UNITED STATES OF AMERICA

Federal Trade Commission

WASHINGTON, D.C. 20580

Office of Commissioner

Alvaro M. Bedoya

Prepared Remarks of Commissioner Alvaro M. Bedoya

Federal Trade Commission 

The National Advertising Division Annual Conference (NAD2022)

1

September 20, 2022

Thank you for that kind introduction, and thank you for the ability to join you remotely. I 

believe you’ve already heard from two of our best, Bureau of Consumer Protection Director Sam 

Levine, and Assistant Director Serena Viswanathan. Given that, I’d like to take a few minutes 

and focus on a subject that I’m sure is on the minds of many people there today — our advanced 

notice of proposed rulemaking on commercial surveillance (“ANPR”).

2

Our nation is the world’s unquestioned leader on technology and the data economy. And 

yet we are almost alone in our lack of meaningful protections for this infrastructure. We lack a 

modern data security law. We lack a baseline consumer privacy rule. We lack civil rights 

protections suitable for the digital age. In light of those gaps, I think this rulemaking has the 

potential to be one of the most significant regulatory initiatives the Commission undertakes in 

the coming years.3

Many of you know that my professional focus has been on privacy. I had the fortune to 

have not learned about privacy in law school. I learned about it on the job, first in the U.S. 

Senate, and then at Georgetown University Law Center, where I ran the Center on Privacy & 

Technology. For most of that time, I co-taught a course with MIT, where we paired law students 

and budding engineers and tasked those teams to draft privacy laws.

For me, the combination of these experiences was the world’s best education on privacy. 

Because I came into these experiences with the same preconceptions about privacy as anyone 

else. But I was then able to quickly see how those preconceptions lined up with reality, with 

history, and with advancing technology. 

I raise all of this because I want to speak to two of the criticisms of the ANPR: First, that 

it reflects a dark view of our modern economy. Second, that it is too broad. In my view, these 

two criticisms line up pretty neatly with two preconceptions I myself had about privacy before I 

began working in this field. The first is the idea that privacy is a luxury. The second is the idea 

1 The views expressed here are my own and do not necessarily represent the views of the Federal Trade Commission 

or any Commissioner. 

2 Commercial Surveillance Advanced Notice of Proposed Rulemaking, 87 Fed. Reg. 51273 (Aug. 22. 2022),

https://www.federalregister.gov/documents/2022/08/22/2022-17752/trade-regulation-rule-on-commercialsurveillance-and-data-security.

3 See generally Statement of Commissioner Alvaro M. Bedoya Regarding the Commercial Surveillance Data 

Security Advance Notice of Proposed Rulemaking (Aug. 11, 2022), https://www.ftc.gov/legal-library/browse/casesproceedings/public-statements/statement-commissioner-bedoya-regarding-commercial-surveillance-data-securityadvance-notice.
2

that privacy is fundamentally about data collection, specifically, taking data from people without 

their consent. 

I’d like to speak about each of these ideas. Then, as time allows, I’ll highlight a few of 

my own priorities for the ANPR and the FTC’s privacy work more generally. And then I’d love 

to take some questions. 

* * *

Let’s talk about that first idea, the idea that privacy is a luxury. 

This idea arguably dates back to the earliest days of modern commercial privacy in the 

United States. Justice Louis Brandeis co-wrote the seminal law review article that first

crystalized that concept in the American legal system.4 He famously described the concept of 

privacy like this in Olmstead v. United States: 

The makers of our Constitution undertook to secure conditions favorable to the pursuit of 

happiness. They recognized the significance of man’s spiritual nature, of his feelings, and 

of his intellect... They conferred, as against the Government, the right to be let alone—

the most comprehensive of rights and the right most valued by civilized men.5

This is an extraordinary, eloquent statement. It is a true statement. But at the same time, 

you cannot hear it, particularly that last phrase — “the right most valued by civilized men” —

and not come away from it with the impression that privacy is a beautiful idea, a lofty concept 

cherished by the comfortable and influential.

It doesn’t help, of course, that Justice Brandeis’s 1890 article was in large part driven by 

the advent of instant cameras that allowed secret photographs of Boston Brahmin weddings.6It 

also doesn’t help that many of our privacy laws were inspired by invasions of famous people’s 

privacy. 

The most famous example of this is our nation’s video privacy law, which we owe to the 

fact that during Judge Robert Bork’s confirmation hearings, a journalist visited the Bork family’s 

video store, got a list of all of their recent rentals, and wrote an article about it. The Bork 

family’s viewing habits were quite boring, but the senators were horrified and passed a law to 

prevent that kind of thing in the future.7

If you pan out to a broader view of our history, however, I think that tells a very different 

story. A story in which spiritual and intellectual privacy are important, yes — but also a story 

4 Samuel D. Warren & Louis D. Brandeis, Right to Privacy, 4 HARV. L. REV. 193 (1890-1891).

5 Olmstead v. United States, 277 U.S. 438 (1928) (Brandeis, J., dissenting).

6 Warren & Brandeis, supra note 1 at 195 (noting how “[i]nstantaneous photographs and newspaper enterprise have 

invaded the sacred precincts of private and domestic life; and numerous mechanical devices threaten to make good 

the prediction that ‘what is whispered in the closet shall be proclaimed from the house-tops’”). 

7 Andrea Peterson, How Washington’s last remaining video rental store changed the course of privacy law, WASH.

POST: THE SWITCH (Apr. 28, 2014), https://www.washingtonpost.com/news/the-switch/wp/2014/04/28/howwashingtons-last-remaining-video-rental-store-changed-the-course-of-privacy-law/; see also Stephen Advokat, 

Publication of Bork’s Video Rentals Raises Privacy Issue, CHI. TRIB. (Nov. 20, 1987), 

https://www.chicagotribune.com/news/ct-xpm-1987-11-20-8703270590-story.html.
3

where privacy is and has always been a matter of safety — physical safety, job safety, a matter of 

basic human fairness.

Our history is rife with these examples: Consider the Pilgrims, who described being 

“hunted and persecuted,” “their houses beset and watched night and day.”8 Consider Harriet 

Tubman, who, in the words of Frederick Douglass, was only able to do her work because of her 

ability to evade detection.9 Consider Marcus Garvey and Martin Luther King Jr., who were 

surveilled by the FBI.10 Or consider the countless gay men and women in the 20th century who 

will tell you stories about how the only way they could keep their jobs was by working very hard 

to keep their private lives private. 

Throughout American history, privacy has not been a luxury, it has been a necessity. A 

basic, vital, necessity.

This pattern continues today. Women across the country are looking at their phones and 

struggling to figure out if that device (or the software on it) might threaten their reproductive 

rights. Too many people continue to be stalked through the use of stalking apps. Too many 

parents are struggling to understand the mental health impacts of social media on their children’s 

mental health. And too many working people are submitting their most vital information online 

for jobs, or mortgages, or a new apartment — and walking away from that with the unshakable 

feeling that these systems will not treat them fairly. 

So there are some who say that the ANPR reflects a dark view of our modern economy 

— that it is too focused on what can go wrong. I think it reflects the seriousness of what’s at 

stake — the fact that real people are experiencing real harm from the way our personal 

information is gathered, kept, and processed. 

* * *

That brings me to the second preconception that I’d like to challenge, the idea that 

privacy is about non-consensual data collection — about taking data from people. I recognize 

that I’m oversimplifying, but I do think that this is partly what’s behind the idea that the ANPR 

is too broad. 

Here, again, I think history is instructive.

I mentioned that in 1890, Louis Brandeis co-wrote the seminal article that first crystalized 

what we would consider the right to commercial privacy. And a lot of people remember that 

story about Boston Brahmins being aghast at wedding paparazzi. Of course, that’s a story about 

data collection, specifically non-consensual data collection.

8 See William Bradford, OF PLIMOTH PLANTATION 14 (1630-1650), https://www.gutenberg.org/files/24950/24950-

h/24950-h.htm (“But after these things they could not long continue in any peaceable condition, but were hunted & 

persecuted on every side, so as their former afflictions were but as flea-bitings in comparison of these which now 

came upon them. For some were taken & clapt up in prison, others had their houses besett & watcht night and day, 

& hardly escaped their hands.”). 

9 See Letter from Frederick Douglass to Harriet Tubman (Aug. 29, 1868), in Preface to Sarah Hopkins Bradford,

SCENES IN THE LIFE OF HARRIET TUBMAN 7 (1869).

10 See generally Justin Hansford, Jailing a Rainbow: The Marcus Garvey Case, 1 GEO. J. L. & MOD. CRITICAL 

RACE PERSP. 325, 345-366 (2009).
4

But Justice Brandeis also described a case in which a woman hired a photographer to take 

her portrait. She then discovered walking down the street one day that the photographer had 

taken her photo and turned it into a Christmas card, for sale in a storefront window. She sued to 

get him to stop that. And she won.11

Why do I share this story? Because it shows that from the very beginning of American 

legal thinking about privacy, privacy hasn’t been a simple question of data collection, it has also 

been a question of data use, secondary use, and commercialization. 

In fact, I would argue that this broader conception of the right to privacy is at the heart of 

what we as a country have contributed to the legal understanding of privacy around the world.12

In 1973, the federal government convened the country’s leading minds to think about 

what rules should apply to government-run information systems. The committee compiled a 

comprehensive set of recommendations called the Code of Fair Information Practices, or “the 

Fair Information Practice Principles,” which are also called “the FIPPs.”13

Soon after that, in 1980, the Organization for Economic Co-operation and Development 

(“OECD”) took the FIPPs and endorsed them as the right framework for government and

commercial.

14 Many of them are codified in laws like the Fair Credit Reporting Act, the 

Children’s Online Privacy Protection Act, the Gramm-Leach-Bliley Act, and other American 

privacy statutes.15 

And if you read what the FIPPs say, you’ll immediately see that they go well beyond the 

question of data collection. They require that information only be used for the reasons for which 

it was collected. They require that information be secured. And they require the prevention of 

downstream misuse. 

But here’s the thing, they also — unsurprisingly — get into the question of fair 

processing and fairness in decision-making. The FIPPs require that people have access to the 

data that describes them, and have the ability to correct it for errors. Why? “[T]o assure accuracy 

11 See Warren & Brandeis supra note 1 at 208-210, n. 1; Charles Simon, Torts-Invasion of Privacy-Unauthorized 

Use of Photograph, 16 DEPAUL L. REV. 255, 257, 

https://via.library.depaul.edu/cgi/viewcontent.cgi?article=3192&context=law-review.

12 I am indebted to Cheryl Saniuk-Heinig for her helpful essay on the FIPPs. Cheryl Saniuk-Heinig, 50 years and 

still kicking: An examination of FIPPs in modern regulation, IAPP:PRIVACY ADVISOR (May 25, 2021), 

https://iapp.org/news/a/50-years-and-still-kicking-an-examination-of-fipps-in-modern-regulation/.

13 Dep’t of Health & Human Serv., Office of Assistant Sec’y for Planning and Eval., RECORDS, COMPUTERS AND 

THE RIGHTS OF CITIZENS (1973), https://aspe.hhs.gov/reports/records-computers-rights-citizens.

14 Org. for Econ. Cooperation and Development (OECD), GUIDELINES ON THE PROTECTION OF PRIVACY AND 

TRANSBORDER FLOWS OF PERSONAL DATA (1980), 

https://www.oecd.org/sti/ieconomy/oecdguidelinesontheprotectionofprivacyandtransborderflowsofpersonaldata.htm

(“These Guidelines apply to personal data, whether in the public or private sectors, which, because of the manner in 

which they are processed, or because of their nature or the context in which they are used, pose a danger to privacy 

and individual liberties.”).

15 The GDPR, for example, codified the FIPPs in Article 5. See Council Regulation 2016/679 of Apr. 27, 2016, 

General Data Protection Regulation, 2016 O.J. (L 119) at Art. 5, http://data.europa.eu/eli/reg/2016/679/2016-05-04.
5

and fairness in any determination relating to an individual’s qualifications, character, rights, 

opportunities, or benefits, that may be made on the basis of such data.”16

In other words, for fifty years, it has been American policy that the use of our data is just 

as important as its collection. And that we need to ensure that this data is processed accurately 

and fairly. 

And so when people allege that the remote proctoring software for their professional 

licensing exam does not recognize their faces because they are black; when people allege that 

their data are being used to manipulate them into staying online far longer than they intend to be; 

when people allege that their information on social media is being used to target them — or 

avoid targeting them — for housing ads in a way that is discriminatory... none of these are 

harms relating to data collection; but all of these are harms that I think are rightfully 

encompassed in a commercial surveillance ANPR. 

There’s a famous saying about the Fourth Amendment, that it protects people, not 

places.17 I think that privacy protects people, not data. And as the FTC considers rules to rein in 

prevalent unfair and deceptive trade practices, we would be remiss, in light of this longstanding 

policy, and long history, not to ask questions about all harms from unfair and deceptive practices 

online. 

* * *

In closing, because I know we have in the room counsel for some of the country’s most 

prominent companies, I’d appreciate the moment to highlight a few areas that are personal 

priorities for me both in the ANPR and in the Commission’s work in general.

First is the question of algorithmic fairness. It used to be that only a narrow slice of your 

life was regulated by machine learning-driven algorithms. Now, increasingly, these black box 

systems are making decisions about hiring, health care, housing, and any number of critical areas 

of our lives.18

Some say that our unfairness authority does not reach discrimination; Section 5 of the 

FTC Act does not mention discrimination, they say.

16 See RECORDS, COMPUTERS AND THE RIGHTS OF CITIZENS (1973), supra note 13, at “Recommendations: 

Safeguards Requirements for Administrative Personal Data Systems,” (1)(B)(7).

17 Katz v. United States, 389 U.S. 347, *351 (1967).

18 See Ziad Obermeyer, et al., Dissecting racial bias in an algorithm used to manage the health of populations, 366 

SCIENCE 447 (Oct. 25, 2019), https://science.sciencemag.org/content/366/6464/447; Eliane Röösli, Brian Rice, & 

Tina Hernandez-Boussard, Bias at warp speed: how AI may contribute to the disparities gap in the time of COVID19, 28 J. OF AM. MED. INFORMATICS ASS’N 190 (January 2021), https://doi.org/10.1093/jamia/ocaa210; HUD v. 

Facebook, FHEO No. 01-18-0323-8, at https://www.hud.gov/sites/dfiles/Main/documents/HUD_v_Facebook.pdf; 

Nicol Turner Lee & Samantha Lai, Why New York City Is Cracking Down on AI hiring, BROOKINGS: TECHTANK

(Dec. 20, 2021), https://www.brookings.edu/blog/techtank/2021/12/20/why-new-york-city-is-cracking-down-on-aiin-hiring/; see also Elisa Jillson, Aiming for truth, fairness, and equity in your company’s use of AI, FTC: BUSINESS 

BLOG (Apr. 19, 2021), https://www.ftc.gov/business-guidance/blog/2021/04/aiming-truth-fairness-equity-yourcompanys-use-ai.
6

I say to them that, if you read Section 5, it also says nothing about privacy or data 

security. That’s because Congress did not define Section 5 on the basis of subject matter. Rather,

Congress defined unfairness to block any conduct that substantially injures consumers, that is not 

reasonably avoidable, and that is not offset by a countervailing benefit.19 I emphatically agree 

with my colleagues Chair Khan and Commissioner Slaughter that discrimination could 

absolutely be the basis for Section 5 unfairness claim.20 

Second, I am keenly interested in learning more about the potential mental health harms 

to children and teenagers stemming from prolonged use of social media, and potential solutions. 

There is now a broad body of research arguing that prolonged daily use of social media is 

associated with increases in depression, anxiety, thoughts of self-harm, and suicidal ideation.21

As I have explained elsewhere, this is a nuanced body of research; it is not the case that social 

media always hurts the average teenage user.22

However, the presence of that nuance only makes it more important that we as an expert 

agency collect comments on this issue and get a clear sense of what exactly is going on, 

particularly if children and teenagers’ data is being used to customize their experience in a way 

that encourages them to stay on social media longer than they themselves want. As one step in 

that direction, I’m pleased to report that it is now part of the FTC’s five-year strategic plan to 

19 See 15 U.S.C. 45(n) (“The Commission shall have no authority under this Section or Section 57a of this title to 

declare unlawful an act or practice on the grounds that such act or practice is unfair unless the act or practice causes 

or is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers themselves and 

not outweighed by countervailing benefits to consumers or to competition.”).

20 See Statement of Chair Lina M. Khan Joined by Commissioner Rebecca Kelly Slaughter, Matter of Napleton 

Automotive Group (Mar. 31, 2022), 

https://www.ftc.gov/system/files/ftc_gov/pdf/Statement%20of%20Chair%20Lina%20M.%20Khan%20Joined%20b 

y%20RKS%20in%20re%20Napleton_Finalized.pdf (“[W]e take this as an opportunity to offer how the Commission 

should evaluate under its unfairness authority any discrimination that is found to be based on disparate treatment or 

have a disparate impact.”); Rebecca Kelly Slaughter, Algorithms and Economic Justice: A Taxonomy of Harms and 

a Path Forward for the Federal Trade Commission (Aug. 2021), https://law.yale.edu/sites/default/files/ 

area/center/isp/documents/algorithms_and_economic_justice_master_final.pdf.

21 Jean M. Twenge et al., Increases in Depressive Symptoms, Suicide-Related Outcomes, and Suicide Rates Among 

U.S. Adolescents After 2010 and Links to Increased New Media Screen Time, 6 CLIN.PSYCH.SCI. 1, 3, 10 (Jan. 

2018), https://doi.org/10.1177/2167702617723376; Hugues Sampasa-Kanyiga & Rosamund Lewis, Frequent use of 

social networking sites is associated with poor psychological functioning among children and adolescents, 18(7) 

CYBERPSYCHOLOGY, BEHAV., & SOC. NETWORKING 380 (Jul. 2015), 

https://www.researchgate.net/publication/280059931_Frequent_Use_of_Social_Networking_Sites_Is_Associated_w 

ith_Poor_Psychological_Functioning_Among_Children_and_Adolescents; Yvonne Kelly et al., Social Media Use 

and Adolescent Mental Health: Findings from the UK Millennium Cohort Study, 6 ECLINICAL MEDICINE 59, 59 

(2018), https://www.thelancet.com/action/showPdf?pii=S2589- 5370%2818%2930060-9.

22 Alvaro M. Bedoya, Remarks of Commissioner Alvaro M. Bedoya at the National Association of Attorneys General 

Presidential Summit (Aug. 9, 2022), https://www.ftc.gov/news-events/news/speeches/remarks-commissioneralvarom-bedoya-national-association-attorneys-general-presidential-summit; see also Amy Orban & Andrew K. 

Przybylski, The association between adolescent well-being and digital technology use, 3 NATURE HUM. BEHAV. 173 

(Feb. 2019), https://www.nature.com/articles/s41562-018-0506-1; Noah Kreski et al., Social Media Use and 

Depressive Symptoms Among United States Adolescents, 68 J. ADOLESCENT HEALTH 572 (2021), 

https://www.jahonline.org/action/showPdf?pii=S1054-139X%2820%2930403-1; Michaeline Jensen et al., Young 

Adolescents’ Digital Technology Use and Mental Health Symptoms: Little Evidence of Longitudinal or Daily 

Linkages, 7(6) CLIN.PSYC.SCI. 1416 (2021), https://journals.sagepub.com/doi/10.1177/2167702619859336.
7

explore the hiring of child psychologists and youth development experts, an idea first proposed 

by the House Republicans.23 I emphatically support it. 

Third is the need to ensure that we are identifying and stopping fraud and other abusive 

data practices online regardless of the language in which it is conducted. There is no language 

exception to law enforcement. It is our responsibility as the nation’s leading consumer protection 

agency to find and stop fraud regardless of the language in which it is conducted; unfortunately, 

our ability to do that is not where it should be. I’d like to hear more about how new rules might 

encourage more effective enforcement by both the Commission and private firms against scams 

and fraud. 

I am also pleased to report that from now on, the Commission will be tracking the 

language of the underlying illegal conduct that it is working to stop; this way, we will be able to 

track our success at stopping fraud in all languages. It is also now explicitly part of the 

Commission’s strategic plan to work to stop fraud in all languages, including Native American 

languages.24

As we improve our own capacity to stop fraud in all languages, I will also be asking tech 

companies, particularly social media platforms, hard questions about what their internal 

capacities are to identify and take down frauds in languages other than English. I have been 

disappointed in many companies’ responses to congressional oversight on this issue.25 It is clear 

to me that they, like the FTC, need to do more to stop all fraud online. 

Lastly, I am keenly interested in protecting Americans’ geolocation. This is work I began over a 

decade ago with a bill I worked on to shut down stalking apps. Unfortunately, today geolocation 

remains woefully unprotected – even though it is a portal to the most sensitive aspects of our 

lives. You may not tell even your closest friends and family that you are visiting an addiction 

treatment center, or a cancer treatment center, or a family lawyer. Your geolocation can reveal all 

of that. 

The Commission has said for over a decade that this sensitive information needs to be 

closely guarded.26 I hope it is clear from the Commission’s recent actions that we will do 

everything in our power to protect it with our existing tools. I’d also welcome proposals for how 

new rules may address and prevent abuse and harmful invasions of location privacy and provide 

better protections in the future.

23 Federal Trade Commission, STRATEGIC PLAN FOR FISCAL YEARS 2022-2026 (2022) (“FTC Strategic Plan”) at 24, 

https://www.ftc.gov/system/files/ftc_gov/pdf/fy-2022-2026-ftc-strategic-plan.pdf; Control Our Data Act, H.R. __ 

[Discussion Draft], 117th Cong. § 114(b)(2)(D) (2021),

https://republicans-energycommerce.house.gov/wp-content/uploads/2021/11/2021.11.02-Republican-CODA-Draft-

.pdf.

24 FTC Strategic Plan supra note 23 at 12. 

25 See Office of Senator Ben Ray Luján, Luján, Klobuchar, Cárdenas Lead Colleagues Urging Tech CEOs to 

Combat Spanish-Language Disinformation (2021), https://www.lujan.senate.gov/newsroom/pressreleases/lujanklobuchar-cardenas-lead-colleagues-urging-tech-ceos-to-combat-spanish-language-disinformation/; Facebook, 

Letter: Facebook’s Response to Senator Luján (Aug. 26, 2021), https://www.lujan.senate.gov/wpcontent/uploads/2021/09/Facebook-Response-Lujan.pdf; Access Now et al., The Santa Clara Principles On 

Transparency and Accountability in Content (2021), https://santaclaraprinciples.com.

26 FTC Final Report, Protecting Consumer Privacy in an Era of Rapid Change at 47 and n214 (2012), 

https://www.ftc.gov/sites/default/files/documents/reports/federal-trade-commission-report-protectingconsumerprivacy-era-rapid-change-recommendations/120326privacyreport.pdf.
8

I urge each of you to take the time to comment on the FTC’s commercial surveillance 

ANPR. We need your input. We will read it carefully and with interest.

Thank you for your time and attention. I’d be glad to answer your questions.