The Federal Trade Commission is sorting through hundreds of public comments as the agency prepares to craft potential new privacy regulations next year.

The effort is expected to take months, and there is no guarantee it will end with new regulations in place. Rulemakings like this one generally take years to finalize, meaning the process could continue past FTC Chair Lina Khan's term, which currently ends in 2024. The FTC could ultimately decide not to move forward under current or future leadership. But the rulemaking process is viewed by policy experts as a step toward cracking down on the collection of personal data by tech companies like Amazon.com Inc. and Meta Platforms Inc.

Public support for some type of federal data privacy measures is growing: According to 451 Research's Voice of the Connected User Landscape: Trust and Privacy Survey 2022, the percentage of consumers somewhat or very likely to support federal data privacy measures has risen to nearly 84% in 2022, up from 69% in 2020. Meanwhile, the legislative effort to pass federal privacy laws has stalled as members of Congress debate whether federal law should preempt more stringent state laws.

Public input

The FTC received more than 1,000 responses to the 95 questions it posed as part of the agency's Advance Notice of Proposed Rulemaking on privacy, which asked about potential privacy regulations but did not propose a specific rule or rules. Some commenters strongly favored the creation of new privacy rules, saying more regulations are needed to protect consumer data and civil rights. Opposing groups said new rules would add regulatory burdens and expenses to small businesses that already adhere to various existing privacy regulations.

While there is currently no federal privacy law, several states have passed their own regulations. California, Colorado, Utah and Virginia are among the states with new privacy laws that become enforceable in 2023, according to the International Association of Privacy Professionals, which tracks the progress of state-by-state privacy laws.

The FTC will likely draw from both supportive and critical comments as it looks to craft regulation that could withstand legal scrutiny, said Jessica Rich, a former director of the FTC's Bureau of Consumer Protection and current privacy and advertising attorney with Kelley Drye & Warren LLP.

"If the agency doesn't proceed properly with its comments, that could be the basis of reversal ultimately by a court down the road," Rich said. "They want to draw on support from the comments; they [also] want to see who is likely to sue them."

After reviewing the initial public input, the commission's next step would be to issue the Notice of Proposed Rulemaking, followed by another comment period. At that point, "The stakes are much higher because they are actually proposing a particular course of action," Rich said.

The FTC will also give stakeholders an opportunity to request hearings on the proposed rule or rules.

Competing views

Critics of the FTC's proposed privacy rulemaking include trade groups that say their members can ill afford additional compliance costs.

"They don't have in-house legal counsel or compliance departments, so when they face new regulatory burdens, that increases cost — they have to hire outside help to comply," said Brian Hurley, chief regulatory counsel for ACA Connects, a trade association representing small and medium-sized internet companies that provide broadband and other services. "Our members are responsible stewards of customer data. They have measures in place to secure the data."

Meanwhile, public advocacy groups such as Washington, D.C.-based Public Knowledge expressed concern about allowing the tech industry to police itself on data privacy and security matters. Public Knowledge urged the FTC to push for more substantive privacy rules.

Public Knowledge also supports a civil rights provision for the internet that ensures companies do not use personal data to discriminate against consumers and make eligibility determinations in areas such as housing, employment, education and credit, said Sara Collins, senior policy counsel for Public Knowledge.

"All of the Democratic commissioners at the very least have shown a very big interest in how to think about our general civil rights laws and how they apply to tech online," Collins said. "I would be very surprised if we don't see something like that in the proposed rulemaking."

As an alternative to a full rulemaking process, the agency could issue a policy statement on privacy and data, said Bilal Sayyed, senior competition counsel at TechFreedom, a free-market think tank focusing on internet law, in public comments filed with the FTC.

"A statement is a legally sound approach and unlikely to lead to the litigation delays associated with an administrative rulemaking," wrote Sayyed, who previously was the director of the Office of Policy Planning, the Federal Trade Commission's internal think tank.

While not as binding as a new regulation, a policy statement would offer "more flexibility in addressing new issues and incorporating new information," Sayyed said.

The FTC's public affairs office did not return a request for comment on this article.