The FTC’s Role in Consumer 

Privacy & Data Security

May 21, 2013 

Jonathan E. Zimmerman 

Federal Trade Commission 

The views expressed are 

those of the speaker and not 

necessarily those of the FTC. 
2 

Overview 

 FTC Background Information 

 Enforcement 

– Recent Case Highlights 

 Policy 

– Workshops 

– Reports 

 Consumer and Business Education 
3 

FTC Background Information 

 FTC is an independent law enforcement agency 

– Five Commissioners appointed by President 

 Consumer protection and competition mandate 

 Section 5 of the FTC Act 

– Broad authority to prohibit deceptive or unfair acts or practices 

 Deceptive practices are representations, omissions, or practices that: 

– Are likely to mislead consumers acting reasonably under the circumstances 

– Representation, omission, or practice must be material 

 Unfair practices are those that: 

– Cause or are likely to cause substantial injury 

– Are not outweighed by the benefits, and 

– Are not reasonably avoidable by the consumer 

 In addition to Section 5, enforce several sector-specific privacy laws (e.g., Fair 

Credit Reporting Act, Children’s Online Privacy Protection Act) 
4 

FTC’s Approach to Privacy 

 The standard the FTC has devised is that companies must: 

– maintain reasonable procedures to protect sensitive consumer information, and 

– must live up to any promises they make to consumers regarding the privacy or 

security of their information. 

 Companies should think about: 

– The nature of the information they collect from consumers 

– Why they are collecting that information 

– How they are using, storing, and disposing of, that information 

– What they are disclosing to consumers about these practices 
5 

FTC’s Approach to Data Security 

 In Data Security Cases the FTC Recognizes: 

– Information security is an ongoing process 

– A company’s security procedures must be reasonable and appropriate in light of the 

circumstances 

 Did the company have effective security measures in place to protect personal information? 

 If not, could the information have been protected at a reasonable cost? 

 Were the security vulnerabilities at issue well-known within the information technology 

industry? 

 Were simple, readily-available low cost measures available to prevent them?

– A breach does not necessarily show that a company failed to have reasonable 

security measures – there is no such thing as perfect security 

– A company’s practices may be unreasonable and subject to FTC enforcement even 

without a known security breach 
6 

FTC Enforcement 

 More than 100 privacy/data-security related actions since 2001, including: 

► 40+ Data Security Cases 

► 100+ SPAM and spyware cases 

► 20 COPPA cases 

► Several FCRA cases 
7 

FTC Enforcement: 

Privacy and Data Security 
8 

Recent Privacy 

Enforcement Highlights 

 Mobile 

– Path 

 Alleged conduct: Deceived users by collecting personal 

information from their mobile device address books without their 

knowledge and consent 

 COPPA violation: Even if you don’t consider yourself a childdirected site, make sure you have age-gate mechanisms in 

place or that you have parental consent 

 Order Provisions: Ban on misrepresentations, establish 

comprehensive privacy program, and $800,000 COPPA civil 

penalty 

 Social Media 

– MySpace 

 Alleged conduct: Sharing user’s personal information with thirdparty advertisers contrary to statements in the company’s 

privacy policy 

 Order provisions: Bar on misrepresentations and audit 

requirements similar to Facebook and Google 
9 

Recent Data Security 

Enforcement Highlights 

 HTC, America (2013) 

– First software security case 

– Focused on HTC’s lack of a software security program as evidenced 

by security flaws HTC introduced into its Android and Windows 

Phone and Windows Mobile devices that could have allowed 

malware to access sensitive device functionality and user information 

– Order Provisions: HTC required to provide security patches for 

millions for phones, set up a software security program, and is 

subject to security audits for the next 20 years 

 Twitter (June 2010) 

– Failure to secure administrative access 

 Weak passwords permitted 

 Administrative login page publicly accessible 

 Account not disabled after multiple failed login attempts 

– Consumers’ tweets were not private, as promised 

– Order provisions: Honor the privacy choices made by consumers and 

establish a comprehensive information security program, with 

biennial independent audit. 
Big Picture Lessons 

 Keep your promises 

 Don’t retain information you don’t need 

 Share only for permissible purpose 

 Dispose of information properly—and don’t forget about paper 

 Keep up with common threats 

– Stolen user credentials 

– SQL injection attacks 

– Failure to limit WIFI network access 

– Update antivirus software 

 Get out in front of breaches and have a plan for dealing with them when they 

occur 
A Word On COPPA 

 Applies to websites and online services 

– Child-directed websites and services that collect personal information from 

users under the age of 13 

– General audience websites and online services with actual knowledge they 

are collecting personal information from children under 13 

 Websites and online services must 

– post privacy policies, 

– provide parents with direct notice of their information practices, 

– and get verifiable consent from a parent or guardian before collecting 

personal information from children 

 Questions? 

– http://business.ftc.gov/documents/Complying-with-COPPA-FrequentlyAsked-Questions

– Coppahotline@ftc.gov 

11 
12 

Policy Work 

 Workshops 

– Mobile Payments 

– Mobile Privacy Disclosures 

– Comprehensive Online Data Collection 

 Reports 

– March 2012 Privacy Report 

– Kids Apps Reports 

– Mobile Privacy Disclosures 

 Consumer and Business Education 

– Marketing Your Mobile App 

– Mobile App Security 
13 

March 2012 Privacy Report 

 Three Main Principles: 

– Principle #1: Adopt Privacy by Design 

 Employ reasonable safeguards to protect data 

 Limit data collection and length of retention 

 Enact procedures to promote data accuracy 

– Principle #2: Simplify Privacy Choices 

 Do Not Track 

– Principle #3: Improve Transparency 

 Standardize and enhance privacy disclosures to 

enable better comprehension and comparison of 

privacy practices 
2013 Mobile Privacy Disclosures Report 

 February 2013 Staff 

Report 

– Outgrowth of Commission’s 

prior work on mobile privacy 

and workshop discussions and 

comments 

 Recommended Best 

Practices for: 

– Platforms 

– App Developers 

– Ad Networks and other Third 

Parties 

– App Developer Trade 

Associations 

14 
Consumer and Business Education 

 Marketing Your Mobile 

App 

– Privacy and Truth-inAdvertising Principles for App 

Developers 

 Mobile App Developers: 

Start with Security 

15 
16 

Resources 

 FTC Business Center (business.ftc.gov) 

– Providing you and your business tools to understand and 

comply with the law 
17 

Questions? 

 More information available at: 

www.ftc.gov

Jonathan E. Zimmerman 

Federal Trade Commission 

jzimmerman1@ftc.gov