Summit Snapshot: Recent Federal Enforcement Actions: Insights from the FTC’s Erik Jones

February 26, 2024

Big Idea: While state laws on consumer privacy proliferate, and a federal omnibus law remains elusive, the Federal Trade Commission continues to exercise its existing enforcement authority – with emphasis in key areas for digital advertisers.

Erik Jones, senior attorney at the Federal Trade Commission's (FTC) Division of Privacy and Identity Protection, along with Mike Signorelli, a partner at Venable LLP and counsel to Digital Advertising Alliance (DAA), had a nuanced one-to-one discussion at this past year’s DAA Summit 23, providing valuable insights into the latest federal and state enforcement actions. The following presents key takeaways from the conversation, with Jones shedding light on the FTC's priorities and their implications for the advertising community.

Mike Signorelli, partner, Venable LLP, and counsel to DAA (left) and Erik Jones, senior attorney, Federal Trade Commission (right, on screen) discuss the recent enforcement actions in health data and children’s privacy.

Insights from Recent FTC Enforcement Actions

Jones discussed recent enforcement actions, focusing on two critical areas: health data and children's privacy. He underscored the FTC's commitment to consumer protection. Notably, he emphasized the importance of companies to devise and implement internal privacy controls and safeguards to avoid business practices that the FTC would deem as “unfair,” under its existing authority.

Health Data:

“[Health data] is an area that is a priority for the agency,” Jones said, pointing to three recent cases involving sensitive health information. He cited GoodRx, BetterHelp, and PreMom, collectively which demonstrate the FTC's enforcement role regarding  privacy controls, fair practices, and transparent data sharing in the health sector. Jones also cautioned companies on the risks associated with using advertising technologies and emphasized the need for responsible data handling.

Children's Privacy:

“We've seen a number of states legislate in the space around children when it comes to data collection, use and processing, as well as “kids safety” bills,” Signorelli said. “And we've even seen complete bans on advertising in certain channels when minors may access that content.” In response, Jones highlighted the FTC's dedication to safeguard children's privacy. He mentioned recent enforcement actions against companies that allegedly violated the Children's Online Privacy Protection Act (COPPA), emphasizing parental consent must be unambiguous, limiting data storage particularly in areas such as games that are likely to have children among users, and age-gating such information accordingly.

Updates on the Health Breach Notification Rule

Jones also provided an update on the review of the Health Breach Notification Rule (HBNR), which requires vendors of personal health records to notify individuals, the FTC, and sometimes the media, of breaches involving unsecured health data. He mentioned proposed changes aimed at modernizing the rule to address the evolving landscape of health data collection and usage. The HBNR applies to vendors of personal health records not regulated by the federal Health Insurance Portability and Accountability Act, which generally covers health insurance and health care providers.

Other FTC Priorities

While health data and children's privacy were highlighted as key focus areas, Jones also mentioned that the FTC prioritizes preventing consumer harm and comprehensively addresses marketplace problems. Jones also highlighted the importance of monitoring the use of third-party tracking pixels on digital content and that the FTC posted a blog in March 2023 regarding this business practice. According to Jones, “...the blog post raised a number of concerns over the pixels and raised a number of questions that they put out to researchers and others to answer,” the use of personal information linked to such pixels, lack of clarity on the use of such pixels, and an inability for consumers to avoid such tracking, among them.

Erik Jones, senior attorney, Federal Trade Commission, noted how self-regulation can be helpful to consumers.

The Role of Self-Regulation: Helpful but Not Necessarily a Harbor

Responding to a question Signorelli posed about self-regulation, Jones acknowledged the positive effects of self-regulatory programs, such as the DAA Principles, in benefiting consumers. "Speaking for myself, there can certainly be positive effects for consumers from self-regulatory programs... Self regulation doesn't necessarily mean that you are compliant with federal law. It's not a safe harbor, but it can help consumers,” Jones said.

Editor’s Note: GoodRx was previously the subject of a DAA Accountability Program Compliance Action and that action was referenced by the FTC.  DAA participants and guests are welcome to join us for DAA Summit 24 in New York City on June 11-12 -- where Ben Wiseman of the Federal Trade Commission is slated to speak.

 

 

Back to Top