It has been roughly six months since Andrew Ferguson took over as chairman of the Federal Trade Commission (FTC). Since that time, Mark Meador was confirmed as the third Republican commissioner (joining Commissioner Melissa Holyoak), and Commissioners Rebecca Slaughter and Alvaro Bedoya were removed from their positions by the president.
Although there has been a lot of change at the agency, we are starting to get a better understanding of what sorts of law enforcement cases will be brought by the FTC under the new leadership. However, thus far we have not seen any new privacy cases announced by the agency. But there have been a number of privacy developments that are worth highlighting.
First, there has been a significant focus on issues involving kids and teens. During the final week of Chair Lina Khan’s tenure, the FTC announced amendments to the Children’s Online Privacy Protection Act (COPPA) Rule that, among other things, require separate parental consent for disclosure of kids’ information to third parties for targeted advertising and expand the definition of personal information to include biometric data. Of course, until rules are actually published in the Federal Register, they don’t become effective, and there was some uncertainty as to when or whether the COPPA amendments would be published. They were, however, published April 22. Some of the changes became effective June 23, with the remainder becoming effective April 22, 2026. Children’s privacy is one of the areas that the commission continues to emphasize as a high priority.
The focus on kids and teens was also evident at the FTC workshop on the attention economy. We wrote a blog about the event previously, but it is worth noting that the event focused on issues such as online addictive design features, the role of parental authority and parental controls, and exposure to harmful content. The event highlighted the FTC’s continued focus on kids but also raised questions about the extent of the agency’s authority to address some of the issues they focused on at the event.
A second important privacy issue emerged in connection with a recent high-profile bankruptcy. On numerous prior occasions, the FTC has either made a statement or sent a letter reminding parties that promises made to consumers regarding data that was collected will often survive a bankruptcy and should be adhered to post-bankruptcy. In March, Ferguson sent a similar letter to the U.S. Trustee regarding bankruptcy proceedings and noted that any bankruptcy-related sale or transfer involving “personal information and biological samples will be subject to the representations the Company has made to users about both privacy and data security, and which users relied upon in providing their sensitive data to the Company.”
A third priority for the FTC will be using the new authority that Congress recently gave to the agency via the TAKE IT DOWN Act, which focuses on nonconsensual intimate images and deepfakes and requires platforms to establish a process to receive notice and take down such images. The FTC has enforcement authority for this new statute, which becomes effective in May 2026, and the commission has indicated that it will devote substantial resources toward enforcement.
Finally, although we haven’t seen any new privacy enforcement, two actions are worth noting. First, in May, the commission finalized a data security settlement that had been announced under Khan. No changes were made to the matter. And just a few weeks ago, the FTC put out for comment a petition that was filed by the CEO of a company that the FTC had sued in connection with a purported stalkerware app. The CEO argued that since he is out of the business, the burdens imposed by the FTC settlement agreement are excessive and unnecessary. The FTC has not indicated whether leadership is supportive of the petition, but any action taken will certainly be looked at closely.
In summary, although we haven’t yet seen a great amount of privacy activity, it’s safe to assume that the FTC will be focusing a great deal on kids and teens and will also focus on privacy enforcement that is consistent with traditional FTC jurisprudence.
[View source.]
