The Federal Trade Commission (FTC) in 2008 is likely to be active in privacy areas both old and new. As for the "old," the FTC will continue to enforce the national Do Not Call Registry, which the Congress will surely soon make permanent. The agency will continue to look for cases to bring against telemarketers, email spammers, identity thieves, and purveyors of spyware. In particular, expect the agency to continue to press sellers to exercise control over third-party telemarketers, as it did in its recent settlements with DirecTV and ADT. Furthermore, if Congress enacts legislation that grants the FTC rulemaking authority over spyware or security breach notifications, look for the agency to initiate major rulemakings on these topics.

Speaking of rulemakings, in 2008, the FTC may finally complete its CAN-SPAM implementation rulemaking, on which comments were filed more than two years ago, as well as its more recent proceeding on prerecorded telemarketing messages.

The FTC's approval in December of Google's acquisition of DoubleClick included a statement that the privacy issues raised in connection with that merger affect all online advertising, but are unrelated to the antitrust considerations it must apply in a merger analysis.

At the same time, however, the FTC demonstrated its continued interest in online advertising privacy issues by publishing a set of "proposed principles," prepared by its staff, to "encourage more meaningful and enforceable self-regulation to address the privacy concerns raised with respect to behavioral advertising." The agency noted the benefits of online advertising, including the abundance of free content on the Web, but also stated that the practice of targeting ads based on a user's online behavior "is largely invisible and unknown to consumers."

Comments on the proposed staff principles are due February 22. The FTC is likely to use the principles, subject to any modifications based on the comments, as a basis for guidelines to address perceived consumer harm from such marketing, particularly where notice is insufficient. The agency might also try to establish those principles as a standard of reasonableness through carefully targeted enforcement actions and consent decrees.

Also, look for the FTC to recommend changes in how Social Security numbers are used in commerce, with a view toward reducing identity theft. The agency would build upon a workshop it convened in early December, which brought attention to the continued widespread use of Social Security numbers in the private sector.

Finally, the FTC will convene yet another "town hall" in 2008, this time focusing on mobile advertising. Here, too, marketers' interest in reaching the "third screen"—the one that the individual carries around—will likely encounter concerns about whether the practice is excessively intrusive or, when coupled with location-based services, constitutes either a tolerable or unduly oppressive form of monitoring.