FTC Privacy and Data Security Enforcement and Guidance Under Section 5

Section 5 of the FTC Act does not itself mention privacy or data security, yet it is the legal basis for well over a hundred Federal Trade Commission privacy and data security enforcement actions. The Commission has used the broad language of Section 5—which prohibits “unfair or deceptive acts or practices,” among other things—to hold individuals and companies accountable for everything from broken privacy and data security promises to “unfair” collection of personal information. To better understand the contours of the FTC’s privacy and data security enforcement under Section 5, this article examines the agency’s litigated cases, public settlements, and guidance materials. This article’s modest purpose is to serve as an introduction to some of those materials. It proceeds in four sections. The balance of Section I provides an overview of FTC privacy and data security enforcement and guidance. Section II addresses FTC privacy enforcement and guidance under Section 5, including the agency’s early privacy actions and those involving social networks, internet tracking, browser toolbars, cookies and behavioral advertising, mobile devices, data brokers, and the misappropriation of consumer data. Section III discusses FTC data security enforcement and guidance under Section 5, including the agency’s recent data security litigation and enforcement actions that help define “reasonable” data security. The article concludes in Section IV