Online companies – ranging from those providing social media platforms, to consumer goods and other sales and services – collect troves of private demographic and behavioral data about us all. The ways companies collect and leverage that data vary. In many instances, the data collected allows companies to use it to target us with ads, recommendations, and other content based on our perceived interests and vulnerabilities. These practices have been well-documented [3].

That data collection is pervasive, and in numerous instances also invasive and extractive. Years of research, investigative journalism, activism and whistleblower revelations have illuminated that the companies collecting that data have little to no accountability to the American people. Indeed they have failed outright at fulfilling even the most basic requests for transparency about how their systems work, what they know about us, and the methods for collecting and storing data collected from their own users or acquired on other individuals with whom the company has no customer relationship. They haven’t even attempted to redress the harms caused by their business models, which promote content to maximize engagement and profit handsomely from amplifying conspiracy theories and bigotry [4].

In response to ANPR Questions 3, 7, 43, 47, and 51, the FTC’s rulemaking efforts should focus on deterring the harms that companies employing these data practices knowingly and negligently cause. Companies need to disclose not just what information they collect, but where they get the information; who shares data with them, and with whom they share data; how they analyze data to profile us; how else they use our information; how they make decisions about what content, goods or services to offer us; and how they secure our data.

Additionally, new rules should include prohibitions on harmful and unnecessary data collection and use. Users shouldn’t have to waive our privacy, quality of service, or other rights by surrendering unnecessary data just to access a given service when there’s no need for that extraneous data to deliver the promised service.

To date, we know that tech companies have facilitated, profited from and sometimes even participated in activities that harm our democracy and voting rights, public health and safety, and other civil and human rights. Digital discrimination and digital redlining are particularly troublesome, meaning “the creation and maintenance of technology practices that further entrench discriminatory practices against already marginalized groups” [5]. Digital redlining includes social media advertising that intentionally targets, or excludes information and opportunities from, members of protected classes in a harmful and discriminatory fashion.

Through the use of discriminatory algorithms and other machine learning which segments online users, digital discrimination causes harm similar to offline discrimination [6]. Civil rights laws have long proscribed discriminatory advertising that makes it harder for some classes to access opportunities. Such discrimination causes both economic and stigmatic harms as the barriers created by disparate and discriminatory treatment do not allow those targeted to “compete on equal footing” [7]. The FTC has also found that digital redlining, including the use of “racially biased algorithms,” constitutes an unlawful unfair or deceptive practice [8].

Algorithms make inferences about users to create efficiencies. The data that allows algorithms to make inferences – data about our geography, location history, employment history, credit history – is built on decades of institutionalized discrimination and segregation. Ultimately, the algorithms mistake this history for user preference, giving different consumers different (and inequitable) experiences and content. Thus, the impact of these methods is not abstract. They have real-world, civil rights consequences. To cite a few of the most prominent examples:

• In the healthcare realm: Researchers from the University of California found that an algorithm widely used in U.S. hospitals to allocate healthcare to patients systematically discriminated against Black people, who were less likely than equally sick white counterparts to be referred to hospitals [9].

• Dangerous COVID-19 and vaccine conspiracy theories have proliferated over social media, exacerbating the public health crisis, impacting our hospitals and leading to far more death and serious illness than might otherwise have occurred. On Facebook, African Americans, Native Americans, Latinx people and other people of color were less likely to be shown credible public health information than white people [10].

• Twitter and Meta have consistently failed to remove or flag as false content that discourages people from voting [11]. This content includes deception (lying about the time, place, and manner of voting); calls for boycott from individuals with alleged sponsorship ties to foreign state actors; and voter intimidation or threats, such as claims that people will show up to polling locations with guns [12].

• Voter suppression campaigns over social media included surgical efforts to dissuade Black, Indigenous, and Latinx voters from turning out to the polls. False election and polling messages in non-English languages were much less likely to be taken down or flagged than similar messages in English [13]. Non-partisan organization Protect Democracy found that “[s]ocial media platforms were plagued by false content about various candidates for office, patently untrue information about electoral processes, systematic efforts to amplify bogus claims about voter fraud, and coercive political messaging tied to COVID-19 conspiracy theories. A great deal of this content targeted marginalized communities and, in particular, communities of color” [14].

• Internal Meta research from 2019 brought to light by whistleblower Frances Haugen found that there was a concerted effort to discourage Latinx people from participating in the U.S. Census [15]. The company’s research summarized posts “telling Hispanic[s] to not fill out the form; telling Hispanics not to participate in answering questions about citizenship; saying that people would be in danger of being deported if they participated; implying the government would ‘get’ immigrants who participated; and discouraging ethnic groups from participating” [16].

• Meta has allowed alleged discriminatory employment ad targeting on the basis of gender and age [17].

• Meta recently settled a lawsuit with the Department of Justice regarding its housing advertising scheme, based on evidence that it engaged in discriminatory practices that meant Black users saw fewer or no ads for affected housing on Facebook [18].

• Google’s algorithms drive discriminatory search results, pushing users to image search results that under-represent women and women of color [19]. Research from 2018 showed its search terms related to Black girls mostly led to pornography, even when terms like “‘porn,’ ‘pornography,’ or ‘sex’ were not included in the search box” [20].

In response to Questions 3, 7, 65 - 70, and 92, the FTC’s rulemaking should include requirements for companies to conduct ongoing and regular company auditing of their algorithmic impact on consumers. New trade rules should also incentivize all companies to invest in compliance with civil rights statutes by affirming that their algorithms do not discriminate against consumers. The FTC may work in collaboration with other federal agencies to pursue compliance with civil rights and other federal statutes, including but not limited to the Department of Justice, Health and Human Services, Domestic Policy Council, and more.

Where companies are found to be engaging in discrimination, pursuant to the FTC Act, the FTC should impose civil penalties for first-time violations because such discriminatory commercial practices cleary constitute and should be readily understood as “unfair . . . acts or practices in or affecting commerce” under Section 5.

As discussed above in both Parts I and II, the ways that companies use, analyze, sell, and retain consumer data have invasive, discriminatory real-world consequences. The United States also currently has no comprehensive legislation guaranteeing consumers information, notice, consent, and other insights into how their data is used by companies. That means there is no effective limit on companies’ ability to continue extractive practices by which they gather consumer information, retain it without proper security mechanisms, and even sell troves of it to government, data brokers, and other actors often without our knowledge or consent.

While it is necessary to promulgate new regulations that address companies’ practices once data has been collected (see Part I) as well as mitigating measures to stem the harms of digital and algorithmic redlining (see Part II), so too is it necessary for companies to provide information to people about the data practices companies engage in. These efforts relate to Questions 73, 89, and 90. Through this process, companies should allow people opportunities to minimize and tailor the information collected on them, and to opt-out of companies’ collection and retention of their data altogether.

New trade regulation rules also must consider the languages used by consumers and require companies to provide information to consumers in the language they use through any company site, app, or service. The rules should also require companies to provide plain-speak language on companies’ data practices and consumers’ opt-out opportunities. The design elements of these notice and opt-out/tailoring mechanisms should be clean, with as few steps for consumers to reach critical information and opt-out processes as possible.