Limits on Private-Sector Collection and Use of Data
The FTC's two theories
Section 5 deception requires a material representation or omission likely to mislead a reasonable consumer. Unfairness requires substantial injury that is not reasonably avoidable and is not outweighed by benefits to consumers or competition. The FTC typically obtains consent orders and can seek civil penalties for order or rule violations, not for every first-time Section 5 violation.
Sector statutes
GLBA covers financial institutions through the Privacy Rule and Safeguards Rule. HIPAA covers covered entities and business associates, with no private right of action. FCRA governs consumer reporting agencies, permissible purpose, and adverse action notices. COPPA requires verifiable parental consent for data from children under 13. TCPA, CAN-SPAM, VPPA, and ECPA regulate narrower collection or use.
Self-regulation and transfers
Industry principles from the Digital Advertising Alliance and Network Advertising Initiative shape ad-tech practices. After Schrems II invalidated Privacy Shield, transfers rely on standard contractual clauses or the Data Privacy Framework.
Traps
Do not assume the FTC Act creates a private right of action, that HIPAA has one, or that deception and unfairness are interchangeable. COPPA generally requires actual knowledge. Definitions of sale and sharing vary by regime.
Worked example
A fitness app says it will not share health data with advertisers, but a software kit does so. This is deception (a broken promise) and likely unfairness (sensitive data, harm not reasonably avoidable). Rule of thumb: deception equals a broken promise; unfairness equals unavoidable substantial harm.