Social media giants like Facebook and X are “vast surveillance” operations that collect, trade and hold troves of people’s data, the US consumer and competition watchdog has found after close examination of their operations.
The regulator’s findings, based on a deep multi-year examination of how nine tech giants monetise data, comes with a call to introduce the first comprehensive federal privacy legislation in the US.
The largely self-regulated model in place in the home of Big Tech has been a “failure”, the report by the Federal Trade Commission said, and lawmakers must stop letting “foxes guard the henhouse”.
Released early on Friday, the FTC staff report is based on orders the regulator issued in 2020 to nine companies – Amazon, Meta, YouTube, X, Snap, TikTok, Discord, Reddit and WhatsApp – for details on how they collect, use and present data, their advertising system and protections for young users.
It shows the companies are engaging in “vast surveillance” of their users to feed a behavioural advertising model that is damaging privacy and competition. Users had little insight on how their data was being exploited and few controls for minimising risks, the report said.
“After collecting vast amounts of people’s personal information, the platforms implemented few guardrails on the disclosure of people’s data, and most disseminated this data to an assortment of third parties,” FTC chair Lina Khan said in a statement.
“Troublingly, no platform could provide a comprehensive list of the third parties to which it had disclosed user data, and several reported disclosing the data to third parties outside of the U.S., including foreign adversaries.”
The report validates years of warnings from privacy and consumer advocates and is a key recognition that the behavioural ad-based business model is driving the data practices.
“Recognising this basic fact is important for enforcers and policymakers alike because any efforts to limit or regulate how these firms harvest troves of people’s personal data will conflict with their primary business incentives,” Ms Khan said.
The FTC chair said the findings are timely as US federal policymakers consider data protection legislation. The report urges the US congress to pass comprehensive federal privacy legislation for the first time.
It says the laws must limit surveillance, address baseline protections, and grant consumers data rights.
The potential shakeup comes as Australia takes a key step in reforming privacy law after a protracted review and consultation process.
The Albanese government this month introduced legislation that covers an initial tranche of changes, including a new statutory tort for serious privacy breaches, transparency requirements for automated decisions, and more teeth for the national privacy watchdog.
But the most significant changes to Australian privacy law and the ones that would match the FTC’s demands like a right to erasure, stronger consent models and a new “fair and reasonable” test for information handling won’t come until the next tranche.
The second tranche won’t come until after the next election, taking Australia’s reform process beyond five years, with stakeholders criticising the government’s “timid” and “unambitious” first round of reforms.
Australia’s consumer and competition watchdog this year gave its own warnings about commercially driven data practices and has called for a new ex ante scheme to help manage digital platforms.
Treasury is designing a legislative framework for a potential ex ante regime tipped to follow Europe’s Digital Markets Act.
Do you know more? Contact James Riley via Email.