Federal Trade Commission

Privacy Impact Assessment

for

FTC Surveys

Updated February 2022

Reviewed March 2023
2

1 System Overview

The Federal Trade Commission (FTC) conducts surveys of consumers and other

individuals/entities in support of its regulatory and law enforcement mission in order to

promote fair competition and prevent fraud, deception, and other unlawful acts and

practices. These surveys help the FTC better understand howconsumers perceive 

statements or representations made to them by businesses; surveys also allow the FTC to 

collect information about and analyze customers’ experiences with various industries. 

Surveys also allow the FTC to receive feedback and information from its law enforcement 

partners. Information collected through surveys helps the FTC develop appropriate 

disclosure guidance for businesses, analyze trends and issues in certain industries, and 

identify whether certain business practices may be harming consumers, for the purposes of 

enforcement, education, and other initiatives. The FTC often retains experts, contractors 

and/or subcontractors to conduct such surveys on the FTC’s behalf and deliver the results

to staff for analysis and possible regulatory, enforcement or other action.

Surveys may involve the collection or maintenance of personally identifiable information

(PII) about individuals using electronic methods (e.g., surveys conducted through the

Internet, data stored in electronic databases). Accordingly, the FTC has prepared, and is

making publicly available, this Privacy Impact Assessment (PIA), which is legally required

when a Federal agency is developing or procuring electronic information technology (IT) to

collect, maintain or disseminate information about members of the public in identifiable

form.0F

1

Although the FTC’s consumer survey activities do not require the FTC to develop or

procure IT, such activities normally involve IT systems used or operated by the FTC, its

contractors, or subcontractors. Thus, consistent with the E-GOV Act, the FTC has conducted

this PIA to ensure that the use of such IT in conducting surveys on behalf of the FTC

conforms to applicable legal, regulatory, and policy requirements regarding privacy.

The FTC will ensure that all applicable surveys adhere to the requirements of the

Paperwork Reduction Act (PRA) and follow the appropriate channels for OMB approval.

This PIA was also conducted to determine the risks and effects of collecting, maintaining

and disseminating information in identifiable form in an electronic information system as

well as to examine and evaluate protections and alternative processes for handling

information to mitigate potential privacy risks.1F

2

2 Information Collected and Stored within the System2F

3

The following questions are intended to define the scope of the information in the system,

specifically the nature of the information and the sources from which it is obtained.

1 See Section 208 of the E-Government Act of 2002 (E-GOV Act).

2 See Office of Management & Budget (OMB) Memorandum M-03-22 (guidance to Federal agencies on conducting

PIAs) and Circular A-130, Managing Information as a Strategic Resource. 3 This PIA uses the term “system” to describe the FTC’s survey activities as a whole. Survey data may be 

considered part of the FTC’s Privacy Act system of investigational and other nonpublic program records, in 

those cases, if any, the data are maintained and retrieved by individual name or other personally assigned

identifier. See 8.2 below. Such data, however, are not physically maintained in a single, unified electronic or 

paper system, but may be reside in various electronic or paper systems or subsystems maintained or operated 

by the FTC and/or its survey contractors and subcontractors.

 
3

.1 What information is to be collected, used, disseminated, ormaintained?

A survey may be used to collect any type of information, including PII, that the agency 

determines is necessary, appropriate, and within its authority to collect in support of the 

agency’s law enforcement and regulatory mission. See 2.7 below. Since surveys are used by 

FTC staff to perform the Commission’s law enforcement and other authorized activities, the 

PII to be collected and maintained will depend on the survey’s specific law enforcement or 

other purpose.

Information collected from or about survey respondents may include their personal contact

information (e.g., name, postal address, e-mail address, phone number). In some cases, 

surveys may collect contact information for other individuals (e.g., home or e-mail address 

of an individual operating a small business or sole proprietorship with whom the consumer 

being surveyed has dealt). Survey responses may also include any of the following:

• Individual answers to specific survey questions (e.g., multiple choice or narrative

response);

• Demographic data about individuals (e.g., age, sex, race, educationlevel);

• Documents collected from individuals (e.g., financing papers, mortgage information,

credit reports) obtained with the consumers’ explicit consent;

• Other relevant survey records or data (e.g., survey date or time, location,

relevant notes or observations of FTC staff, contractors, or subcontractors).

Information may be collected in written form (e.g., paper or Web-based surveys), or may be

solicited through other means (e.g., in-person interviews, telephone calls). Likewise, survey

responses may be maintained in written/textual form, and, in some cases, may also be

recorded in audio or video format, and then transcribed. See sec. 2.4 below.

When a contractor or subcontractor uses Web-based methods to register participants or

collect survey responses, those information collection methods may result in the collection or 

maintenance of additional user administrative information pertaining to the individual survey

respondent (e.g., userID, passphrase, or other login questions) or information about their

experiences or transactions.

Finally, survey records may include aggregate statistical data or other analyses,

compilations or summaries (i.e., containing no PII) prepared by the FTC itself or by

contractors or subcontractors retained to conduct the survey for the FTC.
4

.2 What are the sources of the information in the system?

The FTC may obtain consumer contact information for its surveys from consumer 

complaints previously submitted to the FTC or to third parties that have shared such 

complaints with the FTC (e.g., other state or local agencies, consumer advocacy groups). In 

some cases, consumer contact information may be drawn from customer lists of businesses 

under investigation by the FTC. On occasion, consumers’ contact information may be

compiled from public sources; for example, in a mortgage survey, consumers and their 

addresses may be pulled from county records of mortgage transactions made publicly 

available online or pulled from hardcopy records at local county offices.

Typically, the FTC contracts with a third party (e.g., expert, survey firm) to conduct the 

survey. In cases where the FTC itself does not directly administer the survey to consumers, 

consumer contact information may be provided to a contractor or subcontractor for the 

purpose of conducting a survey. In some cases, the contractor or subcontractor may (e.g., 

via online contextual advertising3 or other means) directly solicit consumers to participate 

in the survey. In other cases, contractors or subcontractors may use their own pre-existing 

panels of consumers for whom the contractors or subcontractors have already collected 

and maintained contact information and relevant demographic data. Survey responses 

reflect the view, opinions, or other information provided by consumers themselves. Certain 

documentation that may be stored in the system may come directly from the consumers 

(with redacted personal information). Survey records may reflect further annotations 

prepared by FTC staff, contractors, or subcontractors involved in administering the survey

or analyzing the consumer responses.

Surveys also allow the FTC to receive feedback and information from its law enforcement

partners.

.3 Why is the information being collected, used, disseminated, or

maintained?

As previously stated, survey information is collected, maintained and used in support of the

FTC’s regulatory and law enforcement mission, to provide useful context and insight into

views, opinions, experiences, and understanding on specific topics or matters relevant to

FTC rules, enforcement cases, education and other initiatives. Surveys also allow the FTC to

receive feedback and information from its law enforcement partners.

.4 How is the information collected?

Information collection methods may vary depending on the survey design and protocol, as

well as the particular contractor or subcontractor (if any) that is retained to conduct the

survey. Any or all of the following methods may be used to collect information during a

survey: Internet, phone, mail, in-person interviews (e.g., individual interviews, focus

groups, mall intercepts), fax, video, audio. In some cases, FTC staff may participate, either

with or without disclosure to consumers (e.g., observing a focus group through a one-way

mirror in order to prevent inhibiting or potentially skewing the discussion and/or results of

the survey).

.5 How will the information be checked for accuracy and timeliness

(currency)?
5

Generally, information used to contact survey participants is not independently verified,

since the consequences to the individual of such an error are minimal, if any. If contact

information for a specific individual is wrong, the FTC or the FTC’s contractor or

subcontractor may review its respective records to determine if there was a clerical error

made when copying the contact information (e.g., from consumer complaints or other

sources) or when contacting the consumer (e.g., mistyped e-mail address). Demographic

data are normally collected from or reported by the survey recipients (e.g., to the

contractor or subcontractor conducting the survey for the FTC), and the FTC relies on the

recipients themselves to report their data truthfully, and on its contractors or

subcontractors to collect and maintain such data accurately. Likewise, the FTC does not

check the accuracy of responses, as survey questions typically solicit personal views or

opinions. The accuracy of any analyses or compilations of survey responses and data

prepared by the FTC or for it by its contractors or subcontractors may be separately

challenged for accuracy (e.g., by public comment if used in a rulemaking, or by crossexamination or challenge in litigation). As is often the case for consumer surveys, there

are no “correct” answers; therefore, the FTC does not check these responses for accuracy.

For surveys regarding consumer experiences, the FTC and its contractors or

subcontractors rely on consumers to truthfully convey their experiences. The FTC and its

contractor or subcontractors develop questionnaires and design surveys to ensure that

consumer responses are not subject to bias or potentially result in the collection of

inaccurate data.

In certain situations, it may be possible to have controls in place to minimize inaccurate

data depending on how the survey is conducted. For example, a contractor conducting a

survey via telephone may be supervised by his/her superior or by a subject matter expert

to ensure that the call is being conducted in a fair and unbiased manner. If a survey is being

conducted in person (e.g., mall intercept), participants may be asked by to verify their

responses either in a post-survey interview or by providing their contact information for

verification at a later date and time.

.6 Is the system using technologies in ways that the FTC has not previously

employed (e.g., monitoring software, Smart Cards, etc.)? If so, how does

the use of this technology affect individuals’ privacy?

No. As noted earlier, any IT used in connection with such surveys normally involves

systems and technologies that the FTC or its contractors or subcontractors already use or

operate (e.g., Internet-based surveys, video or audio equipment). As noted elsewhere in

this PIA, the FTC applies or requires that certain administrative, technical, and physical

controls be in place in order to safeguard the privacy of consumers who may participate in

such surveys.

.7 What law or regulation permits the collection of this information?

See generally the FTC Act, 15 U.S.C. 41 et seq., which authorizes the FTC to gather

information in the public interest and for its regulatory and law enforcement mission, and

other laws and regulations enforced or administered by the FTC.

3 Online contextual advertising refers to advertisements placed based on the context of the webpage. For example, if

a user is visiting a car shopping website, they may be presented with advertisements for cars. All visitors to that

website receive the same advertisement; placement is not based on previously-collected data about the consumer.
6

.8 Considering the type of information collected and sources of collection,

what privacy risks were identified and how were these risksmitigated?

If the FTC provides contractors or subcontractors with consumer contact information, the

FTC requires that they agree to treat it as nonpublic and handle it appropriately to

safeguard against unauthorized use, loss, or disclosure. For example, the FTC requires

written nondisclosure agreements and certain technical security measures (e.g., including

encryption, where appropriate). The FTC typically also reviews survey questions to ensure

that they do not collect more personal information than needed to fulfill the FTC’s survey

needs, and that such information may not be used or shared by FTC contractors or

subcontractors for another purpose without the FTC’s explicit consent. If survey responses

are collected by Web-based methods, the FTC seeks to ensure that secure transmission

methods (e.g., HTTPS) are used (e.g., for any required user accounts or login activities) and

that any third-party tracking technologies are avoided or disabled, to avoid associating the

consumers’ responses on an FTC survey with any other online profile data.

Survey contractors, consultants, and experts are required to collect, maintain, and transmit

PII, if any, in a secure fashion. For example, online collection or transmission of sensitive PII

would normally require the use of encryption, and all data collected must be stored in a

manner to prevent unauthorized access, use, and disclosure.

Furthermore, to help ensure against possible loss or disclosure, and to avoid any

Government collection and maintenance of PII that may be collected or generated by its

surveys, FTC survey contracts normally require the redaction of all personal identifiers of

participants in any reports, analyses, or other survey contract deliverables. Thus, in most

cases, the FTC only receives aggregate or de-identified data regarding participants from its

contractors or subcontractors sufficient to conduct the required analysis. Furthermore, the

data systems used by contractors and subcontractors usually store this aggregate or deidentified data in separate databases from those that contain any PII. The FTC also typically

requires that survey records not be retained except in accordance with FTC instructions,

which will normally require their secure destruction after the survey has been administered

and analysis has been performed. In the unusual case that the survey design requires or

involves the collection or maintenance of particularly sensitive information (e.g., credit

records, financing documentation, purchase records, Social Security numbers), the FTC may

require additional safeguards (e.g., background checks for personnel handling the

information).

.9 Does the system employ the use of automated privacy controls or

enhanced capabilities to support privacy? Explain.

Each survey conducted by the FTC or contractors/subcontractors on behalf of the FTC

varies; as such, survey components and any systems or technologies associated with a

survey may differ greatly. When applicable and available, the FTC and its

contractors/subcontractors will coordinate to ensure systems used in the course of a

survey employ all practical automated privacy controls and any feasible enhanced

capabilities to protect and support privacy.
7

3 Use and Access to Data in the System

The following questions are intended to clearly describe how the information in the system

will be used, and who will use it.

.1 Describe how information in the system will or may be used.

See above sections 1, 2.3. The FTC or its contractors or subcontractors will use contact

information to solicit participation in these surveys, and will use survey responses to

generate analyses, reports, and summaries. The survey responses and other data 

delivered to the FTC by its contractors typically will not include identifying information 

about the respondents, nor will the analyses, reports, and summaries generated from 

these responses. Reports and analyses may be redacted accordingly to protect consumer

information.

.2 Which internal entities will have access to the information?

If the survey is conducted by FTC staff, access to contact information, raw survey data or

other related survey records is limited to FTC employees with a need-to-know. If the survey

is conducted by a contractor or subcontractor, access to personal information is limited to

authorized contractor and subcontractor employees who need such access in the

performance of the contract. Survey responses, analyses, and reports that are issued or

published as a result of the survey may be made accessible to the public. These final reports

or analyses do not include any personal information.

.3 Which external entities will have access to the information? If

contractors or subcontractors have access to data in the system, explain

what, if any, privacy requirements are in place to ensure that data is

properly protected.

As noted earlier, the FTC may retain contractors and/or subcontractors to conduct surveys

on the FTC’s behalf, which may require that such external entities be provided with, or

themselves collect and maintain, contact information, demographic data, survey responses,

and related survey records. In accordance with their terms of contract with the FTC, such

entities are generally prohibited from using, sharing, disclosing or retaining records that

are generated as part of an FTC survey for any other purpose. No other external entities 

will routinely have access to these survey records, except to the extent that disclosure is 

required or authorized by law (e.g., in response to a Freedom of Information Act, official

Congressional request, court discovery or other legal process).

4 Notice and Access for Individuals

The following questions are directed at how or whether the individual is notified of the

scope of information collected. They also concern the individual’s right to consent to uses of

information, right to decline to provide information, ability to ensure the accuracy of the

information collected, and right to access their information.

.1 How will individuals be informed about what information is collected,

and how this information is used and disclosed?

Participants are typically informed about the general nature and purpose of a specific
8

survey when they are contacted to solicit their participation. Participation is always 

voluntary; if individuals choose to participate, the survey form, questionnaire or other 

instrument or survey method (e.g., in-person interview) will explain, as applicable and to 

the extent possible, how their information is to be used and/or disclosed. In some cases 

the nature or purpose of a survey, including its sponsorship by the FTC, may be disclosed at 

the end of the survey, because disclosure before the survey is administered may 

inadvertently create bias in the consumers’ responses. This would affect the accuracy and 

validity of the information collected and effectively nullify the survey. In such cases, 

participants are given the opportunity to have their survey responses deleted and to 

withdraw their participation. 

Before records are maintained by the FTC or on its behalf in a system of records under the

Privacy Act of 1974, notice in accordance with that Act will be provided to survey

participants (i.e., Privacy Act statement under 5 U.S.C. 552a(e)). In other cases, the survey 

contractor or subcontractor may not collect and maintain survey records by name or other 

personally assigned identifiers. In such cases, a Privacy Act statement is not required, but

the FTC will work with the contractor or subcontractor to ensure that consumers receive 

appropriate notice of the survey’s purpose and the use or disclosure of their data.

.2 Do individuals have the opportunity and/or right to decline to provide

information?

Yes. All such surveys are completely voluntary.

.3 Do individuals have the right to consent to particular uses of the

information? If so, how would an individual exercise this right?

No, except by declining to participate in the survey.

.4 What are the procedures that allow individuals to gain access to their

own information? What is the process for receiving and responding to

complaints, concerns, or questions from individuals?

Individuals may file a request with the FTC under the Freedom of Information Act (FOIA)

and the Privacy Act of 1974 for any agency records of the survey that may be about them

and that are not exempt from disclosure to them under those laws.

4 As noted earlier,

however, the FTC typically does not receive any identifiable participant data when surveys

are conducted by a contractor or subcontractor, and thus will not ordinarily have records

for disclosure. The FTC typically does not retain or have access to any identifiable

participant data that may be collected by survey contractors and subcontractors. As

explained above, the FTC normally prohibits any such data from being disclosed, shared or

used, and typically requires that data be destroyed after the survey work and analysis are

completed in accord with the FTC’s instructions.

4 See 16 C.F.R. 4.11(a) (FTC FOIA rules), 4.13(m) (FTC Privacy Act rules).
9

.5 Discuss the privacy risks associated with the process of

providing individuals access to their own records and how those 

risks are mitigated.

Not applicable. In performing these surveys, the FTC and its contractors or subcontractors

do not maintain or operate any online or other system for providing individuals with access

to their data, even if survey responses may, in some cases, be collected by online methods.

5 Web Site Privacy Issues

Complete this section only if the new system or project creates or modifies an FTC Web site, page,

or online form accessible through the Internet.

.1 Describe any tracking technology used by the Web site and whether the

technology is persistent or temporary (e.g., session cookie, persistent

cookie, Web beacon). Currently, persistent tracking technology is not

approved for use by the FTC (see 5.2).

As noted earlier, if Web-based methods are used to collect survey responses, the FTC shall

require the use of secure data transmission methods and that any third-party tracking

technology is avoided or disabled. (There may be instances in which temporary session

cookies may be enabled for the purposes of managing the consumer’s responses, but such

cookies are normally deleted once the user closes his or her browser to end the session.)

.2 If a persistent tracking technology is used, ensure that the proper

issues are addressed.

The FTC does not permit persistent tracking technology on its websites or allow its

contractors/subcontractors to use persistent tracking technology unless previously

approved by the agency under applicable OMB policy. Any use of persistent tracking

technology, whether by FTC staff or a survey contractor, would require prior express

approval by the FTC.

.3 If personal information is collected through a Web site, page, or online

form accessible through the Internet, is appropriate encryption used?

If not, explain.

As noted earlier, if PII is collected by Web-based means, the FTC will work with its

contractor/subcontractor to ensure secure data transmission methods are in use in

accordance with FTC’s established guidelines and policies.
10

.4 Explain how the public will be notified of the Privacy Policy.

If the FTC is conducting the survey itself, the FTC’s privacy policy is posted on the FTC’s web

site, www.ftc.gov. Contractors and subcontractors that operate a Web site through which

survey responses are collected would have their own privacy policies, which are subject to

FTC review.

.5 Considering any Web site or Internet issues, please describe any

privacy risks identified and how they have beenmitigated.

See above. If web-based means are used to collect survey responses from consumers,

certain administrative, technical and physical controls will be required in order to

safeguard consumers’ privacy.

.6 If the Web site will collect personal information from children under

13, or be directed at such children, explain how it will comply with the

Children’s Online Privacy Protection Act (COPPA).

The FTC does not normally conduct surveys of children under 13. Such an FTC survey, if

any, would be required to comply with COPPA.

6 Security of Information in the System

The following questions are intended to describe technical safeguards and security measures.

.1 Are all IT security requirements and procedures required by federal

law being followed to ensure that information is appropriatelysecured?

As noted earlier, each survey conducted by the FTC or its contractors/subcontractors will

vary; as such, survey components and any systems or technologies associated with each

survey may differ greatly. The FTC and its contactors/subcontractors will coordinate to

ensure all applicable federal requirements are met and practical steps are taken to ensure

information is appropriately secured.

.2 Has an Assessment & Authorization been completed for the system or

systems supporting the program?

Any survey data collected and stored by the FTC is part of the Data Center General Support 

System (GSS), which has received an Assessment & Authorization.
11

.3 Has a risk assessment been conducted on the system?

The Office of the Chief Privacy Officer has performed a risk analysis for FTC survey 

activities. When applicable and necessary, the FTC will ensure appropriate security 

controls are identified to minimize the risk associated with conduct of these surveys and 

that such controls have been implemented.

.4 Does the project employ technology that may raise privacy concerns? If

so, please discuss its implementation.

See above, sec. 2.8.

.5 What procedures are in place to determine which users may access the

system and are they documented?

The FTC bureau or office initiating the survey determines access roles and privileges based 

on the user’s job requirement. In accordance with FTC’s established guidelines and 

practices, procedures are documented and administrative access is limited to authorized 

FTC and contractor/subcontractor personnel who require that level of access in the course 

of their job duties.

.6 Describe what privacy training is provided to users either generally or

specifically relevant to the program or system.

All FTC employees and contractors with FTC network access are required to complete

computer security training and privacy awareness training on an annual basis. The 

Federal Acquisitions Regulation (FAR) also requires privacy training for all 

contractors handling PII. 

.7 What auditing measures and technical safeguards are in place to

prevent the misuse of data?

When applicable and necessary, auditing measures and technical safeguards may be 

enacted to ensure that FTC’s contractors/subcontractors comply with all practical rules and

regulations set forth by the agency.

.8 To whom should questions regarding the security of the system be

addressed?

Any questions regarding the security of the system should be directed to the FTC’s Chief

Information Security Officer.
12

7 Data Retention

This section addresses for how long data is maintained, and how and when it is disposed of.

.1 For what period of time will data collected by this system be

maintained?

Typically, data is maintained for as long as necessary to conduct the survey and perform 

analysis of information, subject to applicable agency records disposition schedules. Any 

survey data retained by the FTC for further analysis will not normally include personal 

identifiers. 

.2 What are the plans for destruction or disposal of the information?

 See section 7.1 above.

.3 Describe any privacy risks identified in the data retention and disposal

of the information, and describe how these risks have beenmitigated.

There may be risks associated with collecting personal information and retaining that

information for lengthy periods of time. These risks are mitigated by scrubbing the data

collected of any personal identifiers and by limiting the use of data for the purpose for

which it was collected, and ensuring that it is deleted or disposed of when no longer 

necessary. 

8 Privacy Act

This section addresses the applicability of the Privacy Act of 1974 to the system, and whether or not

the system is covered by a System of Records Notice (mandated for some systems by the Privacy

Act of 1974).

.1 Will the data in the system be retrieved by a personal identifier?

Normally, no. As explained earlier, the FTC itself will receive information from its survey 

contractors in de-identified form, with no records directly identifiable by participant name 

or other personally assigned identifier. Thus, the FTC normally will not retrieve any survey 

records or data by name or other personal identifiers. In some cases, however, if the FTC

collects survey data directly from participants, or contractors collect data in identifiable 

form, the FTC or contractor may maintain and retrieve, or be able to retrieve, survey 

records or data by name or other personal identifier assigned to the individual survey 

respondent (e.g., tracking or other code number).

.2 Is the system covered by an existing Privacy Act System of Records

notice (SORN)?

Survey data are covered by an existing FTC SORN only in cases where the FTC or its 

contractor maintains and retrieves survey records or data by name or other personally 

assigned identifier.

5 If the FTC or its contractors or subcontractors use web-based
13

methods to conducts surveys, resulting in the collection of login IDs, passphrases, or

responses to challenge questions, that administrative user information would be covered 

by the FTC SORN that applies to computer user identification and access records.6 All of the 

FTC’s SORNs are available on the FTC’s public Web site, www.ftc.gov.

7

9 Privacy Policy

This section confirms that the information handling practices of the system are consistent with the

FTC’s privacy policy.

.1 Confirm that the collection, use, and disclosure of the information in

this system has been reviewed to ensure consistency with the FTC’s

privacy policy.

The collection, use, and disclosure of the information in this system has been reviewed to

ensure consistency with the FTC’s privacy policy.

5 See FTC I-1. 6 See FTC VII-3. 7 See https://www.ftc.gov/about-ftc/foia/foia-reading-rooms/privacy-act-systems.