The FTC and the New Common Law of Privacy

Daniel Solove and I have recently posted a draft of our new article, The FTC and the New Common Law of Privacy.

One of the great ironies about information privacy law is that the primary regulation of privacy in the United States has barely been studied in a scholarly way. Since the late 1990s, the Federal Trade Commission (FTC) has been enforcing companies’ privacy policies through its authority to police unfair and deceptive trade practices. Despite more than fifteen years of FTC enforcement, there is no meaningful body of judicial decisions to show for it. The cases have nearly all resulted in settlement agreements. Nevertheless, companies look to these agreements to guide their privacy practices. Thus, in practice, FTC privacy jurisprudence has become the broadest and most influential regulating force on information privacy in the United States – more so than nearly any privacy statute and any common law tort.

In this article, we contend that the FTC’s privacy jurisprudence is the functional equivalent to a body of common law, and we examine it as such. The article explores the following issues:

• Why did the FTC, and not contract law, come to dominate the enforcement of privacy policies?
• Why, despite more than 15 years of FTC enforcement, have there been hardly any resulting judicial decisions?
• Why has FTC enforcement had such a profound effect on company behavior given the very small penalties?
• Can FTC jurisprudence evolve into a comprehensive regulatory regime for privacy?

The claims we make in this article include:

• The common view of FTC jurisprudence as thin — as merely enforcing privacy promises — is misguided. The FTC’s privacy jurisprudence is actually quite thick, and it has come to serve as the functional equivalent to a body of common law.
• The foundations exist in FTC jurisprudence to develop a robust privacy regulatory regime, one that focuses on consumer expectations of privacy, that extends far beyond privacy policies, and that involves substantive rules that exist independently from a company’s privacy representations.

 You can download the article draft here on SSRN.