FTC’s Khan warns tech industry that agency will strictly enforce AI data privacy

Artificial intelligence tools will be vigorously regulated by the Federal Trade Commission (FTC), with an eye on consumer privacy, its Chair Lina Khan told an audience of tech executives and startup founders at a conference Tuesday.

“We’re crafting easily administrable remedies with bright-line rules on the development, use and management of AI inputs,” Khan said during a speech. “That means making clear that some data, particularly peoples’ sensitive health data, geolocation data and browsing data is simply off limits for model training.”

Khan said the agency’s enforcement actions will make clear that “there is no AI exemption” from existing laws.

“Firms cannot use claims of innovation as cover for law breaking,” Khan added.

Referring to how behavioral advertising has sometimes fueled companies’ abuse of private data, Khan said AI model training is “emerging as another feature that could further incentivize surveillance.”

The agency is closely watching how companies notify consumers if they want to use data they have already collected in another capacity to train AI, Khan said, emphasizing that firms must “actively notify users of this change rather than quietly and retroactively rewriting their terms of service.”

The FTC recently announced a string of settlements with companies it alleges improperly used consumers' health, geolocation and browsing data.

Last week, the agency announced that Avast Limited will pay $16.5 million and no longer be permitted to sell or license web browsing data to advertisers after an investigation revealing the company and its subsidiaries allegedly peddled aggregated, re-identifiable browsing data to third parties on a massive scale, usually without alerting consumers.

Two data brokers were penalized for selling geolocation data to advertisers last month with the FTC alleging the companies amassed and sold the data without adequately informing consumers or obtaining their consent. The settlements cracking down on the sale of geolocation data were unprecedented for the agency.

Last March, in one of a string of health privacy settlements, the online counseling service BetterHelp, Inc. agreed to pay $7.8 million for allegedly sharing information about consumers’ mental health difficulties with third parties, including Facebook and Snapchat, for advertising purposes.

Khan’s speech Tuesday reflected the increasingly aggressive FTC approach to regulating technology companies’ treatment of consumer privacy.

“We're looking at how business models can create and drive incentives,” Khan said. “Our remedies are making clear that the drive to refine algorithms cannot come at the expense of people's privacy or security.”