets about what that proscribed conduct is, rather than waiting until

after a violation—and the resultant harm—has occurred to redress it.

We have the opportunity to develop a public, participatory record and use it to draft rules 

that let businesses know what Section 5 means in the context of the data economy. We can show 

how our understanding of what is unfair has evolved in response to these prevailing market 

practices. Providing more specific guidance to industry about the requirements of the law will

facilitate compliance and streamline the Commission’s enforcement burdens, allowing us to use 

our limited resources more efficiently.

Of course, I have no certainty that a rulemaking record would support a minimization 

rule or any other particular approach; I am mindful of the legal and prudential need for the 

agency undogmatically to follow the facts and evidence where they lead. But I am confident that 

it is time for us to start asking the questions and developing the record, before the practices about 

which we are concerned become even more entrenched.

The market is changing whether we promulgate rules or not. Consumers are not just 

complaining to pollsters. As we’re all observing with Apple’s mobile changes, consumers, when 

given the choice, will elect not to be tracked in numbers that are sending shockwaves through 

this industry.34 But I do not want to see an internet ecosystem fully controlled by one or two 

device and operating system manufacturers; that raises very real competitive concerns. Shutting 

off the data spigot for others while filling your own well is the kind of anticompetitive 

innovation that we’re bound to see more of if this space remains unregulated.35

That’s why I see a fairer and more equitable future in leveling the playing field for 

advertisers, service and product providers, and operating system manufactures alike. Bright-line 

rules can be a clear articulation of where the law stands on what are unfair or deceptive acts 

under our Section 5 authority. I believe that’s better for consumers and could even do something 

to address those critical trust and technology challenges facing the advertising industry.

Thank you, and I look forward to your questions.

 34 See Alex Kantrowitz, Apple’s power move to kneecap Facebook advertising is working, CNBC (Sept. 24, 2021),

https://www.cnbc.com/2021/09/24/apples-ios-changes-hurt-facebooks-ad-business.html.

35 See Garrett Sloane, What Apple’s Iphone Update Means for the Ad Industry, ADAGE, Sept. 16, 2021, 

https://adage.com/article/digital-marketing-ad-tech-news/what-apples-iphone-update-means-ad-industry/2366001.