Privacy Law Commons^™

From Privacy To The Data Economy: The Ftc’S Reframing Of Its Regulatory Priorities, Maria P. Angel

Scholarly Works

This Article argues that the Federal Trade Commission’s turn to “commercial surveillance” reflects a strategic shift away from traditional privacy frameworks toward addressing structural power dynamics in the data economy. Drawing on an analysis of 112 FTC documents, it identifies three core commitments: tackling systemic harms, adopting a political economy lens, and constraining corporate power. The Article contends that this reframing is both necessary in the AI age and should influence the future of privacy regulation in the United States, even amid efforts to limit the FTC’s authority.

Target(Ed) Advertising, Derek E. Bambauer

UF Law Faculty Publications

Targeted advertising—using data about consumers to customize the ads they receive—is deeply controversial. It also creates a regulatory quandary. Targeted ads generate more money than untargeted ones for apps and online platforms. Apps and platforms depend on this revenue stream to offer free services to users, if not for their financial viability altogether. However, targeted advertising also generates significant privacy risks and consumer resentment. Despite sustained attention to this issue, neither legal scholars nor policymakers have crafted interventions that address both concerns, and existing regulatory regimes for targeted advertising have critical gaps.

This Article makes three key contributions to the …

Leading By Example: The Federal Trade Commission’S Leniency Sets A Low Bar For Children’S Data Privacy Standards, Alyssa Light

Mitchell Hamline Law Journal of Public Policy and Practice

No abstract provided.

An Impossible Task: Enforcing Disclosure Requirements In A Multi-Billion Dollar Industry, Keelin Ferris

Catholic University Journal of Law and Technology

Users of the first global social network, MySpace, could have never imagined that a mere twenty years later, teenagers could be millionaires making thirty-second videos out of their parents’ basement. Social media platforms have blossomed and advanced to an unpredictable level in a short amount of time. The growth of TikTok, surpassing one billion users, has been one of the most substantial contributors to the change in landscape.[1] In 2025, “social media influencers” come in all shapes and sizes.[2] Social media users can scroll through Instagram reels and stumble upon their fellow PTA member, co-worker, or grandmother promoting …

Data In Distress: Effectuating State Data Privacy Laws During Bankruptcy, Cameron Love

Emory Law Journal

In 2000, an online toy retailer, Toysmart.com, attempted to liquidate consumer data to pay creditors in its bankruptcy case. The attempted sale drew objections from the Federal Trade Commission and forty-seven state attorneys general. Five years later, Congress attempted to resolve privacy concerns in bankruptcy, amending the Bankruptcy Code to provide clear procedures for the liquidation of “personally identifiable information.” Recently, scholars have criticized these amendments, characterizing them as “limited,” “outdated,” and “privacy theater.” This Comment adds to these criticisms, arguing the amendments’ failure to mandate consideration of relevant nonbankruptcy law puts these permissive sales procedures on a collision course …

Individualized Ideological Enclosures: The Generative Ai Crisis And How Consumers Can Reclaim Their Feeds, Sydney Rose

Catholic University Journal of Law and Technology

No abstract provided.

Patching The Data Security Blanket: How A Stronger, Collaborative Ftc Is The Answer Right Under Our Nose, Jose A. Gonzalez Lopez

Marquette Intellectual Property & Innovation Law Review

None

Understanding American Privacy, Neil M. Richards, Andrew B. Serwin, Tyler Blake

Scholarship@WashULaw

This Article is an explanation of some of the key features of American privacy law for a general audience. In particular, it tries to explain American privacy law against the critique that because the US currently lacks a European-style privacy law, the United States lacks much in the way of privacy law. We argue that the lack of a European-style data protection law in the United States is not the end of the analysis. This article therefore offers a basic roadmap to American privacy law for the uninitiated. In order to understand American privacy, we believe that it is important …

Ai's Legitimate Interest: Towards A Public Benefit Privacy Model, Charlotte A. Tschider

Faculty Publications & Other Works

Health data uses are on the rise. Increasingly more often, data are used for a variety of operational, diagnostic, and technical uses, as in the Internet of Health Things. Never has quality data been more necessary: large data stores now power the most advanced artificial intelligence applications, applications that may enable early diagnosis of chronic diseases and enable personalized medical treatment. These data, both personally identifiable and de-identified, have the potential to dramatically improve the quality, effectiveness, and safety of artificial intelligence.

Existing privacy laws do not 1) effectively protect the privacy interests of individuals and 2) provide the flexibility …

Meaningful Choice: A History Of Consent And Alternatives To The Consent Myth, Charlotte A. Tschider

Faculty Publications & Other Works

Although the first legal conceptions of commercial privacy were identified in Samuel Warren and Louis Brandeis’s foundational 1890 article, The Right to Privacy, conceptually, privacy has existed since as early as 1127 as a natural concern when navigating between personal and commercial spheres of life. As an extension of contract and tort law, two common relational legal models, U.S. privacy law emerged to buoy engagement in commercial enterprise, borrowing known legal conventions like consent and assent. Historically, however, international legal privacy frameworks involving consent ultimately diverged, with the European Union taking a more expansive view of legal justification for processing …

The Missing Regulatory State: Monitoring Businesses In An Age Of Surveillance, Rory Van Loo

Faculty Scholarship

An irony of the information age is that the companies responsible for the most extensive surveillance of individuals in history—large platforms such as Amazon, Facebook, and Google—have themselves remained unusually shielded from being monitored by government regulators. But the legal literature on state information acquisition is dominated by the privacy problems of excess collection from individuals, not businesses. There has been little sustained attention to the problem of insufficient information collection from businesses. This Article articulates the administrative state’s normative framework for monitoring businesses and shows how that framework is increasingly in tension with privacy concerns. One emerging complication is …

Confiding In Con Men: U.S. Privacy Law, The Gdpr, And Information Fiduciaries, Lindsey Barrett

Seattle University Law Review

In scope, ambition, and animating philosophy, U.S. privacy law and Europe’s General Data Protection Regulation are almost diametric opposites. The GDPR’s ambitious individual rights, significant prohibitions, substantive enforcement regime, and broad applicability contrast vividly with a scattershot U.S. regime that generally prioritizes facilitating commerce over protecting individuals, and which has created perverse incentives for industry through anemic enforcement of the few meaningful limitations that do exist. A privacy law that characterizes data collectors as information fiduciaries could coalesce with the commercial focus of U.S. law, while emulating the GDPR’s laudable normative objectives and fortifying U.S. consumer privacy law with a …

Privacy Remedies, Lauren H. Scholz

Indiana Law Journal

When consumers sue companies for privacy-intrusive practices, they are often unsuccessful. Many cases fail in federal court at the motion to dismiss phase because the plaintiff has not shown the privacy infringement has caused her concrete harm. This is a symptom of a broader issue: the failure of courts and commentators to describe the relationship between privacy rights and privacy remedies.

This Article contends that restitution is the normal measure of privacy remedies. Restitution measures relief by economic gain to the defendant. If a plaintiff can show the likely ability to recover in restitution, that should be sufficient to pass …

The Future Of Facial Recognition Is Not Fully Known: Developing Privacy And Security Regulatory Mechanisms For Facial Recognition In The Retail Sector, Elias Wright

Fordham Intellectual Property, Media and Entertainment Law Journal

In recent years, advances in facial recognition technology have resulted in a rapid expansion in the prevalence of private sector biometric technologies. Facial recognition, while providing new potentials for safety and security and personalized marketing by retailers implicates complicated questions about the nature of consumer privacy and surveillance where a “collection imperative” incentivize corporate actors to accumulate increasingly massive reservoirs of consumer data. However, the law has not yet fully developed to address the unique risks to consumers through the use of this technology. This Note examines existing regulatory mechanisms, finding that consumer sensitivities and the opaque nature of the …

Data Protection In An Increasingly Globalized World, Nicholas F. Palmieri Iii

Indiana Law Journal

With the rise of the internet in recent decades, it has become increasingly easy for various enterprises—including retailers, advertising agencies, and service providers—to acquire, use, and even share the personal details of their users. Such a trend is unlikely to decrease in the coming years; in fact, internet usage is only likely to increase as more and more people gain access to the internet. In the wakeof recent data breaches, including the now infamous breach of Equifax as well as the scandal involving Facebook and Cambridge Analytica, people are even more aware of the need for (and the risk of …

Protecting Consumer Data Privacy With Arbitration, Erin O'Hara O'Connor

Scholarly Publications

No abstract provided.

The Tortoise And The Hare Of International Data Privacy Law: Can The United States Catch Up To Rising Global Standards?, Matthew Humerick

Catholic University Journal of Law and Technology

Technological developments spur the development of big data on a global scale. The breadth of data companies collect, maintain, process, and transmit affects nearly every country and organization around the world. Inherent to big data are issues of data protection and transfers to third countries. While many jurisdictions emphasize the importance of protecting consumer data, such as the European Union, others, like the United States, do not. To circumvent this issue, the United States and European Union contracted around data privacy standard discrepancies through the Safe Harbor Agreement, which eased cross-border data transfers. However, the Court of Justice of the …

Who Are The Real Cyberbullies: Hackers Or The Ftc? The Fairness Of The Ftc’S Authority In The Data Security Context, Jaclyn K. Haughom

Catholic University Law Review

As technology continues to be an integral part of daily life, there lies an ever-increasing threat of the personally identifiable information of consumers being lost, stolen, or accessed without authorization. The Federal Trade Commission (FTC) is the U.S. government’s primary consumer protection agency and the country’s lead enforcer against companies subject to data breaches. Although the FTC lacks explicit statutory authority to enforce against data breaches, the Commission has successfully relied on Section 5 of the FTC Act (FTCA) to exercise its consumer protection power in the data security context. However, as the FTC continues to take action against businesses …

Peeling Back The Student Privacy Pledge, Alexi Pfeffer-Gillett

Scholarly Articles

Education software is a multi-billion dollar industry that is rapidly growing. The federal government has encouraged this growth through a series of initiatives that reward schools for tracking and aggregating student data. Amid this increasingly digitized education landscape, parents and educators have begun to raise concerns about the scope and security of student data collection.

Industry players, rather than policymakers, have so far led efforts to protect student data. Central to these efforts is the Student Privacy Pledge, a set of standards that providers of digital education services have voluntarily adopted. By many accounts, the Pledge has been a success. …

The Price Of Free Mobile Apps Under The Video Privacy Protection Act, Suzanne L. Riopel

American University Business Law Review

No abstract provided.

Paying For Privacy And The Personal Data Economy, Stacy-Ann Elvy

Articles & Chapters

Growing demands for privacy and increases in the quantity and variety of consumer data have engendered various business offerings to allow companies, and in some instances consumers, to capitalize on these developments. One such example is the emerging “personal data economy” (PDE) in which companies, such as Datacoup, purchase data directly from individuals. At the opposite end of the spectrum, the “pay-for-privacy” (PFP) model requires consumers to pay an additional fee to prevent their data from being collected and mined for advertising purposes. This Article conducts a simultaneous in-depth exploration of the impact of burgeoning PDE and PFP models. It …

“Hello…It’S Me. [Please Don’T Sue Me!]” Examining The Fcc’S Overbroad Calling Regulations Under The Tcpa, Marissa A. Potts

Brooklyn Law Review

Americans have received unwanted telemarketing calls for decades. In response to a rapid increase in pre-recorded calls made using autodialer devices, Congress enacted the Telephone Consumer Protection Act (TCPA) in 1992. The TCPA imposes restrictions on calls made to consumers’ residences and wireless phones using autodialer devices, even if they are not telemarketing calls. Congress appointed the Federal Communications Commission (FCC) to prescribe rules and regulations to enforce the TCPA. In 2015, the FCC released an order that defined autodialer more broadly under the statute. Consequently, devices that have the potential to become autodialers in the future, even if they …

Schrems And The Faa’S “Foreign Affairs” Prong: The Costs Of Reform, Peter Margulies

Law Faculty Scholarship

No abstract provided.

Data Privacy Regulation In The Age Of Smartphones, Matthew Hettrich

Touro Law Review

No abstract provided.

Sacrificing Privacy For Convenience: The Need For Stricter Ftc Regulations In An Age Of Smartphone Surveillance, Ashton Mckinnon

Journal of the National Association of Administrative Law Judiciary

This comment aims to focus on the most frequently used connector that consumers treasure not only for convenience but also as a lifelong necessity - the smartphone. The FTC needs to enforce federally mandated guidelines that will allow the consumer to use technology without the technology using the consumer. Part II of this comment focuses on the type of information that can be collected by various companies, service providers, and agencies from an individual's smartphone, and the intentions of these collectors behind use of this information. Part III evaluates how applications (apps) contribute to this scheme, and, specifically, apps' recordkeeping …

The Internet Of Things And Wearable Technology: Addressing Privacy And Security Concerns Without Derailing Innovation, Adam D. Thierer

Richmond Journal of Law & Technology

The next great wave of Internet-enabled innovation has arrived, and it is poised to revolutionize the way humans interact with the world around them. This paper highlights some of the opportunities presented by the rise of the so-called Internet of Things (IoT) in general and wearable technology in particular and encourages policymakers to allow these technologies to develop in a relatively unabated fashion.

Wherever You Go, There You Are (With Your Mobile Device): Privacy Risks And Legal Complexities Associated With International ‘Bring Your Own Device’ Programs, Melinda L. Mclellan, James A. Sherer, Emily R. Fedeles

Richmond Journal of Law & Technology

The cross-use of mobile devices for personal and professional purposes—commonly referred to as “Bring Your Own Device” or “BYOD” for short—has created a new backdrop for doing business that was scarcely imaginable even ten years ago.

The Scope And Potential Of Ftc Data Protection, Woodrow Hartzog, Daniel J. Solove

Faculty Scholarship

For more than fifteen years, the FTC has regulated privacy and data security through its authority to police deceptive and unfair trade practices as well as through powers conferred by specific statutes and international agreements. Recently, the FTC’s powers for data protection have been challenged by Wyndham Worldwide Corp. and LabMD. These recent cases raise a fundamental issue, and one that has surprisingly not been well explored: How broad are the FTC’s privacy and data security regulatory powers? How broad should they be?

In this Article, we address the issue of the scope of FTC authority in the areas of …

Unfair And Deceptive Robots, Woodrow Hartzog

Faculty Scholarship

Robots, like household helpers, personal digital assistants, automated cars, and personal drones are or will soon be available to consumers. These robots raise common consumer protection issues, such as fraud, privacy, data security, and risks to health, physical safety and finances. Robots also raise new consumer protection issues, or at least call into question how existing consumer protection regimes might be applied to such emerging technologies. Yet it is unclear which legal regimes should govern these robots and what consumer protection rules for robots should look like.

The thesis of the Article is that the FTC’s grant of authority and …

Note, Institutionally Appropriate Approaches To Privacy: Striking A Balance Between Judicial And Administrative Enforcement Of Privacy Law, Lauren Henry Scholz

Scholarly Publications

No abstract provided.