The tension between meaningful transparency and consent fatigue has never been fully resolved — the FTC’s 2012 privacy report introduced “just-in-time notices” as a goal, but achieving actionable disclosure without overwhelming consumers remains an open challenge in privacy practice. The US opt-out default creates a different dynamic than GDPR’s opt-in world: it can enable a trust-based relationship between publisher and consumer, but requires excellent execution. FTC Chair Lina Khan’s framing at the prior year’s IAPP — that notice and consent are fundamentally outdated models — points toward emerging alternatives: data minimization, use restrictions, and substantive privacy rights rather than disclosure-based protection. The FTC’s potential path to a federal privacy rule runs through MAGNUSON-MOSS rulemaking authority. The agency published an Advanced Notice of Proposed Rulemaking in August 2022, asking foundational questions about where a federal privacy rule could go. A Notice of Proposed Rulemaking with actual rule text has not yet been published, and the full process — informal hearings, final rule, judicial review — has historically taken many years, though some at the agency believe the timeline can be compressed. Without federal baseline legislation, the patchwork of state laws continues to dominate the compliance landscape with no unified standard. Two additional themes rounded out the episode. Professor Danielle Citron’s upcoming IAPP presentation was highlighted as a marker of how far the field has come: privacy is increasingly understood as a human right and a dimension of personal dignity, not merely a compliance obligation. And Utah’s governor signed a social media bill extending parental control rights over children’s access to social media through age 18 — broader than any other state, including time-of-day access restrictions and a requirement that social media companies give parents password access to monitor their children’s accounts. Age verification and identity complexity make enforcement challenging, and the state-by-state variation continues to create real implementation difficulty for industry.
Transparency vs convenience, FTC rulemaking, Utah kids online
- State Privacy LawsFTC EnforcementPrivacy Regulations
- Episode 7
- March 29, 2023
Stream this episode on
Summary
Transcript
**Jonathan:** Hey, Laura. How's it going? **Laura:** Hi, JJ. It's good to see you. **Jonathan:** Yeah. Good to see you too. So we'll see you next week. We're at IAB. We're at IAPP. **Laura:** Yeah. I'm looking forward to that. It's good to have friends in town. This weekend, we were overrun with tourists visiting cherry blossoms. They were in full bloom. It was gorgeous. It was like pre-COVID days. It was great. **Jonathan:** Oh, good. Nice. So look, I wanted to kick off event season for us, starting with the policy and legal summit next week. One of the issues we're grappling with on a panel that we're on is — and I'd love to get your perspective on this, Laura — how do you balance transparency and this drive for transparency and informed consent with compliance and convenience? What are some of the good ways that you've seen people do that? Or do you have a perspective on how do you get transparent? Because we're trying to balance transparency with convenience. And I don't think people want to say yes or no to every little thing. And I'm wondering if there's any guidance there that you've seen from the FTC or elsewhere. **Laura:** Right. No, I mean, it's such a good question, and we're seeing increased emphasis on that in the CPRA regulations elsewhere. And my observation — you know, just even thinking back to the Federal Trade Commission's 2012 privacy report and its emphasis there on things like just-in-time notices so that consumers could be making decisions in real time about the collection and use of their information — and balancing that with making decisions based on clear and conspicuous notice that is understandable, digestible, and balancing that in turn with that sense of over-notice so that consumers don't have notice fatigue. All of these are somewhat in tension, right? That we want consumers to have actionable information but not be faced with notice fatigue so that they're just clicking through without really understanding what they're reading. So this is a challenge for privacy practitioners to grapple with and something that hasn't really been solved for in the years that I've been practicing. And so it's something that we continue to struggle with. **Jonathan:** Do you think we're on the right track? I mean, when you think about GDPR and opt-in environments, it tends to move these privacy modals towards ticking yes or no on everything. With an opt-out environment that we're seeing more in the US, it seems to lend itself more to — hey, you can trust us — but you can trust us as a brand who's collecting and managing your data. We can come back anytime and opt out. I feel like it naturally gives us a head start on thinking about transparency with US consumers at least. Is that the right way to think about it? **Laura:** That's a really interesting perspective. I think that for brands — for publishers who execute correctly — that is the right way to think about it. But it does require that relationship of trust between the publisher and the consumer. And so publishers that execute well, that's exactly what happens. But we know from research that there can be mistrust, and so it really does require a well-done execution. **Jonathan:** Yeah, it gets me thinking about — after next Monday, we'll be at the IAPP's Global Privacy Summit. Thinking back to last year, when Lina Khan had her keynote, she talked about notice and consent being outdated models for privacy. And it had me thinking, well, what are the alternatives then? If notice and consent go away, what do you do instead? I think we're seeing some of that, right? Data minimization could be one of the ways to handle that. Another thing could be just restrictions on how you use certain data types, and when and where they can be used potentially. I mean, given what you've seen, Laura, and kind of your experience at the FTC — what could be those alternatives to notice and consent? **Laura:** No, that's right. I mean, I think from a public policy perspective, we see consensus — policy is moving away from just notice and choice towards substantive privacy rights. But under existing federal law, it's just tough to imagine how we get there. That said, the Federal Trade Commission in its Advanced Notice of Proposed Rulemaking that Chair Khan and the Democratic commissioners announced in August of 2022, they asked a number of questions trying to tease out where the agency could go with its MAGNUSON-MOSS rulemaking in pursuing a privacy rule under the FTC's rulemaking authority. And so it'll be interesting to see when the FTC issues its Notice of Proposed Rulemaking, where it's headed next in terms of substantive privacy rights — like the rights you mentioned, data minimization, etc. **Jonathan:** Got you. And then what's the tie in to MAGNUSON-MOSS? **Laura:** MAGNUSON-MOSS was the warranty legislation — that's the preempting — yeah. So there's a number of steps, and the FTC controls some of them, but some of them are out of the FTC's control. So, by way of example, the first step, of course, is publishing the ANPR. That's what came out in August of '22. And then subsequent to that, the agency would publish a Notice of Proposed Rulemaking seeking public comment on a rule text. So we haven't seen that yet. And then what would come next would be informal hearings followed by the publication of a final rule and then judicial review. And so there's a number of steps there. In the past, it's taken many years for those steps to all proceed in succession. There are folks at the Federal Trade Commission who believe that that timeline can be compressed significantly. And indeed, the FTC adopted some changes to its rulemaking in an effort to compress that timeline. But there are different schools of thought on just how much time those rule changes effectuated. **Jonathan:** Got you. Thanks, Laura. Yeah, looking forward to seeing those. The other session I'm really looking forward to at the IAPP Summit is Danielle Citron's presentation, which seems to be a theme. This idea that privacy is valued by individuals. How do we, as we embrace technology, ensure that privacy rights are maintained and people's data dignity is respected? Seems to be an ongoing theme. It wasn't a theme two, three years ago. I'm glad that it's kind of hitting the headlines now. What are your thoughts and perspectives on that? **Laura:** Well, let me just say at the outset that I am a huge fan of Professor Citron. I followed her work for a very long time. Just super excited for her in winning the MacArthur Award, and very excited that she moved over to the University of Virginia, my alma mater. And in terms of privacy and dignity in her work — it is interesting to see privacy evolve from something that was done sort of as an afterthought by legal departments to promote compliance and mitigate risk to something that is really a robust area of legal scholarship and thinking about it as a human right. And so, watching her field of study grow is something that is really rewarding as a practitioner and someone who's just thought about this for a while now. I'm looking forward to that talk. It gives us a really unique and valuable aspect to our work here in private practice. **Jonathan:** I love that. Yeah. So we talked last week about Iowa. Obviously, it's front of mind for a lot of folks. What's your read, Laura, on kind of what's happening in state legislation these days and what we need to keep an eye out for or think about? **Laura:** Yeah, well it's never dull. I'll say that. This week, there are many developments, but the one that I wanted to mention is Utah, where we saw the governor sign a bill related to social media that gives parents control over the social media activities of their children under the age of eighteen. And so while, of course, the Children's Online Privacy Protection Act provides certain safeguards for children under thirteen federally, and there are protections for children who are a bit older than thirteen in various states — this Utah social media bill provides protections to children up to eighteen in Utah that are far broader than we've seen in any other state. And it will be really interesting to watch Utah and its division of consumer protection implement this new law that the governor signed last week. It really presents some challenges in terms of state-by-state implementation of law that, again, is different state to state. We wrestled with that as industry when California passed CCPA, but this presents new challenges and it will be interesting to watch. **Jonathan:** What are those? **Laura:** I think we talked about this a couple weeks ago in a different context — this idea that how do you really — when we talked about it, we talked about children picking up an iPad. You don't really know that it's a kid, right? Unless you know there's a kid behind it. The identity issues are real. What are some of those challenges here with the social media role? Are they similar? Is it something different? **Jonathan:** Well, so different from an age-appropriate design code, this really has to do with social media as social media. And so, for example, there are limits to when social media for a child under the age of eighteen can be available in terms of hours of the day, and access that parents need — that social media companies need to provide to parents in the form of a password or its equivalent so that a parent can monitor posts. So it is just a different approach than other states have taken. **Laura:** Gotcha. Thanks, Laura. I appreciate this. Thanks for sharing your perspective. We'll see you next week. **Jonathan:** Wonderful to talk to you. Can't wait to see you in DC. **Laura:** Yes, same here. See you, Laura. Thanks.
Next step
See permissioning infrastructure in action
Walk through the platform with a Ketch architect, or launch the free CMP today.
Get started in less than 5 min