How the FTC Can Mandate Data Minimization Through a Section 5 Unfairness Rulemaking

Executive Summary

Unfair data collection practices and surveillance have eroded consumer privacy, and this ever present and unwanted observation constitutes a substantial injury to consumers. This paper argues that the Federal Trade Commission (FTC) should use its Section 5 unfairness authority to establish a Data Minimization Rule to prohibit all secondary data uses with limited exceptions, ensuring that people can safely use apps and online services without having to take additional action. It also lays out two additional options to consider should the FTC decline to prohibit all secondary uses: prohibit specific secondary data uses, such as behavioral advertising or the use of sensitive data; or mandate a right to opt out of secondary data use, including through global opt-out controls and databases.

Additionally, to supplement this Data Minimization Rule, the FTC should adopt data transparency obligations for primary use of data; civil rights protections over discriminatory data processing; nondiscrimination rules, so that users cannot be charged for making privacy choices; data security obligations; access; portability; correction; and deletion rights. In addition, the FTC should prohibit the use of dark patterns with respect to data processing.

The FTC has wide authority to issue prescriptive rules in order to forestall business practices that can cause consumer injury. With respect to judicial interpretation, the courts generally give broad deference to expert agencies’ interpretation of their substantive statutes, and these privacy regulations are likely to withstand First Amendment scrutiny.