The Federal Trade Commission (FTC) Warns Companies on Permissive Data Practices

The Federal Trade Commission (FTC) is warning companies against adopting “more permissive data practices” in the era of artificial intelligence (AI), as highlighted in a post by law firm Ballard Spahr.

Businesses cannot do away with existing privacy commitments by changing policies retroactively, according to the FTC guidance. They must inform consumers before adopting more permissive data practices. Informing consumers after the fact via a “surreptitious, retroactive amendment to its terms of service or privacy policy” may be unfair or deceptive, the FTC said.

Ballard Spahr added: “In other words, the long-standing practice of simply updating the privacy policy may not provide sufficient notice to consumers depending on the nature of the changes.”

In its guidance, the FTC noted that it has a long history of challenging deceptive and unfair practices in connection to a company’s privacy policy and promises to consumers. “Nearly two decades ago, the FTC charged Gateway Learning Corporation, known for its ‘Hooked on Phonics’ products, with violating the FTC Act after it changed its privacy policy to allow it to share consumer data with third parties without notifying consumers or getting their consent.”

An example of the kind of change that requires prior notice is sharing data with third parties or using data for AI training. According to the FTC, those constitute material changes to practices. Such changes require companies to square their new business goals with their existing privacy commitments. 

Ballard Spahr attorneys note that the policy articulated in February 2024 resembles the same requirements in some state privacy laws.

“For example, under the Colorado Privacy Act, certain types of changes require notice to consumers beyond simply updating the privacy policy—even if the policy states that changes are effective upon posting,” the law firm wrote. “Similarly, if the change constitutes a secondary use, affirmative consent may be required.”

The Ballard Spahr attorneys suggest that companies pay diligent attention to what notice is required and when before starting new processing activity with data that has already been collected.