On March 26, 2012, the Federal Trade Commission (FTC) issued its long-awaited final report on privacy, titled "Protecting Consumer Privacy in an Era of Rapid Change" (Report). This Report follows a preliminary staff report issued by the FTC in December 2010 (Preliminary Report). Since the Preliminary Report, the Commission notes that the industry has made significant progress in certain areas, most notably in responding to the Report’s call for Do Not Track, but that progress in other areas has been slower. Also, since the Preliminary Report, the FTC has initiated a number of enforcement actions against companies and industries involving unfair or deceptive practices with regard to consumer data, which help define and frame the issues of greatest concern to the FTC, as detailed in the Report. These cases involved the data practices of Google and Facebook, online advertising networks, mobile applications, list brokers involving the Fair Credit Reporting Act, and companies that failed to maintain reasonable data security.

The Report sets forth the FTC’s final privacy framework (described in detail below) and a number of proposals that will significantly impact entities that collect, use, and share consumer data obtained online, offline, and through apps and wireless devices. In particular, companies that collect data would be permitted to use consumer information only for purposes related to the particular purpose for which such information was collected or that may be reasonably expected by the consumer given the context of the situation. Any other uses would require notice to, and the consent of, the affected consumers. However, the FTC appears to retreat from its recommendation in the Preliminary Report for Do Not Track legislation, noting the industry’s efforts to improve consumer control over how their information is collected and used online for behavioral tracking and ad serving, and it encourages continued improvements and full implementation of those mechanisms.