In a policy speech that signaled the US Federal Trade Commission’s return to “not stretching our legal authorities,” Commissioner Melissa Holyoak unveiled the Republican majority’s data privacy vision to bolster technology innovation while protecting the online safety of minors.
In a policy speech that signaled the US Federal Trade Commission’s return to “not stretching our legal authorities,” Commissioner Melissa Holyoak unveiled the Republican majority’s data privacy vision to bolster technology innovation while protecting the online safety of minors.In an address to the world’s largest annual gathering of privacy professionals* where she subbed in for FTC Chairman Andrew Ferguson, Holyoak declared that “I love privacy.” But she also said the FTC must weigh privacy harms to consumers against the benefits of innovation and flexibility in the development of artificial intelligence and other digital technologies. The US needs to ensure enforcement and regulations continue to allow the digital economy to grow because US “leadership in digital technologies, including artificial intelligence, is critical to securing our economic and national security,” she said.
“We'll do that by enforcing the laws we have, and not by stretching our legal authorities,” Holyoak said, in a not-very-opaque reference to the activist privacy enforcement agenda of former Chair Lina Khan. “And we'll continue to do it by taking a flexible, risk-based approach to privacy enforcement that balances potential privacy harms, consumer expectations, legal obligations, business needs and competition.”
In AI and other developing digital technology, she said the FTC will strive to make regulation and enforcement predictable and clear to business. While Holyoak never used the term "regulatory humility" that FTC leadership used during the first administration of President Donald Trump, her focus in today's speech appeared to closely track that philosophy.
“The Commission should create a predictable regulatory and enforcement environment that promotes innovation and development of new technologies," including artificial intelligence, Holyoak said. The FTC’s study under its Section 6(b) authority into AI partnerships (see here) shed light on "the massive amounts of data required for training models," and the commission needs to focus on regulating that data, she said
But in AI and other developing digital technologies, Holyoak said, the FTC wants to promote healthy competition. Access to data, she said, is a key part of that, and a too-intrusive privacy regime may entrench the dominance of big companies.
"Requiring consent – at least for certain types of data or in certain contexts – may level the competitive playing field by acquiring the same level of privacy protections across the board. But on the other hand, a privacy regime that requires affirmative consent from users for data collection or use may actually favor dominant players, because users are more familiar with big firms, and thus they may have more trust in how those firms will collect or use their data," Holyoak said.
The commission should make decisions "based on sound economic principles and robust empirical analysis. Economics has been a critical component of the Commission's privacy enforcement program for many years. Indeed, our economists have a long history of developing sound economic theories of harm," Holyoak said.
The studies into AI should continue, she said, encouraging International Association of Privacy Professional attendees to respond to the commission’s request for information about anticompetitive AI regulations (see here).
— Minors —
As tougher new enforcement rules for the Children’s Online Privacy Protection Act were published today in the Federal Register, to come into effect in June (see here), Holyoak said the FTC's focus on protecting the privacy and safety of children and teens online would continue.
“The amendments are a culmination of a bipartisan effort that started in 2019 and while I would have preferred a different approach to some of the amendments, I voted in favor of the final rule because it expands privacy protections for children," Holyoak said.
The FTC must use all of its statutory authority to address online risks to children and teens, such as cyber bullying, “inappropriate content” and online scams as well as privacy risks, said Holyoak, who was the solicitor general of Utah before joining the FTC last year.
“So the commission must use every tool that Congress has given it to help protect children and teens from online harm and to better understand emerging technologies like AI powered chat bots that can negatively affect kids' online privacy and safety,” she said.
The FTC is also concerned about adversary nations weaponizing the personal data of Americans, Holyoak said.
The FTC can further protect that information by leveraging “our existing statutory authorities, like the Protecting Americans’ Data from Foreign Adversaries Act. In short, that Act prohibits businesses from selling, licensing, transferring, disclosing, or providing access to Americans’ sensitive personal data that they do not collect directly to entities controlled by foreign adversaries,” Holyoak said.
She hinted there could be a partnership in the future between the FTC and the Department of Justice, which just enacted its new national security program to protect data from foreign entities (see here), to address that risk.
One such piece of sensitive information is precise geolocation data, which will continue to be an important area of enforcement, she said.
“Precise geolocation data is particularly sensitive and can reveal our religious beliefs, our political affiliations and even medical conditions and treatment. This information can be exploited and poses significant and frankly unacceptable risks to our national and economic security,” Holyoak said.
*International Association of Privacy Professionals Global Privacy Summit 2025, Washington, DC, April 22-24, 2025.
Please e-mail editors@mlex.com to contact the editorial staff regarding this story, or to submit the names of lawyers and advisers.