The FTC's Proposed Framework for Privacy Protection Online: A Move Toward Substantive Controls or Just More Notice and Choice

Abstract

This article argues that the FTC, and Congress if necessary, should recognize that a notice and choice approach to privacy protection is not likely to protect consumer interests in most modern day settings. Indeed, policy makers may be doing more harm than good by continuing to focus on notice and choice, thereby giving a misleading impression that privacy is being protected when it is not. Moreover, by adhering to a notice and choice regime, they avoid discussing the more difficult yet most fundamental questions in the privacy debate. Under what circumstances is data collection likely to harm individuals, and when is it benign? If a practice is reasonably likely to cause harm, what is the most effective way to prevent the harm from occurring? Even if data collection causes no direct harm, should it still be limited if it undermines other values, such as personal autonomy, or should we just accept that our lives are increasingly an open book?