"Social media and online video firms are conducting ‘vast surveillance’ on users, FTC finds", 19 September 2024

Social media and online video companies are collecting huge troves of your personal information on and off their websites or apps and sharing it with a wide range of third-party entities, a new Federal Trade Commission (FTC) staff report on nine tech companies confirms.

The FTC report... looked at the data-gathering practices of Facebook, WhatsApp, YouTube, Discord, Reddit, Amazon, Snap, TikTok and Twitter/X between January 2019 and 31 December 2020. The majority of the companies’ business models incentivized tracking how people engaged with their platforms, collecting their personal data and using it to determine what content and ads users see on their feeds, the report states.

The FTC’s findings validate years of reporting on the depth and breadth of these companies’ tracking practices and call out the tech firms for “vast surveillance of users”. The agency is recommending Congress pass federal privacy regulations based on what it has documented. In particular, the agency is urging lawmakers to recognize that the business models of many of these companies do little to incentivize effective self-regulation or protection of user data.

“Recognizing this basic fact is important for enforcers and policymakers alike because any efforts to limit or regulate how these firms harvest troves of people’s personal data will conflict with their primary business incentives,” FTC chair Lina Khan said in a statement.

The FTC is also asking that the companies mentioned in the report invest in “limiting data retention and sharing, restricting targeted advertising, and strengthening protections for teens”.

...

Whatever product was in use, it was not easy to opt out of data collection, according to the FTC. Nearly all the companies said they fed personal information to automated systems, most often to serve content and advertisements. On the flipside, almost none of them offered “a comprehensive ability to directly control or opt-out of use of their data by all Algorithms, Data Analytics, or AI”, per the report.

Several firms say it’s impossible to even compile a full list of who they share your data with. When the companies were asked to enumerate which advertisers, data brokers or other entities they shared consumer data with, none of these nine firms provided the FTC with a full inventory.

The FTC also found that despite evidence that children and teens use many of these platforms, many of the tech companies reported that, because their platforms are not directed at children, they do not need different data-sharing practices for children under 13 years of age. According to the report, none of the companies reported having data-sharing practices that treated the information collected about and from 13- to 17-year-olds via their sites and apps differently than adult data, even though data about minors is more sensitive.

The FTC called the companies’ data-minimization practices “woefully inadequate”, finding that some of the companies did not delete information when users requested it. “Even those Companies that actually deleted data would only delete some data, but not all,” the report stated.

Some of the firms have disputed the report’s findings. In a statement, Discord said the FTC report was an important step but lumped “very different models into one bucket”.

A Google spokesperson said the company had the strictest privacy policies in the industry.

The other firms either did not provide an on-the-record comment or did not immediately respond to a request for comment.

However, if companies dispute the FTC’s findings, the onus is on them to provide evidence, says the Electronic Privacy Information Center (Epic), a Washington DC-based public interest research organization focused on privacy and free speech.