Executive Summary

Protecting privacy online is fundamental to prevent myriad harms, but current regulation has not sufficiently safeguarded individual privacy to date. As Congress considers enacting federal legislation to protect privacy, it has a variety of options at its disposal for addressing how the new legislation should be enforced.

At present, the Federal Trade Commission (FTC) has the broadest federal jurisdiction over protecting consumer privacy. However, the FTC’s privacy authority is constrained. It does not have the ability to address all privacy concerns, and its scope is limited as an enforcement agency focused primarily on interstate commerce and consumers.

First, the FTC’s current approach focuses on privacy harms that can be quantified in terms of economic damage. Yet privacy encompasses many things that cannot be quantified. Privacy represents soft values with “social, political, and informational consequences”—i.e., it has no clear monetary value. Second, the FTC’s Section 5 authority to take action against “unfair or deceptive acts or practices” does not sufficiently protect privacy. Both causes of action are narrow, and the FTC has rarely invoked its unfairness authority to address privacy abuses. Third, the FTC has limited rulemaking authority under the Magnuson-Moss Warranty-Federal Trade Commission Improvement Act (Magnuson-Moss).

Additionally, the FTC currently lacks the capacity to exercise its jurisdiction over privacy regulations effectively. The FTC has around 40 full-time staff working on privacy issues, which is significantly fewer than many foreign data protection authorities in smaller countries. It is also unclear whether the FTC has the technological expertise it needs to enforce privacy laws.

As an alternative, Congress could consider establishing a new data protection agency, as some experts have argued. Doing so could provide opportunities to create a structure that is better suited to enforcing privacy, including by maintaining some degree of stability or independence across presidential administrations. A new agency dedicated to the cause of privacy enforcement and data protection could also improve relations with authorities abroad. The primary concern with creating a new agency, however, is that it might be logistically difficult and take a long time to set up.

The proper role of states in privacy enforcement is also an important issue for Congress to consider. There are two important questions regarding state authority: whether state attorneys general (AGs) have the authority to enforce a federal privacy law, and whether state legislatures have the freedom to enact their own privacy laws. State enforcement could provide several benefits, including serving as a hedge against regulatory capture and political pressure at the federal level. On the other hand, if states take differing approaches to protecting their constituents’ privacy, they could cause overly burdensome compliance challenges for companies.

Individuals could also enforce their own privacy rights if Congress includes a private right of action in federal privacy legislation. With a private right of action, an individual whose privacy rights are violated could sue the violating company directly rather than rely on a federal or state enforcer. While there is some opposition to a private right of action from industry and lawmakers, private rights of action are an extension of democratic participation, like petitioning government, writing members of Congress, and talking to state legislators. Additionally, individuals have not always been able to rely on the government to protect their rights, particularly their civil rights. A private right of action can therefore empower individuals to pursue enforcement on their own.

Congress should carefully consider all of these options as it works to craft new federal privacy legislation. The effectiveness of any privacy law will depend on how it is enforced.