The Federal Trade Commission’s increased activity in the data security arena continues, as the FTC has ordered nine social media and video streaming companies—including Facebook, Twitter, TikTok, and Reddit—to provide data on their data privacy practices. The orders seek to discover on (i) how these companies collect, use and present personal information, (ii) their advertising, (iii) their user engagement practices, and (iv) how their practices affect children and teenagers.

In issuing the orders, the FTC focused on social media’s monetization of users’ activities and “the industry’s increasing intrusion into our private lives.” In a joint statement, the FTC wrote:

Never before has there been an industry capable of surveilling and monetizing so much of our personal lives. Social media and video streaming companies now follow users everywhere through apps on their always-present mobile devices. This constant access allows these firms to monitor where users go, the people with whom they interact, and what they are doing. But to what end? Is this surveillance used to build psychological profiles of users? Predict their behavior? Manipulate experiences to generate ad sales? Promote content to capture attention or shape discourse? Too much about the industry remains dangerously opaque.

The FTC promised its study “will lift the hood on the social media and video streaming firms to carefully study their engines,” with particular attention to “ascertaining the full scale and scope of social media and video streaming companies’ data collection.” Consistent with this concern, the FTC’s will investigate, among other things:

  • how many users these companies have;
  • how active the users are;
  • what the companies know about them;
  • how they got that information;
  • what steps the companies take to continue to engage users;
  • how social media and video streaming companies process the data they collect, including what kinds of inferences they are able to make about user attributes, interest, and interactions;
  • how business models influence what Americans hear and see, with whom they talk, and what information they share;
  • how children and families are targeted and categorized;
  • “whether we are being subjected to social engineering experiments”; and
  • the financial incentives of social media and video streaming services

The Commission issued the orders on a 4-1 vote. The dissenter, Noah Phillips, criticized the orders as “an undisciplined foray” that was “unlikely to produce the kind of information the public needs, and certain to divert scarce Commission resources better directed elsewhere.”

Going forward, we can expect similar FTC inquiries, motivated by a rationale along the lines of the joint statement. The Trump administration has been criticized for its cybersecurity efforts, but the FTC has bucked this trend; this year, it initiated 22 data security cases, as compared to just nine in 2017. A second Trump administration might have resulted in the appointment of commissioners who could have pulled the FTC away from conducting investigations such as this one and closer to the position the dissent suggests.

As things now stand, however, observers expect the FTC’s cybersecurity activities to increase under President Biden. Biden will have the opportunity to fill four of the five commissioner slots and to name a commission chair, thus crafting an agency that can promote a data security agenda following, and expanding upon, the rationale the Commission articulated in this case.