A Federal Trade Commission staff report takes aim at social media and video stream companies’ data collection practices and data protection measures.

Social media, and Big Tech in general, have increasingly been in the spotlight for how they collect and monetize user data. While it’s been well known that social media companies do this, recent revelations have revealed just how much these companies surveil users, with the FTC report shedding light on video streaming services’ practices as well.

Listen to our deep dive into the not-so-secret world of shady data collection! FTC takes aim!

“The report lays out how social media and video streaming companies harvest an enormous amount of Americans’ personal data and monetize it to the tune of billions of dollars a year,” said FTC Chair Lina M. Khan. “While lucrative for the companies, these surveillance practices can endanger people’s privacy, threaten their freedoms, and expose them to a host of harms, from identify theft to stalking. Several firms’ failure to adequately protect kids and teens online is especially troubling. The Report’s findings are timely, particularly as state and federal policymakers consider legislation to protect people from abusive data practices.”

The report found the platforms in question use a variety of tactics to collect “troves of data” on “both users and non-users of their platforms.” Practices included getting data from data brokers, not just from the companies’ own platforms.

To make matters worse, the report found serious issues with how companies handle the data they collect, noting “that the companies’ data collection, minimization and retention practices were “’woefully inadequate.’”

The staff report also found that the business models of many of the companies incentivized mass collection of user data to monetize, especially through targeted advertising, which accounts for most of their revenue. It further noted that those incentives were in tension with user privacy, and therefore posed risks to users’ privacy. Notably, the report found that some companies deployed privacy-invasive tracking technologies, such as pixels, to facilitate advertising to users based on preferences and interests.

Additionally, the staff report highlighted the many ways in which the companies fed users’ and non-users’ personal information into their automated systems, including for use by their algorithms, data analytics, and AI. The report found that users and non-users had little or no way to opt out of how their data was used by these automated systems, and that there were differing, inconsistent, and inadequate approaches to monitoring and testing the use of automated systems.

The report also found significant issues with how companies handle data pertaining to children and teens, concluding there are not enough safeguards in place.

Furthermore, the staff report concluded that the social media and video streaming services didn’t adequately protect children and teens on their sites. The report cited research that found social media and digital technology contributed to negative mental health impacts on young users.

Based on the data collected, the staff report said many companies assert that there are no children on their platforms because their services were not directed to children or did not allow children to create accounts. The staff report noted that this was an apparent attempt to avoid liability under the Children’s Online Privacy Protection Act Rule. The staff report found that the social media and video streaming services often treated teens the same as adult users, with most companies allowing teens on their platforms with no account restrictions.

Ultimately, the FTC’s report is non-binding, with no immediate impact on the companies being studied. Nonetheless, the agency makes a number of recommendations, including two that could ultimately have a profound impact on the above companies.

• Congress should pass comprehensive federal privacy legislation to limit surveillance, address baseline protections, and grant consumers data rights.
• Congress should pass federal privacy legislation to fill the gap in privacy protections provided by COPPA for teens over the age of 13.

In addition, the FTC wants companies to take voluntary measures to limit data collection and protect user privacy.

• Companies should limit data collection, implement concrete and enforceable data minimization and retention policies, limit data sharing with third parties and affiliates, delete consumer data when it is no longer needed, and adopt consumer-friendly privacy policies that are clear, simple, and easily understood;
• Companies should not collect sensitive information through privacy-invasive ad tracking technologies;
• Companies should carefully examine their policies and practices regarding ad targeting based on sensitive categories;
• Companies should address the lack of user control over how their data is used by systems as well as the lack of transparency regarding how such systems are used, and also should implement more stringent testing and monitoring standards for such systems; Companies should not ignore the reality that there are child users on their platforms and should treat COPPA as representing the minimum requirements and provide additional safety measures for children;
• The Companies should recognize teens are not adults and provide them greater privacy protections.

Unfortunately, unless Congress tackles the first two items, there is virtuall no chance companies will voluntarily address the remaining items.

Thanks to the FTC’s report, however, users at least have a much clearer picture of how their data is being collected and retained.