No comprehensive federal privacy law governs the collection, use, and  sale or other disclosure of personal information by private-sector  companies in the United States. In  addition, as detailed in this report, FTC addresses consumer concerns  about Internet privacy using its broad authority to protect consumers from  unfair and deceptive trade practices. FTC and FCC Oversight of Internet Privacy

FTC is primarily a law enforcement agency that, among other  responsibilities, currently has the lead in overseeing Internet privacy at  the federal level. Although FTC has not implemented its section 5 authority by issuing  regulations regarding Internet privacy, it has issued regulations to  implement other statutory authorities. Prior to 2015, Internet services  were considered information services under the Communications Act, and  thus FTC was not prohibited from considering the privacy practices of  Internet service providers under its FTC Act authority to protect  consumers from unfair and deceptive practices. Once FCC had asserted primary  oversight over Internet service providers, FCC promulgated privacy  regulations specific to them. Most of these actions pertained to  first-time violations of the FTC Act for which FTC does not have the  authority to levy civil penalties. FTC levied civil penalties against two  of those companies for violating their settlement agreements. Selected Stakeholders Provided Various Views on the Effectiveness of Current Internet Privacy Oversight and How It Could be Enhanced Industry Stakeholders View Current Enforcement Approach as Providing Flexibility, While Consumer Stakeholders See Limitations with This Approach

As previously discussed, no federal statute comprehensively and  specifically governs Internet privacy across all sectors. Industry stakeholders we interviewed generally said that “direct  enforcement” of a statute is preferable to promulgating and enforcing  regulations implementing that statute (which constitutes enforcement of  the statute as well). Regulations can be flexible. Representatives from an Internet association said that FTC’s Internet- privacy enforcement actions should focus on concrete harms. Privacy Statute

Stakeholders from a variety of perspectives—including from academia,  industry, consumer advocacy groups, and former FTC and FCC  commissioners—told us that a privacy statute could enhance Internet  privacy oversight by, for example, clearly articulating to consumers,  industry, and privacy enforcers what behaviors are prohibited, among  other things. In addition, some stakeholders—including a representative from a  consumer group, a former federal enforcement official, and a former FCC  commissioner—said FTC’s section 5 “unfair or deceptive practices”  authority may not enable it to fully protect consumers’ Internet privacy  because it can be difficult for FTC to establish that Internet privacy  practices are legally “unfair.” For example, under section 5, FTC has  charged companies with committing a “deceptive” practice if their privacy  policies said they would not collect or use consumers’ personal  information but then did so. FTC staff said that these  additional steps add time and complexity to the rulemaking process. For example, officials from the CFPB and the  FDA, both of which use APA section 553 notice-and-comment  rulemaking, said that their rulemaking authority assists in their oversight  approaches and works together with enforcement actions. Comprehensive legislation addressing Internet privacy that  establishes specific standards and includes APA notice-and-comment  rulemaking and first-time violation civil penalty authorities could help  enhance the federal government’s ability to protect consumer privacy,  provide more certainty in the marketplace as companies innovate and  develop new products using consumer data, and provide better  assurance to consumers that their privacy will be protected. Matter for Congressional Consideration

Congress should consider developing comprehensive legislation on  Internet privacy that would enhance consumer protections and provide  flexibility to address a rapidly evolving Internet environment. Issues that  should be considered include: which agency or agencies should oversee Internet privacy; what authorities an agency or agencies should have to oversee  Internet privacy, including notice-and-comment rulemaking authority  and first-time violation civil penalty authority; and how to balance consumers’ need for Internet privacy with industry’s  ability to provide services and innovate. Academic stakeholders were selected because of their  expertise in privacy, consumer protection, and regulatory issues. Academics

	Consumer advocacy groups

	Federal government agencies

Consumer Financial Protection Bureau (CFPB)  Consumer Product Safety Commission (CPSC)  Department of Commerce, National Telecommunications and Information  Administration (NTIA)  Equal Employment Opportunity Commission (EEOC)  Federal Communications Commission (FCC)  Federal Trade Commission (FTC)  Food and Drug Administration (FDA)  Occupational Safety and Health Administration (OSHA)

	Former government officials

	Industry groups

	Internet content providers

	Internet service providers

Appendix II: Federal Trade Commission Internet Privacy Enforcement Cases

The following table identifies 101 Federal Trade Commission (FTC)  Internet privacy enforcement actions filed between July 1, 2008 and June  30, 2018 in which the agency alleged a violation of either the Federal  Trade Commission Act (FTC Act) or the Children’s Online Privacy  Protection Act (COPPA) and implementing COPPA regulations and  subsequently entered into a settlement agreement with the target entity.
Why GAO Did This Study

In April 2018, Facebook disclosed that a Cambridge University researcher may have improperly shared the data of up to 87 million of its users with a political consulting firm. This disclosure followed other recent incidents involving the misuse of consumers' personal information from the Internet, which is used by about three-quarters of Americans. GAO was asked to review federal oversight of Internet privacy. This report addresses, among other objectives: (1) how FTC and FCC have overseen consumers' Internet privacy and (2) selected stakeholders' views on the strengths and limitations of how Internet privacy currently is overseen and how, if it all, this approach could be enhanced.
GAO evaluated FTC and FCC Internet privacy enforcement actions and authorities and interviewed representatives from industry, consumer advocacy groups, and academia; FTC and FCC staff; former FTC and FCC commissioners; and officials from other federal oversight agencies. Industry stakeholders were selected to represent different sectors, and academics were selected because of their expertise in privacy, consumer protection, and regulatory issues.

What GAO Found

The United States does not have a comprehensive Internet privacy law governing the collection, use, and sale or other disclosure of consumers' personal information. At the federal level, the Federal Trade Commission (FTC) currently has the lead in overseeing Internet privacy, using its statutory authority under the FTC Act to protect consumers from unfair and deceptive trade practices. However, to date FTC has not issued regulations for Internet privacy other than those protecting financial privacy and the Internet privacy of children, which were required by law. For FTC Act violations, FTC may promulgate regulations but is required to use procedures that differ from traditional notice-and-comment processes and that FTC staff said add time and complexity.
In the last decade, FTC has filed 101 enforcement actions regarding Internet privacy; nearly all actions resulted in settlement agreements requiring action by the companies. In most of these cases, FTC did not levy civil penalties because it lacked such authority for those particular violations. The Federal Communications Commission (FCC) has had a limited role in overseeing Internet privacy. From 2015 to 2017, FCC asserted jurisdiction over the privacy practices of Internet service providers. In 2016, FCC promulgated privacy rules for Internet service providers that Congress later repealed. FTC resumed privacy oversight of Internet service providers in June 2018.
Stakeholders GAO interviewed had varied views on the current Internet privacy enforcement approach and how it could be enhanced. Most Internet industry stakeholders said they favored FTC's current approach—direct enforcement of its unfair and deceptive practices statutory authority, rather than promulgating and enforcing regulations implementing that authority. These stakeholders said that the current approach allows for flexibility and that regulations could hinder innovation. Other stakeholders, including consumer advocates and most former FTC and FCC commissioners GAO interviewed, favored having FTC issue and enforce regulations. Some stakeholders said a new data-protection agency was needed to oversee consumer privacy. Stakeholders identified three main areas in which Internet privacy oversight could be enhanced:
Statute . Some stakeholders told GAO that an overarching Internet privacy statute could enhance consumer protection by clearly articulating to consumers, industry, and agencies what behaviors are prohibited.
Rulemaking . Some stakeholders said that regulations can provide clarity, enforcement fairness, and flexibility. Officials from two other consumer protection agencies said their rulemaking authority assists in their oversight efforts and works together with enforcement actions.
Civil penalty authority. Some stakeholders said FTC's Internet privacy enforcement could be more effective with authority to levy civil penalties for first-time violations of the FTC Act.
Comprehensive Internet privacy legislation that establishes specific standards and includes traditional notice-and-comment rulemaking and broader civil penalty authority could enhance the federal government's ability to protect consumer privacy.

What GAO Recommends

Congress should consider developing comprehensive legislation on Internet privacy that would enhance consumer protections and provide flexibility to address a rapidly evolving Internet environment. Issues that should be considered include what authorities agencies should have in order to oversee Internet privacy, including appropriate rulemaking authority.