9.1 Section 5 of the FTC Act and Privacy

As described more thoroughly in Chapter 1, Section 5 of the Federal Trade Commission Act declares illegal “unfair or deceptive acts or practices in or affecting commerce.”² The statute states that “unfair” practices are those that cause or are likely to cause “substantial injury to consumers which is not reasonably avoidable by consumers themselves and not outweighed by countervailing benefits to consumers or to competition.”³

As with data security, the FTC has not promulgated privacy regulations under Section 5. Rather, it takes a case-by-case approach to determine whether a company's privacy practices are unfair or deceptive. In general, the FTC expects companies to disclose material aspects of the manner in which they handle personal data (i.e., if they share information with third parties) and to be honest in their statements about data processing (i.e., not to lie in their privacy policies). Transparency, full disclosure, and honesty are among the most important principles in complying with the FTC's privacy expectations. Unlike data protection regulators in other countries, the FTC does not impose a specific set of data privacy requirements on all companies.

The FTC most clearly articulated its privacy expectations in March 2012, when it issued a 73-page report, entitled Protecting Consumer Privacy in an Era of Rapid Change.⁴ Although the report is not legally binding, it provides the best guidance to date as to the types of actions that companies can take to reduce the chances of facing FTC enforcement actions regarding their privacy practices. The following are the principles in the FTC's report:

• Privacy by design. Companies should integrate privacy into every element of their organizations, products, and services. When developing new products and services, privacy and data security should be considered from the very start. Companies should consider limits on data collection, retention policies, data disposal practice, and data accuracy.
• Simplified consumer choice. A company must obtain affirmative consent from consumers if the company collects sensitive data or plans to use consumer data in a manner that is materially different from the manner in which the company claimed it would be used when it collected the data. However, the FTC does not believe that companies always need to obtain affirmative consent. If its practices “are consistent with the context of the transaction or the company's relationship with the consumer, or are required or specifically authorized by law,” the company is not required to obtain consent, the FTC wrote.
• Privacy notices. The FTC recognizes the value in disclosing privacy practices via privacy notices (often known as “privacy policies” on websites). However, the Commission noted its concerns that privacy policies often are long and complex, and therefore not particularly useful to consumers. The FTC urged companies to make their privacy notices “clearer, shorter, and more standardized to enable better comprehension and comparison of privacy practices.” The FTC urged companies to consider using some “standardized elements” to enable easier comparison.
• Access. The FTC believes that consumers should have reasonable access to the data that companies maintain regarding them, allowing the consumers to correct errors. The Commission stated that “consumer access should be proportional to the sensitivity and the intended use of the data at issue.” If data is used only for marketing purposes, the FTC is less likely to conclude that consumers should be permitted to access it, as the costs of access likely would outweigh the consumer benefits. However, if the data is used to make individual determinations about a consumer's employability or creditworthiness, the FTC believes that consumers should have a right to access the data.
• Consumer education. Companies should educate consumers about their privacy practices. In particular, the FTC urges companies to provide consumers with information from the FTC's privacy and security websites and resources.

The FTC followed up on its Privacy Report in February 2013, when the FTC staff issued a report with best practices for mobile app privacy.⁵ The mobile report contained privacy recommendations for app platforms (e.g., the iTunes store and mobile operating systems) and app developers (the creators of the apps). Although the report does not constitute binding law, it provides a good indication of the FTC's privacy expectations for mobile apps.

In the mobile report, the FTC staff stated that the app platforms should consider the following features for its apps and privacy disclosures:

• Just-in-time disclosures and opt-in consent before allowing apps to collect sensitive information such as geolocation data.
• A one-stop “dashboard” allowing customers to review the types of content accessed by apps that they have downloaded.
• Privacy best practices so that developers can be required to make privacy disclosures.
• Clear disclosures about extent to which apps are reviewed for privacy before they are made available on platform.
• A “Do Not Track” mechanism for smartphone users, allowing consumers to prevent ad networks from tracking them.

The FTC recommended that app developers consider the following:

• Posting a privacy policy that is easily accessible through app stores.
• Just-in-time-disclosures and opt-in consent for collecting and sharing sensitive information.
• Coordinating with ad networks and other third parties to provide accurate disclosures to consumers.
• Self-regulatory programs to provide guidance on uniform, short-form privacy notices.

Transparency is perhaps the FTC's most important expectation for companies' privacy practices. The FTC provides companies with tremendous flexibility in determining how to collect, use, and share customers' personal information, but it expects that companies will accurately disclose these practices to consumers. If a company does not disclose a material practice – or, even worse, misrepresents it – the FTC may bring an enforcement action.

For example, in August 2012, the FTC announced a $22.5 million civil penalty against Google for violating a previous privacy-related consent order. The FTC alleged that Google surreptitiously placed advertising tracking cookies in consumers' Safari web browsers. These cookies allowed targeted advertising via Google's DoubleClick advertising network. However, Google informed Safari users that they did not need to take any actions to opt out of targeted advertisements because Safari's default setting effectively prevents such cookies. Typically, the FTC settles privacy and data security cases by entering into consent orders that require a company take specific remedial actions, and it does not fine them initially. However, the FTC imposed the $22.5 million because Google already was operating under a 2011 consent order, arising from alleged misrepresentation of its privacy practices on a social network, Google Buzz. In a statement accompanying the $22.5 million fine, the FTC stated that the penalty “signals to Google and other companies that the Commission will vigorously enforce its orders.”

Similarly, in 2011, the FTC announced a settlement and consent decree with Facebook arising from allegations about the social network's privacy practices. Among other things, the FTC alleged that Facebook made users' friends lists public without providing them with advance warning. Additionally, the FTC alleged that Facebook's “Friends Only” setting still allowed user content to be shared with third-party application used by the users' friends.

Companies that tout their privacy protections in their marketing to consumers must ensure that their products and services live up to those promises. For instance, in May 2014, the FTC reached a settlement with Snapchat, a mobile messaging application that marketed the fact that messages sent via the service would “disappear forever” after a designated time period. The FTC brought the complaint because users could circumvent this requirement, and store the messages beyond the expiration date.

The FTC in recent years has increasingly focused on particularly sensitive data collected by new technologies, such as geolocation. For instance, in December 2013, it announced a settlement with Goldenshores Technologies, the creator of a popular flashlight app for Android. The FTC alleged that the company provided third parties, including ad networks, with users' precise location and unique device identifiers, but it failed to disclose this sharing in its privacy policy. Moreover, the FTC states that when customers first opened the app, they had an option to “accept” or “refuse” the end user licensing agreement, but that this presented a “false choice” because the information already had been sent to third parties after the app was downloaded.

9.2 Health Insurance Portability and Accountability Act

Although the FTC has not enacted specific privacy regulations for all companies, some sectors are legally required to abide detailed privacy regulations. Among the most restrictive is healthcare, owing in part to the sensitive nature of health records.

Chapter 3 described the data security and breach notification requirements of the Health Insurance Portability and Accountability Act (HIPAA), enforced by the U.S. Department of Health and Human Services.⁶ Also under HIPAA, the Department has adopted a Privacy Rule, which limits the ability of health plans, healthcare providers, healthcare clearinghouses, and their business associates to use and disclose “protected health information,” which is information that relates to an individual's physical or mental health or condition, the provision of healthcare to the individual, or the individual's payments for healthcare.⁷ The Privacy Rule only applies if the information identifies the individual; it does not apply to the use or disclosure of de-identified information.

The Privacy Rule allows covered entities to use and disclose protected health information:

• To the individual.
• For treatment, payment, or healthcare.
• Incidental to a permitted use or disclosure.
• If the individual has authorized the use or disclosure.
• For use in a facility directory or to notify family or friends of care, provided that the individual has the opportunity to agree or object (if the individual is incapacitated, the use or disclosure may be deemed to be in the individual's best interests).
• If the use or disclosure is in the public interest, which the law defines as one of the following categories: (1) required by law; (2) for public health activities; (3) regarding victims of abuse, neglect, or domestic violence; (4) for health oversight activities, such as criminal investigations of a health provider; (5) for judicial and administrative proceedings; (6) for law enforcement purposes; (7) information about decedents; (8) for cadaveric organ, eye, or tissue donation purposes; (9) for research purposes; (10) to avert a serious threat to health or safety; (11) for specialized government functions, such as military and national security activities; and (12) for workers compensation.⁸

If the use or disclosure is not explicitly covered by one of the exemptions above, the covered entity or business associate is required to obtain the individual's written authorization, which specifically allows the use and disclosure. For instance, in order for a healthcare provider to be permitted to use an individual's protected health information for marketing purposes, the written authorization must explicitly give permission to use the data for marketing.⁹

When covered entities and business associates use or disclose protected health information, they typically must make “reasonable efforts” to only use or disclose the “minimum necessary” information for the intended purpose. In other words, if a health insurer needs the healthcare provider's records of a patient's most recent physical in order to process its payment, the healthcare provider should not provide the insurer with records from the patient's ten most recent visits. The “minimum necessary” limit does not apply in a few select cases – notably if needed for treatment, disclosed to the individual who is the subject of the information, or if disclosed under an authorization by the individual.¹⁰

Covered entities also must fulfill a number of administrative requirements under the Privacy Rule. They must designate a privacy official responsible for implementation of its privacy policies and procedures. Covered entities also must train all of their employees regarding protected health information.¹¹ HIPAA further imposes a number of data security requirements, which are discussed in Chapter 3.

The HIPAA Privacy Rule also requires covered entities to provide consumers with “adequate notice of the uses and disclosures of protected health information that may be made by the covered entity, and of the individual's rights and the covered entity's legal duties with respect to protected health information.”¹² If the covered entity has a direct treatment relationship with the individual, it must make a good-faith effort to obtain a written acknowledgment that the customer has received the privacy notice.¹³

In addition to restricting the use and disclosure of protected health information, HIPAA provides individuals with a relatively broad right of access to their information.¹⁴ Individuals do not, however, have a right to access psychotherapy notes or information that is compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding.¹⁵

9.3 Gramm-Leach-Bliley Act and California Financial Information Privacy Act

As with health information, nonpublic financial data also receives special protection under U.S. law. The Gramm-Leach-Bliley Act (GLBA), whose data security requirements were discussed in Chapter 3, also imposes privacy requirements on financial institutions. GLBA's privacy requirements, known as the Privacy Rule, generally are less burdensome than the HIPAA requirements that healthcare providers face, owing in part to the greater sensitivity of healthcare data.

GLBA imposes two general requirements: notice and choice. Under the notice requirement, a financial institution generally must provide customers with privacy notices at the time that the relationship with the customer is formed and at least once a year after that.¹⁶ The notices must provide “clear and conspicuous disclosure” of the institution's privacy practices, including its policies for disclosing nonpublic personal information to nonaffiliated third parties, the categories of persons to whom the information may be disclosed, the categories of nonpublic personal information that the financial institution collects, the institution's confidentiality and security policies, and other disclosures.¹⁷ Financial regulators have developed model privacy notices that could satisfy this requirement.¹⁸ In 2014, the Consumer Financial Protection Bureau adopted a new regulation that allows certain institutions to satisfy this requirement by posting the notices online, provided that they do not share nonpublic personal information with unaffiliated third parties.¹⁹

GLBA's Privacy Rule also requires financial institutions to allow users to choose whether to permit certain types of information sharing. If the financial institution is sharing information with a nonaffiliated third party that is performing services for the financial institution (e.g., marketing the institution's services), the institution does not need to provide the user with choice before sharing the data. However, if the financial institution intends to disclose nonpublic personal information to nonaffiliated third parties for other purposes (e.g., to market another company's services), the institution first must clearly and conspicuously notify the individual of the planned sharing and provide the individual with an opportunity to opt out before the institution shares the information.²⁰

A California law imposes more restrictive choice requirements on financial institutions. The California Financial Information Privacy Act, also known as SB-1,²¹ requires companies to receive opt-in consent from consumers before sharing their data with most unaffiliated third parties (unless the sharing is necessary to provide the financial services to the customers). This opt-in requirement is significantly more restrictive than GLBA's opt-out requirement because opt-in requires the customer to provide explicit consent before the sharing occurs. In contrast, under the opt-out system, if a customer does nothing after receiving notice, the information sharing is permitted. The California Financial Information Privacy Act also restricts financial institutions' ability to share information with affiliated entities. To do so under the California law, customers must obtain opt-out consent. This also is more restrictive than the GLBA Privacy Rule, which does not restrict financial institutions' sharing of data among affiliated companies.

9.4 CAN-SPAM Act

In the early 2000s, as email was becoming an important component of business and personal lives, policy makers focused on the increasing volume of junk “spam” email messages that were flooding inboxes around the nation. States began to develop their own patchwork of anti-spam laws, and in 2003, Congress passed a single national restriction on spam, the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (CAN SPAM Act).²² The law is enforced by the Federal Trade Commission and Federal Communications Commission. The statute has been criticized by some consumer groups because it preempts more stringent state laws and prevents consumers from bringing private lawsuits against spammers.

Among the key requirements of the CAN SPAM Act are the following:

• Prohibition of false or misleading transmission information. The CAN SPAM Act prohibits the senders of commercial email messages from using false header information, including email addresses or IP addresses. The statute states that header information is misleading “if it fails to identify accurately a protected computer used to initiate the message because the person initiating the message knowingly uses another protected computer to relay or retransmit the message for purposes of disguising its origin.”²³
• Prohibition of deceptive subject headings. Senders of commercial email messages may not use a subject line that “would be likely to mislead a recipient, acting reasonably under the circumstances, about a material fact regarding the contents or subject matter of the message[.]”²⁴
• Return address or opt-out. Senders of commercial email must include a return email address or other mechanism (e.g., a link) that allows recipients to request not to receive commercial emails in the future. Once a sender receives such a request, it must stop sending commercial emails to that address within ten business days.
• Identification of email as advertisement. Commercial email must contain a “clear and conspicuous identification” that the email is an advertisement or solicitation, a notice of the opportunity to decline to receive further email, and a valid physical mailing address of the sender.

Companies that violate the CAN SPAM Act can face FTC penalties of up to $16,000 per email.

9.5 Video Privacy Protection Act

The Video Privacy Protection Act (VPPA),²⁵ passed in 1988 in an effort to protect the privacy of video cassette rental information, has had a surprisingly large impact on the data processing abilities of websites and apps that deliver online video content.

Congress passed the VPPA in response to a newspaper's publication of the video rental records of Judge Robert Bork, who had been nominated to the United States Supreme Court. The VPPA prevents “video tape service providers” from knowingly disclosing an individual's personally identifiable video requests or viewing habits, unless the individual has provided informed, written consent. The requirement is rather broad, though it contains a few exceptions, including disclosures that are incidental to the ordinary course of business for the service provider (debt collection activities, order fulfillment, request processing, and the transfer of ownership) and to law enforcement under a warrant, subpoena, or court order. Companies may use opt-out consent to share only customers' names and addresses, providing that their video viewing information is not disclosed.

Why should websites and apps be concerned about a law that restricts the ability of “video tape service providers” to share information? The statute rather broadly defines “video tape service providers” as “any person, engaged in the business, in or affecting interstate or foreign commerce, of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials[.]”²⁶ This definition is broad enough to encompass not only video rental stores, but websites and apps that provide video (whether it be streaming movies, television shows, or news clips). For instance, in 2012, a federal court ruled that Hulu's online movie streaming is covered by the VPPA because Hulu provides “similar audio visual materials.”²⁷

VPPA disputes often arise when websites or apps provide individually identifiable video viewing information to third-party analytics companies. Unless companies can convince a court that they are not covered by the VPPA or an exception applies, they must obtain a very specific form of consent from the consumer in order to share the data. The VPPA requires the request for consent be “separate and distinct” from any other legal or financial notice. For instance, to obtain a consumer's consent online, the provider must use a separate online pop-up ad seeking consent to disclose video viewing information, and the customer must take an affirmative act, such as clicking “I agree.” The notice may not be buried in a larger privacy policy or terms of service. Once a website or app obtains consent, it may share video viewing information for two years, or until the consumer revokes consent.

Companies have good reason to care about compliance with the VPPA. The statute allows damages of at least $2500 per violation. This large amount makes the VPPA a particularly attractive tool for class action plaintiffs' lawyers. Imagine that a newspaper's website shared the video viewing information of 100,000 registered users with its online analytics provider and did not obtain proper consent. A VPPA class action lawsuit could recover $250 million. For this reason, it is important that companies take extra precautions to ensure that they obtain adequate consent before sharing video viewing information.

A number of states have enacted statutes that are similar to the VPPA. One notable state law is the Michigan Video Rental Privacy Act, which is broader than the VPPA. The Michigan law restricts information sharing by companies that are “engaged in the business of selling at retail, renting, or lending books or other written materials, sound recordings, or video recordings.”²⁸ In 2014, a federal court ruled that this includes not only online video providers but also magazines that share information about their subscribers.²⁹ Accordingly, at least for Michigan subscribers, companies must be careful about sharing subscriber information not only for videos but for virtually all forms of online content.

9.6 Children's Online Privacy Protection Act

The Children's Online Privacy Protection Act (COPPA)³⁰ restricts the online collection of personal information from minors who are under 13 years old. The Federal Trade Commission has promulgated regulations³¹ under COPPA and enforces the law.

COPPA applies to two types of website and online services: (1) those that are directed to children under 13 and (2) those that have actual knowledge that they are collecting or maintaining information from children under 13. To determine whether a website or online service is directed to children under 13, the FTC's regulations state that the Commission considers:

• subject matter;
• visual content;
• use of animated characters or child-oriented activities and incentives, music or other audio content;
• age of models;
• presence of celebrities who appeal to children
• language or other characteristics of the service; and
• whether advertising promoting or appearing on the website or online service is directed to children.³²

Websites and online services that are covered under COPPA must provide clear notice on their sites about the information that they collect from children, how they use the information, and their disclosure practices for this information. The websites and services must obtain “verifiable parental consent” before collecting, using, or disclosing any personal information from children under 13. The FTC broadly defines personal information as including:

• first and last name;
• physical mailing address;
• online contact information;
• screen or user name that functions as online contact information;
• telephone number;
• social security number;
• persistent identifier “that can be used to recognize a user over time and across different websites or online services”;
• photograph, video, or audio file, where such file contains a child's image or voice;
• geolocation information that can identify the street and city or town; or
• information regarding the child or the child's parents, collected along with an identifier described above.³³

To obtain verifiable parental consent, the regulations state, websites and online services must use methods that are “reasonably calculated, in light of available technology, to ensure that the person providing consent is the child's parent.”³⁴ Included among the examples of such methods listed in the regulations are:

• requiring parent to sign a consent form and return it by postal mail, fax, or electronic scan;
• requiring parent to use a credit or debit card or other payment system that notifies the account holder of a transaction;
• having parent call a toll-free number;
• having parent connect to company via video-conference; and
• checking a form of government-issued identification against databases of such information (as long as the parent's identification is promptly deleted after verification).³⁵

If a website or online service is collecting personal information only for internal operations, and will not disclose it to any outside party, it also can obtain parental consent using the “email plus” method, in which the parent provides consent via a return email message, provided that the website or online service also take an additional confirming step, either (1) requesting in the initial message that the parent include a phone number or mailing address to which the operator send a confirming phone call or letter, or (2) after a “reasonable” delay, the operator sends another email confirming consent.³⁶

Even if a website or online service has obtained verifiable parental consent, it must provide parents with an ongoing opportunity to access the personal information collected from their children, delete the information, and prevent further use or collection of the information. The websites and online services also are required to maintain the confidentiality, security, and integrity of information that they collect from children, though the regulations do not specify particular data security safeguards that the companies must enact.

If the FTC determines that a website or online service has violated COPPA, it can bring an enforcement action in court, seeking damages of up to $16,000 per violation. The largest COPPA enforcement action to date resulted in a $3 million settlement. Playdom, which develops online multi-player games, operated a website called Pony Stars, a virtual online world directed to children. The FTC alleged that from 2006 to 2010, hundreds of thousands of children registered for Pony Stars, even though Playdom did not properly obtain verifiable parental consent, nor did it properly post a COPPA-compliant privacy policy.

9.7 California Online Privacy Laws

Some of the most stringent online privacy laws were adopted not by Congress but by the California legislature. Although the laws only apply to California residents, they have become de facto requirements for most companies that conduct business in the United States. In addition to the California Financial Information Privacy Act, described above, California has imposed requirements on companies via the California Online Privacy Protection Act (CalOPPA), the California Shine the Light law, and the California “Eraser Button” law.