1 

Federal Trade Commission

Privacy Impact Assessment

Tableau Public 

Completed April 2019 

Reviewed January 2023
2

The Federal Trade Commission (FTC or Commission) has prepared this Privacy Impact 

Assessment (PIA) to analyze and explain how the FTC handles personally identifiable 

information (PII) about individuals that may be available to the agency through the FTC’s use 

of Tableau Public. 

The purpose of this PIA is: (i) to ensure that the FTC’s handling of available PII conforms to 

applicable legal, regulatory, and policy requirements regarding privacy, (ii) to determine the 

risks and effects if the FTC were to collect, maintain or disseminate such information, and (iii) 

to examine and evaluate protections and alternative processes for handling such information to 

mitigate potential privacy risks. See section 208 of the E-Government Act of 2002 (E-GOV); 

Office of Management & Budget (OMB) Memoranda 03-22 (2003) & 10-23 (2010); OMB 

Circular A-130 (2017).

SECTION 1.0 – SPECIFIC PURPOSE OF THE FTC’S USE OF APPLICATION

1.1 – What is the specific purpose of the agency’s use of the application, and how does

that use fit with the agency’s broader mission?

Tableau Public is a free service managed by a third party (Tableau Software) that the FTC uses

to publish interactive data visualizations on the internet. On a reoccurring basis, the FTC makes 

available to the public data from the Consumer Sentinel Network Data Book, which contains 

aggregate information about what consumers report to the FTC on an annual basis, such as fraud, 

identity theft, and other consumer protection topics.

1 The Consumer Sentinel Data Book is 

based on reports filed by consumers and does not include information from any consumer 

surveys conducted by the FTC. No personally identifiable information is included in the 

Consumer Sentinel Data Book. Reports older than five years are purged biannually. 

The Consumer Sentinel data that the FTC will include in its Tableau Public dashboards is similar 

to the data that it has traditionally included in the annual data book. The FTC will make 

interactive data dashboards, charts, and maps compiled from aggregated Consumer Sentinel 

Network data available online via Tableau Public on a quarterly basis. The interactive interface 

features maps that allow users to click on and identify statistics for each state, including statistics 

for Metropolitan Statistical Areas greater than 100,000 people in population size.2 The data also 

includes median and aggregate losses reported for all fraud categories, as well as identify theft 

statistics. 

Making this information available via Tableau Public aligns with the agency’s broader mission 

by providing current data on fraud and other complaints reported to FTC by consumers. Users 

of this information are expected to be consumers, members of the media, law enforcement, 

community organizations, Congressional offices, researchers, and others interested in 

identifying and studying consumer protection issues on local, state-by-state and nation-wide 

 

1 The FTC compiles reports received from consumers about problems they experience in the marketplace. Such 

reports are stored in the Consumer Sentinel Network (Sentinel), a secure online database available only to law 

enforcement. For more information about the Consumer Sentinel Network, refer to the Sentinel Network Services 

PIA. 2 The exception to this Metropolitan Statistical Area (MSA) size is for data originating from the state of Wyoming, 

which may include information from MSAs of 88,000 in population size. 
3

basis. FTC staff uses these interactive dashboards to study trends and conduct consumer 

education and outreach. 

1.2 – Is the agency’s use of the application consistent with all applicable laws,

regulations, and polices?

The January 21, 2009 Presidential memorandum on Transparency and Open Government and the 

OMB Director’s December 8, 2009 Open Government Directive call on federal departments and 

agencies to harness new technologies to engage with the public. Using tools like Tableau Public 

helps the FTC to make self-reported consumer data available in aggregate form, which in turn 

helps the FTC meet the federal guidance outlined in the directive and memorandum, including the 

goals of transparency, participation and collaboration. 

SECTION 2.0 – IS THERE ANY PII THAT IS LIKELY TO BECOME AVAILABLE TO

THE AGENCY THROUGH THE USE OF THE APPLICATION?

2.1 – What PII will be made available to the FTC?

The FTC does not have access to any PII that is not already publicly available for all Tableau public 

account holders. Users have the option of “following” the FTC official Tableau Public account. 

Followers are alerted or receive notifications from Tableau Public when the FTC publishes new 

content or updates its page. The FTC has access to publicly available data that Tableau Public 

account holders have provided on the platform. These “followers” of the FTC may include the 

following information in their public accounts: User name, organization or affiliation, location 

(city, state), website, links to the individual’s social media accounts (e.g., Twitter, Facebook, etc.), 

a picture or icon representation, and a section titled “More About Me,” which may include 

additional narrative information about the user. 

The FTC can also see aggregate “views” a particular visualization receives from users on Tableau 

Public. If a user follows the FTC official Tableau Public account then the FTC can also see other 

pages or users the individual follows. 

Furthermore, users who visit the FTC Tableau Public webpage are not required to have a Tableau 

Public account. An individual is not required to make their PII public or let the FTC have access 

to this data for the purposes of viewing the FTC’s data on Tableau. Even where a user has a 

Tableau Public account, the user may choose to use an alias or only provide a first name as their 

user name. They may opt to exclude any additional information in their public profile other than 

their user name. 

In any event, even where user PII is available to the FTC through its use of Tableau Public as 

described above, the FTC does not routinely collect or maintain such PII. In specific 

circumstances, the FTC may collect limited information (e.g. usernames or handles) about 

members of the public (e.g., if messages or posts directed to the FTC or its employees on Tableau 

are deemed as threatening or violent, or where the content may reveal some other potential law 

enforcement violation). The FTC may also occasionally produce reports or summaries of its use of 

this social media platform that include PII posted publicly (i.e., usernames): for instance, it may do 

so if needed to comply with social media records retention guidelines from the National Archives 
4

and Records Administration (NARA). In such instances, the collection of PII in these summaries 

will be reduced as much as is feasible. 

 

2.2 – What are the sources of PII?

Individual users of Tableau Public are the source of any PII available to the agency on the Tableau 

Public platform. If a user voluntarily chooses to set up a user account on Tableau Public, users

must register with a name, email address, and password. Tableau Public does not share users’ 

email addresses or make them publicly available. 3 As mentioned in 2.1, the FTC does not have 

access to any user information that the individual provides to Tableau Public unless that 

information is publicly available on that user’s profile.

 

2.3 – Do the FTC’s activities trigger the Paperwork Reduction Act (PRA) and, if so, how

will the agency comply with the statute?

Per the OMB memorandum, Social Media, Web-Based Interactive Technologies, and the 

Paperwork Reduction Act, the FTC’s use of Tableau Public as outlined in Section 1.1 is not a webbased interactive technology that would trigger the PRA. Under the PRA, the FTC’s use of 

Tableau Public is not an information collection activity. 

SECTION 3.0 THE FTC’S INTENDED OR EXPECTED USE OF PII

Section 3.1 – Generally, how will the agency use the PII described in Section 2.0?

As mentioned in 2.1 above, the FTC does not routinely collect or maintain PII from users of the 

Tableau Public platform. While the FTC can view the profile and PII elements that a “follower” of 

the FTC’s page chooses to make publicly available, the agency does not require followers to 

provide their PII nor does the FTC routinely collect any such data from users. Use of Tableau 

Public is free to the FTC and to members of the public, and individuals have the ability to “follow”

the FTC’s official page. The purpose of the FTC’s use of Tableau Public is to disseminate statistical 

data to the public, not to provide the FTC with PII about individuals. The FTC may incidentally view 

the PII made available to it, or may review its list of followers to improve services accordingly, but in 

general, the FTC does not intend to use such PII. See also the exceptions noted in in 2.1 above. 

 

Section 3.2 – Provide specific examples of the types of uses to which the PII may be subject.

Not applicable. As noted above, the FTC will not collect, maintain, or use any PII made available

to the agency through its use of Tableau Public, except as noted in 2.1 and 3.1 above. 

 

3 Tableau Public’s user agreements and privacy policies are available at 

https://www.tableau.com/legal.
5

SECTION 4.0 SHARING OR DISCLOSING OF PII

Section 4.1 – With what entities or persons inside or outside the agency will the PII be

shared, and for what purposes will the PII be disclosed?

All data made publicly available by individuals on Tableau Public is openly accessible to anyone 

who visits the FTC’s Tableau Public Site. The FTC cannot opt to remove followers or disable the 

“follow” feature. As such, anyone who voluntarily follows the FTC’s Tableau Public account has 

his or her Tableau Public user profile data available. That said, the FTC does not collect, maintain, 

nor share this data with anyone, except as noted in 2.1 above. 

Section 4.2 – What safeguards are in place to prevent expansion of use beyond those

authorized under law and described in this PIA?

Only approved FTC staff members have access to manage the FTC’s Tableau Public page. Each 

staff member responsible for managing a social media account must sign and comply with the 

agency’s internal Rules of Behavior. The FTC’s Tableau Public account is registered using 

official FTC email accounts. The FTC does not collect, maintain or disseminate data made 

available to the agency through its use of Tableau Public, except as noted in 2.1 above. The FTC 

provides a disclaimer in the “More About Me” section of the official FTC Tableau Public 

account, which details that the FTC does not collect, maintain, use, or share PII from the site and 

that the FTC’s privacy policy does not apply to the Tableau Public website. In addition, when 

visitors to www.ftc.gov click on the link to go to the Tableau Public website, there is an 

interstitial page that warns users that they are leaving the FTC’s website and being directed to an 

external third-party site. 

SECTION 5.0 - MAINTENANCE AND RETENTION OF PII

Section 5.1 – How will the FTC maintain the PII, and for how long? 

The FTC will have access to publicly available user profile data for as long as the FTC’s official 

Tableau Public page remains open and active, or for as long as individual users opt to follow the 

official FTC Tableau Public Account. However, as explained above, the FTC does not collect or 

maintain any PII made available to the agency through its use of Tableau Public, except as noted in 

2.1 above. 

 

 

Section 5.2 – Was the retention period established to minimize privacy risk?

Per the FTC’s own privacy policy, the FTC does not collect any information (including PII) that is 

unnecessary, in order to minimize privacy risk and reduce the amount of information that must be 

maintained. The FTC does not collect, store, or disseminate user data from the Tableau Public 

platform, except as noted in 2.1 above. In the limited instances in which the FTC does so (see 2.1 

above), any PII collected will be retained and disposed of in accordance with NARA’s General 

Records Schedule (GRS) 6.4, item 020, Public Comments and Communications Not Requiring 

Formal Action, or other records schedules that may apply.
6

SECTION 6.0 – HOW THE AGENCY WILL SECURE PII

Section 6.1 – Will the FTC’s privacy and security officials coordinate to develop methods of

securing PII?

Not applicable, because the FTC does not collect, maintain, or disseminate PII from the Tableau 

Public website, except as noted in 2.1 above. Regarding the limited instances in which the FTC 

does so (see 2.1 above), privacy and security officials routinely coordinate to develop methods to 

secure all agency PII. See also Sections 2.0 and 5.0.

 

SECTION 7.0 – IDENTIFICATION AND MITIGATION OF OTHER PRIVACY RISKS

Section 7.1 – What other privacy risks exist, and how will the agency mitigate those risks?

The privacy risks associated with the FTC’s use of Tableau Public are limited, if any, because the 

agency does not collect, maintain, or disseminate PII made available to it on the platform, except as 

noted in 2.1 above. As noted earlier, only authorized FTC staff members have access to manage 

the FTC’s Tableau Public page. The FTC’s Tableau Public account is registered using official 

FTC email accounts, and the FTC limits access to its administrative Tableau accounts to prevent 

the unauthorized collection of PII through these accounts. In the “More About Me” section of the 

FTC’s Tableau Public profile, a disclaimer is made to all users explaining that Tableau Public is a 

third party site; although the FTC does not routinely maintain, use, or share any identifiable 

information from Tableau Public, Tableau and or its partners may collect user data and use tracking 

technology. There is also a link to the FTC’s privacy policy. 

SECTION 8.0 – CREATION OR MODIFICATION OF A SYSTEM OF RECORDS

Section 8.1 – Will the FTC’s activities create or modify a “system of records” under the

Privacy Act of 1974? 

No, in general, the FTC does not collect or maintain agency records about individuals by 

assigned identifier or otherwise through its use of its Tableau Public account. Thus, the agency is 

not creating, nor does it need to modify, any system of records under the Privacy Act of 1974.