On September 19, the US Federal Trade Commission (FTC) published a comprehensive report that particularly scrutinizes the data collection and use of large social media and video streaming services. The conclusion of the competition and consumer protection authority: The USA urgently needs a national data protection law.
FTC report on data hunger of major social media platforms
The report is based on an investigation that began in December 2020, when the FTC ordered a total of nine large companies to provide comprehensive information about their data protection practices. The companies in question are as follows: Amazon (for the gaming platform Twitch), Facebook (now Meta Platforms), YouTube, Twitter (now X Corp.), Snap, ByteDance (for the video sharing platform TikTok), Discord, Reddit and WhatsApp.
The aim was to find out how these platforms collect, store and use data. It also investigated how the companies use demographic information for advertising purposes and what measures are taken to protect children and young people.
The report shows that many of these companies
- collect huge amounts of personal data. And not just from users, but also from non-users, often with the help of data brokers.
- store this data indefinitely without applying appropriate deletion policies.
- data on a large scale, which raises concerns about the protection of this information.
- fail to adequately protect children and young people by applying the same data protection standards as for adults.
- Use advertising tracking technologies to deliver targeted advertising based on interests and preferences.
According to the FTC report, it is alarming that many of the companies investigated did not respond appropriately to user requests for deletion. In addition, tracking technologies such as "pixels" are used to create extensive profiles for targeted advertising measures. Children and young people, who are particularly vulnerable, are often treated like adults and are not adequately protected, even though they are exposed to significant risks such as identity theft or damage to their mental health.
Companies should adapt their data protection practices
The findings of the report have far-reaching consequences for companies, particularly with regard to adapting their data protection practices and strategies.
- Stronger regulation and legal requirements
The report explicitly calls on Congress to pass a comprehensive national data protection law. Companies must expect that future laws will impose stricter requirements for data minimization and consumer data protection. This could significantly restrict companies' commercial use of data while imposing stricter liability and compliance obligations. - Restriction of data storage and forwarding
The FTC recommends that companies introduce clear guidelines on data minimization. This includes ensuring that data is only stored for as long as it is needed and that the scope of data collection is severely limited. Companies must review their storage practices and develop new measures to ensure that data is deleted at the end of its required useful life. - Restrict targeted advertising
The report criticizes the fact that the business model of many companies is based on the massive collection and monetization of user data through targeted advertising. Companies must be prepared for stricter regulations that could restrict the use of personal data for advertising purposes, especially in connection with sensitive information. - Greater control of algorithms and AI systems
The use of algorithms and artificial intelligence (AI) to process and analyze personal data was also critically examined in the report. Companies that rely on such technologies must expect stricter requirements for the transparency and control of these systems. It is expected that stricter testing and control mechanisms will be introduced to prevent misuse or misconduct by automated systems. - Improving the protection of children and young people
The FTC's criticism that companies treat children and young people in the same way as adults is particularly serious. Many companies rely on the fact that their platforms are not formally aimed at children. This allows them to avoid liability under the Children's Online Privacy Protection Act (COPPA). However, the FTC requires that companies recognize that children and young people use their platforms and protect them accordingly. In practice, this could mean that companies will have to take additional data protection measures for younger users and comply with stricter regulations on age restrictions and parental consent in the future. - Increased risk of market dominance
The report also points out that the mass collection of user data gives some companies a dominant market position. Companies that manage large amounts of data could be subject to greater competition control in the future, especially if this leads to distortions of competition and a restriction of consumer choice.
Reading tip: ECJ ruling on GDPR fines - what discretion does a data protection authority have?
Recommendations of the FTC
In its report, the FTC has formulated a series of recommendations for companies and legislators. The key points of these recommendations are
- The need for a comprehensive federal privacy law for the U.S.
- Companies should only store data for as long as necessary and pursue a clear and comprehensible data protection policy.
- The use of privacy-invasive technologies such as ad tracking should be significantly restricted.
- The protection of children and young people must go beyond the legal minimum, with a particular focus on the protection of privacy and mental health.
It is crucial for companies to adapt their data protection practices to these recommendations. And not only to avoid regulatory sanctions, but also to maintain consumer trust in an increasingly data protection-conscious society. Those who act now can already integrate future legal requirements into their corporate strategy and secure long-term competitive advantages.
English 
German 
Italian 
French