A Law and Economics Approach to Privacy Policy Misstatements: Considering the Need for a Cost-Benefits Analysis in the FTC's Deception Framework

Abstract

It is said that today’s world is shaped by technology and fueled by information. Technological innovations such as mobile phones, audio and video recording devices, and computers, as well as the Internet and the rise of Big Data, have revolutionized our ability to capture, analyze, and share information. Further, information is undoubtedly critical to the economy. When readily available, consumer information enables businesses to “deliver the right products and services to the right customers, at the right time, more effectively and at a lower cost.” It also enhances customer convenience, improves service quality, and allows businesses to target those likely to be interested in the goods and services they offer, reducing waste and the need for mass advertising. Indeed, information about consumer needs and preferences is said to be “the cornerstone of any system that allocates goods and services within an economy.” As more information about consumers becomes available, the economy can more accurately and efficiently meet their needs and preferences.But many privacy advocates argue that the technological revolution that started in the twentieth century and continues today has caused a rapid erosion of personal privacy. Without a doubt, more personal information is readily available today than at any other point in mankind’s history. One proposal to stop this erosion is to stop the avalanche of technology and commercial opportunity responsible for it by intervening in the market for privacy by increasing the cost of consuming other people’s privacy and lowering the profits of voluntarily giving up one’s own privacy. Others argue for a less paternalistic approach, such as an increased emphasis on privacy-enabling technologies like encryption or a greater effort to obtain prior informed consent from consumers. Irrespective of the framing of the issue and the various proposed solutions, most privacy scholars agree that “the collection and use of personal data by businesses and government is spinning out of control.” While merchants that collect, use, store, and share consumer information are not specifically regulated under federal law, they are nevertheless regulated by the Federal Trade Commission (FTC), which has power under Section 5 of the Federal Trade Commission Act to sanction businesses that engage in deceptive or unfair acts or practices in relation to their collection and use of consumer data. But some have called into question the FTC’s method for determining whether to bring a Section 5 enforcement action, arguing for “a deeper integration of economics and cost-benefit analysis” into the FTC’s consumer protection framework. They argue that “[a]n economic approach to privacy regulation [should be] guided by the tradeoff between the consumer welfare benefits of new and enhanced products and services against the potential harm to consumers, both of which arise from the same free flow and exchange of data.” This Essay examines calls for the integration of economic considerations into the FTC’s Section 5 framework. It does so by applying law and economics analysis to the FTC’s recent enforcement action against retail analytics provider Nomi Technologies for a privacy policy misstatement. In Part II, the Essay sets the stage by providing a brief summary of the current state of consumer privacy law and explaining how the FTC became the predominant consumer privacy watchdog in the United States. Part III cites calls for increased economic considerations to temper the FTC’s power and distinguishes the two means through which the FTC may sanction privacy violations — unfairness and deception. Part IV discusses Nomi’s data collection practices and its settlement with the FTC. The Essay proceeds to the law and economics analysis in Part V, using both rational and behavioral models to determine whether the FTC’s deception framework produces economically efficient outcomes in the context of privacy policy misstatements and to recommend efficiency-promoting improvements to that framework.