New US FTC Commissioner Bedoya signals support for broad view of online privacy harms

The US Federal Trade Commission traditionally has been staffed by lawyers, economists and — more recently — by computer scientists who untangle the complex workings of online platforms. Alvaro Bedoya says the FTC needs to hire a new type of expert to study online harm: psychologists.

“We've got a CTO [Chief Technology Officer] and we've got top-flight engineers that can look at that, but there is not one full-time psychologist on staff,” the newest commissioner said, growing animated in a recent conversation. “And yet speak — speak! — to a parent of a child or a teenager and ask them what they're concerned about for their children. One of the themes is going to be what's happening to our children online.”

In one of his first one-on-one media interviews since joining the FTC, the first digital privacy expert to join the commission talked to MLex about topics ranging from his efforts to bolster internal communication at the agency to his view of the privacy risks of the metaverse, as well as the risks to children and teens from addictive algorithms driven by the collection of their personal data.

Bedoya, an influential privacy scholar and former US Senate staffer, joined the FTC in May as the third Democratic member of the five-member commission. Within the FTC, he's already acquired a reputation as a communicator, taking it upon himself to meet with a cavalcade of staffers over coffee during his first five months at the agency, particularly those in the Bureau of Competition who, in an annual survey, voiced significant morale issues.

Bedoya has reached across the aisle to build a relationship with Christine Wilson, currently the sole Republican on the commission and a sharp critic of Chair Lina Khan.

Are addictive algorithms really a privacy issue?

“This is how our brains work. I can't think of something more private,” Bedoya said. “If someone alleges that a technology or a product is harming their mental health in a way that is medically diagnosable, is that a health harm? Yes. Is that a privacy harm? I also think it's a privacy harm.”

Section 5 of the FTC Act, the agency’s primary enforcement tool, doesn’t contain the word “privacy,” he noted.

Flight to USA

Himself a parent of two young children, Bedoya said the FTC needs to better understand whether there are harms to children and teens  from the use of their personal data by social media platforms, and he said tech companies worried about regulatory risk are already hiring psychologists to answer that question. The Democratic commissioner gave credit to Republican US Representative Cathy McMorris Rodgers of Washington state, who is also one of the architects of the American Data Privacy and Protection Act, for the idea of adding child psychologists to the FTC staff.

It’s easy to see why people find Bedoya engaging. On a Zoom call, the commissioner beat a reporter to the first question and started asking with interest about the significance of personal items he could see in the background in the reporter’s home office.

In a recent stream of emotional Tweets, Bedoya posted a photo of two spoons his mother got permission to keep on the Lufthansa flight to the US when his family emigrated from their native Peru in the 1980s. The Bedoya family wasn’t sure they would have utensils in their new home.

“Why share this? Because it's been 35 years, and I am filled with gratitude at everything this country has given me,” tweeted the commissioner, who grew up in upstate New York. “I spend a lot of time thinking about my mother, who changed professions, raised two boys mostly by herself for many years when my dad moved away for work, who made us fiercely proud of who we were even though to most people's eyes we didn't have terribly much.”

Location, location, location

In his early speeches and statements as an FTC commissioner, Bedoya has signaled he will take a broad view of privacy, and that its regulation must go beyond governing the consensual collection of personal data to consider how it's processed, shared and commercialized. For a century, that broader view has been part of American legal thought about privacy, he argued in a speech in September before the National Advertising Division's annual conference — perhaps not the friendliest audience for such a view.

“There’s a famous saying about the Fourth Amendment, that it protects people, not places. I think that privacy protects people, not data,” Bedoya said in that speech. “And as the FTC considers rules to rein in prevalent unfair and deceptive trade practices, we would be remiss, in light of this longstanding policy, and long history, not to ask questions about all harms from unfair and deceptive practices online.”

In the same NAD speech, Bedoya said he was concerned about the “woefully unprotected” state of geolocation data because of the ways it can reveal the most intimate details of a person’s life. Formerly the first chief counsel to the US Senate Judiciary Subcommittee on Privacy, Technology and the Law after its founding in 2011, Bedoya told MLex that even in that job a decade ago, the FTC was telling Congress that consumers should have the right to give affirmative consent before their location is collected and shared.

More than a decade later, that has yet to fully happen in the US. “The Commission's interest in [location data] should surprise no one,” Bedoya told MLex.

“We have an almost entirely unregulated open market for this information,” he added. “I am most interested in the information when it is not secured appropriately, when it is being loosely given away or sold with little to no protection for how it will be used, or to whom it is being sold. . . . I'm particularly interested in instances where it is being used by parties downstream from the point of initial collection, where I think there's a particularly strong argument that [potential harm] is not reasonably avoidable by consumers.”

A key example of what Bedoya hopes will be a continued focus by the FTC on location data is the agency’s recently filed lawsuit against Kochava, an Idaho data broker the FTC says committed violations of the prohibitions against “unfair” conduct in Section 5 through the sale of consumers’ location data.

“I do think it's really important we brought that case. I think it is a solid case. I don't know if I see it as a template. But I do think that the business community should understand that we're serious” about giving US consumers more control over the use of location data, Bedoya said.

After leaving the Senate, where he was also chief counsel to Senator Al Franken of Minnesota, an early and vocal advocate of tighter privacy rules, Bedoya became the founding director of the Center on Privacy and Technology at Georgetown University, where he authored an influential paper on facial recognition in 2016.

As technology evolves, Bedoya said the FTC will need to consider holistically how people might be harmed by it. That is behind his call for staff psychologists at the FTC. What about the metaverse, Meta Platforms’ CEO Mark Zuckerberg’s vision for how people will soon interact using virtual or augmented reality devices and apps?

“The interesting thing about the metaverse is that there is nothing that is not quantified within it. Right? Because it's an entirely synthetic world, every aspect of it is by necessity measured and tracked,” Bedoya said. “So it’s not like when I go about my daily life, aspects of it generate data and aspects of it don’t. Every single thing within the metaverse generates data.”

Could the mental health concerns for children and teens for the fully immersive metaverse be even more significant, Bedoya wondered, than the current problems some children have in differentiating between the physical world and the two-dimensional Internet. “How does a developing brain adjust to such an enveloping reality?” he said.

Bipartisan alliance

Location data like that at issue in the Kochava case is a key input to target advertising. An expert witness for the Office of the Arizona Attorney General in its now settled litigation against Google estimated that 95 percent of Google’s ad revenue is tied to location data. Google disputed that number, but not the central role location data has in targeting ads.

As the FTC leans into its privacy rulemaking process, Bedoya says he believes there will always be a way to provide targeted advertising legally — if adults give informed consent. As public comments continue to flow into the FTC for its privacy rulemaking process, Bedoya is carefully reading and thinking about what those disclosures say about how the ad-tech industry works.

“There's a way to do it, a way to protect privacy,” Bedoya said of targeted ads. “Are industry practices squarely in line with that? I don't know. And that's something I think we're trying to find.”

The Kochava case was also significant in that it drew the support of a Republican commissioner, Wilson, for a case that relies exclusively on the unfairness prong of Section 5. Despite the more politicized culture of the FTC over the past year, Bedoya sees his Republican counterpart as an important ally on privacy.

Bedoya reached out to Wilson the same day he was nominated to a seat on the FTC. “I want to work with you on privacy,” he told her. Since joining the agency in 2018, Wilson has been an important voice on privacy, even amid her skepticism about the Democrats’ plan for a wide-spectrum rulemaking effort.

As with the other commissioners, Bedoya and Wilson do a weekly call, where they frequently focus on children’s privacy and other data protection issues. “I know some folks on the outside were surprised by that vote,” Bedoya said of Wilson’s backing to sue Kochava. “I wasn’t.”

Wilson has also been a pointed critic of Khan’s treatment of staff, saying in June that Khan “has shown nothing but disdain” for senior staffers.

Bedoya declined to discuss what he’s hearing back from staff about the morale issue, which focused on their view of the FTC’s senior leadership.

“The chair is working on this and cares a lot about it,” Bedoya said. “But absolutely, part of those visits was, particularly the competition shops, was trying to figure out what's behind the morale issues.”

But the coffee conversations with staff, Bedoya said, have confirmed his feeling after 169 days that he has “a dream job” at the FTC, something he never could have conjured on that flight from Lima to JFK Airport 35 years ago.

“These are folks who could go work for private industry any day of the week and make two times what they make — no problem. And they stay where they are doing the work they do . . . because they want to help people,” Bedoya said. “I feel profoundly lucky to be here. And those visits only reinforced that.”