FTC Launches Rulemaking on Commercial Surveillance Consent

The Federal Trade Commission released an Advanced Notice of Proposed Rulemaking (ANPR) on August 22, 2022 that asks whether new rules are needed to curb commercial surveillance and shore up data security. The agency frames the request as a response to the “scale, opacity, and pervasiveness” of data collection that today powers a multi‑billion‑dollar industry.

The ANPR lists a series of questions about consent, retention, and transfer of consumer data. It asks how effective consent is as a metric for unfair or deceptive practices, whether firms should be required to offer opt‑out choices, and how consent standards might differ for vulnerable groups such as minors or the elderly. The document also notes that “mass surveillance has heightened the risks and stakes of errors, deception, manipulation, and other abuses.”

Public Forum and Comment Landscape

The FTC announced a virtual public forum for Thursday, September 8, 2022, running from 2 p.m. to 7:30 p.m. The forum invites anyone to attend and submit remarks. According to the Federal Register filing, the agency received 11,111 comments on the proposal through Regulations.gov, a volume that underscores the public’s appetite for shaping the rules.

Commenters ranged from privacy‑focused NGOs to industry trade groups. Several submissions warned that overly strict consent requirements could cripple data‑driven services, while others argued that the current consent model is a “meaningless checkbox” that fails to protect consumers from identity theft and psychological harm. The FTC has not yet indicated which viewpoints will inform the final rule.

Technical Mechanics of Commercial Surveillance

Commercial surveillance relies on a stack of everyday technologies—mobile apps, smart home devices, and location services—to collect granular data about individuals. The ANPR points out that this data is often repurposed for advertising, risk scoring, and even law‑enforcement analytics. Because the data is stored and transferred across multiple vendors, the attack surface expands, raising the likelihood of breaches.

The FTC’s questions probe the durability of consent when data is aggregated and sold downstream. They ask whether consent should be “demonstrable or substantial” enough to remain a useful benchmark for unfair practices. The agency also seeks input on whether consent standards should vary by practice, suggesting that a one‑size‑fits‑all approach may be insufficient for high‑risk activities such as biometric profiling.

Regulatory Context and Precedent

The ANPR follows a series of FTC actions targeting deceptive data practices, including the 2020 settlement with a major ad‑tech firm over undisclosed data sharing. Federal law already restricts certain surveillance activities under the Fair Credit Reporting Act and the Children’s Online Privacy Protection Act, but the FTC argues that those statutes do not fully cover the modern commercial surveillance economy.

Legal scholars have noted that the FTC’s authority to regulate “unfair or deceptive acts or practices” gives it broad latitude, yet any rule must survive judicial review for overreach. The ANPR therefore asks how the agency should balance consumer protection against the risk of stifling innovation in data‑driven services.

Industry Response and Market Implications

Tech companies have begun adjusting their privacy architectures in anticipation of stricter consent regimes. Some firms are piloting “dynamic consent” dashboards that let users toggle specific data uses in real time. Others argue that such granular control will increase friction and reduce the effectiveness of personalization algorithms that underpin revenue models.

Investors are watching the rulemaking closely. A shift toward mandatory opt‑out could force firms to redesign data pipelines, potentially raising compliance costs. Conversely, clearer consent standards might reduce litigation risk and restore consumer trust, a factor that could translate into higher engagement metrics.

What to Watch

The FTC is expected to issue a formal Notice of Proposed Rulemaking later this year, followed by a comment period that could extend into 2024. Stakeholders should monitor the agency’s final language on consent thresholds, the scope of required opt‑out mechanisms, and any carve‑outs for critical services. The next public forum, slated for early 2024, will likely surface additional industry positions and may signal the timeline for an eventual rule adoption.