The US Federal Trade Commission is “studying” social media’s use of private data. The agency seems particularly interested in how data is used for advertising—especially the data of minors.
It’s a bipartisan FTC study, but its timing is notable, with Washington prepping President #46. Does it herald a new era of regulation for apps and platforms?
And if so, what about yours? In this week’s Security Blogwatch, we look ahead.
Your humble blogwatcher curated these bloggy bits for your entertainment. Not to mention: Better Days time lapse.
Zeitgeist tipping point?
What’s the craic? Lauren Feiner reports—FTC orders Amazon, Facebook and others to explain how they collect and use personal data:
Amazon, TikTok owner ByteDance, Discord, Facebook and its subsidiary WhatsApp, Reddit, Snap, Twitter and Google-owned YouTube were each sent orders to hand over information about their data practices. The companies have 45 days to respond.
…
The agency is [also] seeking information about how they determine which ads to show their users, whether algorithms or data analytics are used on personal information, how they “measure promote, and research” engagement from users and how their data practices impact children. … The FTC filed charges last week against Facebook alleging the company has unlawfully maintained a monopoly in personal social networking services.
And Chris Mills Rodrigo adds—FTC opens privacy study:
The orders … do not implicate any legal wrongdoing. [But] the FTC often uses this kind of study to gather data that can then be used for potential enforcement action.
…
Commissioners Rohit Chopra (D), Rebecca Kelly Slaughter (D) and Christine Wilson (R) said … the study “will lift the hood on the social media and video streaming firms to carefully study their engines. … As concerns mount regarding the impact of the tech companies on Americans’ privacy and behavior, this study is timely and important.”
But FTC commissioner Noah Joshua Phillips (R) isn’t so chipper—Dissenting Statement:
The 6(b) orders are … an undisciplined foray into a wide variety of topics, some only tangentially related to the stated focus. [They] trade a real opportunity to use scarce government resources to advance public understanding of consumer data privacy practices … for the appearance of action.
…
Congress intended the Commission to execute its Section 6 authority to serve the public interest. … With that authority comes the responsibility to exercise it in a manner designed to serve those functions. … I do not think today’s action lives up to that tradition.
Interesting timing, thinks jkav13, with the Electoral College electing to elect the president-elect: [You’re fired—Ed.]
Is anyone else surprised that this is only getting kicked off now, in the last waning days of the Trump administration?
But taustin thinks not:
The new administration will very openly and publicly kill this investigation by the end of January—if only because if they don't, those same platforms will be against them next time around.
I think AaronMK speaks for many, when he says:
This is at least 15–20 years too late. Using trackers to mine all of the browsing habits of a person has never been something that any reasonable person would think is okay to do, outside a warranted wiretap, and it is about time our laws finally caught up with this very basic principle.
And what’s the FTC going to do with all that data? WolfgangVL reckons he knows:
They no longer need a paper-trail. There no longer needs to be any even fake oversight.
This data is now de-facto property of Uncle Sam, and will be combined with every other database and provide a … political and social profile on every American without even fake lip-service oversight. It's not like we had been in great shape before, but now they have everything, even the stuff they didn't even know they wanted, and it comes with no oversight, no auditability, and in the end, very little accountability for the companies doing the collection in the first place.
But wait! There’s more. Sebastian Payne and Tim Bradshaw note that other regulators are flexing their muscles—Tech companies face multibillion … UK fines over harmful content:
The UK will target the world’s biggest tech companies with … fines if they fail to rapidly remove illegal and harmful content from their platforms. … New “duty of care” requirements for platforms … will require the companies to “remove and limit the spread of illegal content” including child sexual abuse and terrorist material.
…
Ofcom, the UK’s independent media regulator, will enforce penalties for tech companies of up to [$25m], or 10 per cent of annual global turnover, whichever is higher. … Ofcom will also have the power to block non-compliant services from the UK and to impose criminal sanctions against senior managers.
And slightly further afield. Natalia Drozdiak notes—Tech Firms Risk Fines of 10% of Sales in EU:
Tech giants deemed to be gatekeepers could face fines as high as 10% of annual revenue if they don’t comply with new European Union rules on data usage. … The new Digital Markets Act will target “gatekeeper” firms, defined [by] criteria including the number of users in the millions and overall revenue in the billions of dollars, as well as their significant impact on the single market.
…
The EU will also propose separate rules that will force greater responsibility on platforms for what users post on their sites, threatening fines as high as 6% of global revenue. … The EU’s plans come as regulators around the world are bearing down on tech giants, which they see as having become too big, too powerful and too profitable.
Meanwhile, domikai sounds slightly cynical:
Interesting. [But] I'm guessing deployers of bull**** everywhere will rise up against this intrusive … something something.
The moral of the story?
The Washington winds are a-changin’. Is your app next for scrutiny?
And finally
Hat tip: Mark Frauenfelder
You have been reading Security Blogwatch by Richi Jennings. Richi curates the best bloggy bits, finest forums, and weirdest websites … so you don’t have to. Hate mail may be directed to @RiCHi or sbw@richi.uk. Ask your doctor before reading. Your mileage may vary. E&OE. 30.
This week’s zomgsauce: Cristián Molina (cc:by-nd)
Keep learning
Learn from your SecOps peers with TechBeacon's State of SecOps 2021 Guide. Plus: Download the CyberRes 2021 State of Security Operations.
Get a handle on SecOps tooling with TechBeacon's Guide, which includes the GigaOm Radar for SIEM.
The future is security as code. Find out how DevSecOps gets you there with TechBeacon's Guide. Plus: See the SANS DevSecOps survey report for key insights for practitioners.
Get up to speed on cyber resilience with TechBeacon's Guide. Plus: Take the Cyber Resilience Assessment.
Put it all into action with TechBeacon's Guide to a Modern Security Operations Center.
