Comments of the Cordell Institute on the Prevalence of Commercial Surveillance and Data Security Practices that Harm Consumers

These comments are a response to the Federal Trade Commission's 2022 advance notice of proposed rulemaking (“ANPR”) requesting public comment on the prevalence of commercial surveillance and data security practices that harm consumers (Commercial Surveillance ANPR, R111004).In an increasingly digitized world, data collection, processing, and transfer have become integral to market interactions. Our personal and commercial experiences are now mediated by powerful, information-intensive firms who hold the power to shape what consumers see, how they interact, which options are available to them, and how they make decisions. That power imbalance exposes consumers and leaves them all vulnerable. We all share data concerning ourselves with these platforms, often unwittingly, and we leave ourselves at the risk of their manipulation and control. The Federal Trade Commission envisions “[a] vibrant economy fueled by fair competition and an empowered, informed public.” But this vision cannot be realized in the absence of meaningful consumer trust. Where trust is present, consumers are empowered to invest in companies and share their data knowing they are not going to be betrayed, manipulated, deceived, or treated unfairly. Where trust is weakened or absent, in contrast, the marketplace breaks down and becomes a fertile ground for the development of market failures that are contrary to the interests of consumers and competition. Recognizing the importance of trust, loyalty, and relational vulnerability, the Cordell Institute submitted comments to the Federal Trade Commission which were organized around three central arguments. First, commercial surveillance is the correct term for data practices observed in the market. Humans are increasingly being tracked, identified, classified, and commodified online, resulting in a corporate surveillance regime which the Commission is correct to label as such. This prevalent commercial surveillance inflicts substantial injuries on consumers, eroding trust in digital markets as consumers feel betrayed by data practices that do not advance their interests. Commercial surveillance also poses significant risks to our mental health, civil rights, and democracy. Such harms are not outweighed by countervailing benefits to consumers or competition, as the benefits of commercial surveillance disproportionately flow to industry. Second, notice and choice has failed to protect consumers from unfair trade practices. Notice and choice is overwhelming, illusory, and ineffective. Rather than being empowering, notice and choice has proven overly burdensome on consumers and has legitimized harmful, disloyal data practices. Notice and choice is plagued by cognitive and structural problems which prevent consumers from effectively engaging in privacy self-management. These problems reveal a fundamental problem with notice and choice: rather than giving consumers meaningful choices, notice and choice manufactures consent. Consent has its place in law, but a number of pathologies which undermine the validity of consent are present in digital market interactions. The increasing prevalence of dark patterns and manipulative design further highlights the failure of notice and choice. There are situations in which consent can be effective, but those circumstances are rarely present in digital markets. American privacy must move beyond notice and choice if it is to truly protect the ability of consumers to make voluntary choices and safely interact in markets. Third, the commission should ground future data privacy rules under its Section Five powers in concepts of trust, loyalty and relational vulnerability. Modern commercial relationships are uniquely risky for consumers. Modern tech companies are entrenched in our lives and have considerable control over what we see and click, making consumers vulnerable to companies in unprecedented ways. We trust these companies with our data out of necessity, but the law fails to stop them from engaging in self-serving, opportunistic behavior. Not all privacy injuries are caused by disloyal commercial surveillance, but all disloyal commercial surveillance causes substantial injuries. Such practices are the very definition of an unfair trade practice for the digital age, because they leave consumers substantially worse-off, are not reasonably avoidable given consumers’ vulnerability, and negate any possible offsetting benefits to consumers or competition by poisoning the marketplace. Commercial surveillance creates strong incentives to generate short-term profits by extracting more data and attention in increasingly harmful ways. Approaching questions of unfairness through the frame of disloyalty and relational vulnerability thus reveals why certain commercial surveillance practices are both unfair and deceptive. Loyalty is what separates harmful commercial surveillance from market intelligence that can benefit everyone. By narrowing the category of commercial surveillance to the subset of those practices which are disloyal, the Commission can craft precise trade regulations which target the most egregious and pressing harms in the marketplace.