FTC Highlights Scrutiny of Health and Geolocation Data

The Federal Trade Commission (FTC) recently published a blog post that highlights the agency’s  continued focus on “highly sensitive data,” including information about a person’s health and precise location data. The blog post – which comes in the wake of the U.S. Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization and President Biden’s July 8 Executive Order encouraging the FTC to take further measures to protect consumers’ privacy regarding reproductive healthcare services – clearly indicates the FTC’s commitment to protecting data “at the intersection of location and health: information related to personal reproductive matters.” Even with that core focus, the implications of the blog post are much broader. The post discusses sensitive information collection, sharing, and selling generally, and signals the FTC’s growing skepticism and concern about the use of this data across the data ecosystem. Companies that collect and/or process data such as health and geolocation data should pay attention to the FTC’s latest statements, which indicate the agency’s enforcement and policy priorities.

The blog post highlights that “[t]he Commission is committed to using the full scope of its legal authorities to protect consumers’ privacy” and that it “will vigorously enforce the law if [the FTC] uncover[s] illegal conduct that exploits Americans’ location, health, or other sensitive data.” Pointing to past enforcement actions as a “roadmap for firms seeking to comply with the law,” the blog post provides a list of key considerations for companies dealing with sensitive consumer data, which include reminders that:

• Sensitive data is protected by numerous federal and state laws, including under Section 5 of the FTC Act.
• If claims that data are anonymized or aggregated are untrue, such claims will be considered to be deceptive trade practices, in violation of the FTC Act. Of particular note here, the blog post states that “[s]ignificant research has shown that ‘anonymized’ data can often be re-identified, especially in the context of location data,” and warns that “[c]ompanies that make false claims about anonymization can expect to hear from the FTC.” 
• The FTC is concerned about practices that result in “over-collect[ion], indefinitely retain[ing], or misus[ing] consumer data” in general and sensitive data in particular.

With federal privacy legislation still being debated in Congress, the FTC continues to take steps to utilize its existing authorities to prioritize consumer privacy issues, with sensitive data protections being a main focus. Companies should look to enforcement and policy trends to stay on pace with the FTC’s evolving approach on these important issues.