Deep Dive Episode 109 – Regulating by Consent Agreement: Examining FTC’s YouTube Settlement and Beyond

Nathan Kaczmarek:   Good afternoon, and welcome to The Federalist Society’s Fourth Branch Podcast for The Regulatory Transparency Project. My name is Nate Kaczmarek. I am the Director of RTP. As always, please note that all expressions of opinion are those of the guest speakers on today’s call. 

Today, we’re happy to bring you a great panel discussion as part of The Federalist Society’s Executive Branch Review Week titled, “Regulating by Consent Agreement: Examining FTC’s YouTube Settlement and Beyond.”

For our Moderator today, we’re pleased to have Neil Chilson, who is a Member of our RTP working groups and the Senior Research Fellow for Technology and Innovation and the Charles Koch Institute.

If our audience would like to learn more about all of our speakers and their work, you can visit RegProject.org—that’s R-E-G-Project.org—where we have listed all of their bios. In a minute, I’ll turn it over to Neil to get us started and to moderate the conversation for us.

After opening remarks and discussion, we will go to audience Q&A. So audience, please think of the difficult questions you’d like to ask our speakers. 

Thank you all for joining us. Neil, the floor is yours. 

Neil Chilson:   Thank you, Nate, for that introduction. We have a really great call setup today, and I’ll introduce our panelists and our topic in just a moment. But I wanted to take just a few seconds to thank a few people. 

Like so many events these days, this teleforum was initially intended to be part of a larger, in-person event. But given COVID-19 and the response, we, like so many other event organizers, had to change our plans. And I particularly want to thank a fellow RTP member, Svetlana Gans, who did so much to organize and reorganize this event. She will be hosting a separate FedSoc panel on FTC remedial authority in the near future, so keep an eye out for that. 

Thanks also to The Federalist Society staff and especially to our panelists for their flexibility and for accommodating this change. 

So we’re here to talk about the Federal Trade Commission and in particular, to talk about its consent authority and how the use of that authority effects third parties. That is, parties or companies who aren’t being investigated by the FTC but perhaps have some sort of relationship with the companies or individuals that are being investigated. 

The FTC’s consent authority and how it is used has long been the matter of some discussion and debate. And that debate has usually centered on how consents effect the defendant companies that the FTC is investigating. But a recent settlement has raised a new issue, or we’ll examine in the discussion whether or not it is a new issue.

What about how consents effect non-parties to the settlement? The particular case that prompted the organization of this panel was the FTC’s September 2019 settlement with online video service YouTube. As you probably know, YouTube is one of the internet’s most popular websites with 2 billion monthly active users, and it features content from more than 50 million individual creators, most of whom are individual people or small businesses. 

The settlement requires YouTube to adopt new rules around content that is arguably directed to children, and this will affect many YouTube content creators. Many of these creators earn money using YouTube. Some will need to restructure their business models. The changes also arguably subject content creators to an increased risk of prosecution and FTC fines. 

Yet, these content creators weren’t part of the negotiation between the FTC and YouTube. Instead, the regulation was negotiated between the company and the FTC, and it was put in place by a court. 

So what we want to talk about today is how does the process at the FTC accommodate or fail to accommodate the concerns of third parties in cases like the YouTube investigation. Is this just a natural result of the effect of digital platforms where we have large companies who have many, many consumers on them, and those consumers’ abilities will be affected by any change to the platform whether it’s taken on by the platforms themselves or mandated by government? If so, is this approach justified and when? And how can the FTC address the concerns and interest of third parties when it uses consent agreements? 

So with that, let me introduce our excellent panelists. They all have just loads of expertise so I’m sampling from their lengthy and impressive bios, but they all have easily google-able names. And so if you’d like to learn more, I’d either go to the FedSoc website for this event or just google them.

So starting with Jessica Rich, she is one of the nation’s leading experts on privacy and consumer protection. She is currently a Distinguished Fellow at the Institute for Technology Law and Policy at Georgetown Law. And most relevantly, for our purposes, she was, for four years, the director of the Bureau of Consumer Protection at the Federal Trade Commission. That role capped her 26-year career at the agency, and I was proud and lucky to overlap with Jessica during my time at the Federal Trade Commission. She was a joy to work with and she remains so. So Jessica started her career in private practice in New York City, and she’s a graduate of NYU Law School and Harvard College. 

Next up is Sean Royall. He is a Partner at the law firm of Kirkland and Ellis, where he focuses on antitrust and consumer protection. Sean previously served as the deputy director of the FTC’s Bureau of Competition, supervising mergers and leading conduct investigations and trials. In private practice, Sean has become one of the leading lawyers in the country handling complex consumer protection matters involving marketing and advertising practices, privacy, and data security. 

Interestingly, he served as the lead counsel for Facebook in connection with the FTC’s extensive investigation of the company’s privacy related practices. That investigation resulted in a recent and unprecedentedly large settlement. And so he has a lot of knowledge about the settlement process and the consent order process. Although, he may not be able to speak about any particular matter. I’ll let him issue any such disclaimers. 

Next up is Gerry Stegmaier, a Senior Research Fellow and a Practitioner in Residence in the program on the economics of Privacy at Scalia Law School’s Law and Economic Center. He has taught what was one of the first information privacy courses since 2001. He’s also an attorney in private practice who counsels Fortune 500 companies and has represented clients in nearly two dozen FTC investigations and other proceedings. 

So our plan today is to have each panelist give initial remarks for about eight minutes in the order I introduced them: Jessica, then Sean, then Gerry. We’ll then go through another round for each to respond to each other. That should last about another 10-15 minutes. For the final 15-20 minutes, we will take caller questions. So I really encourage everyone to listen up and think hard about what questions you have and what you want to learn more about with regard to the FTC’s settlement process and how it effects third parties. 

With that, let’s kick it over to Jessica to learn about the reason for settlements and how the FTC considers third parties in these settlements. Jessica?  

Jessica Rich:   Great. Thanks, Neil, and thanks to everyone. I’m really happy to be here or be on the phone with former colleagues to talk about the FTC consent process. I worked with this process for over 25 years, and I believe it works well for government, for consumers, for industry. In general, consent orders provide an additional avenue for resolving allegations of wrongdoing that can be far more desirable for many companies than going straight to litigation. Companies avoid the costs and risks of litigation, and they can shape the message in the outcome of the case. 

Consent authority is also efficient and effective from a government perspective. Every law enforcement agency I know uses it in some form. Now, I was going to walk through the process of consent authority because I thought some people on the phone might not know it and I also thought that would address some of the larger criticisms about consent authority, etc., in lieu of litigation, etc. But I think I’m going to jump right into the issue of third parties because that’s the meat of what we’re talking about today. And I’d be happy to answer questions about the process if those in the audience have them.

So let me go into that. So a built-in assumption for this panel, and it’s very polite, as Neil always is, but it’s a built-in assumption that FTC orders shouldn’t affect third parties, and if they somehow do, it’s an overreach. And it’s true that orders are legally enforceable only against defendants and respondents named and also per rule 65, those acting in concert with them. But orders affect third parties in a variety of ways and would be highly unrealistic to expect otherwise. 

First and obviously, many order provisions track the law and may pull together elements from regulations and court cases that aren’t so easy to find in one place. These types of provisions apply equally to third parties and can be very instructive to them, especially when they’re coupled with the facts of a particular case. 

Second, even those more detailed order provisions, the ones that go beyond the strict requirements of the law, often reflect the Commission’s view as to what is legally compliant. It may not be the only way to be legally compliant, but it can be quite valuable to companies looking for guidance.

Remember, Section 5 is very high level and has been criticized for not providing this type of guidance. Beyond that, as you know, virtually every company operates within an ecosystem involving many third parties. As a result, any violation a company commits in any order obtained against the company inevitably affects third parties. This is equally true in consent orders and court-mandated orders. 

So let me give a variety of examples where this comes up. The FTC and the courts routinely hold companies responsible for actions of third-party agents: sales agents, service providers, endorsers, content creators. When that happens, the order may include provisions requiring notice to or monitoring of those third-party agents, which obviously affects them. 

The FTC and the courts have also repeatedly applied the doctrine of [inaudible 12:06]  in which one company is liable for putting deceptive claims into commerce that a third-party company then uses to make its own claims. Again, the orders in those cases may include notice to and monitoring of those third parties.

In pyramid and multi-level marketing cases, the orders often require extensive provisions to prevent false earnings claims, which have a big effect on downstream buyers and sellers that make and rely on those same earnings claims. They can’t make those false claims, and they’re on notice of them. 

In ChoicePoint, which was an early data broker case involving a purchase of data by identity thieves, the order barred ChoicePoint from selling data to third parties unless those third parties met certain criteria showing they were legitimate businesses as opposed to identity thieves. This order, therefore, had a big effect on third parties’ ability to purchase data from ChoicePoint, which is a big source of data. 

In the so-called in-app purchase cases against Apple, Google, and Amazon, the FTC alleged that these platforms enabled and profited from unauthorized purchases that were made through kids’ apps operating on the platforms. The orders then required the platforms to restructure their payment mechanisms, which obviously affected many of the apps operating on those platforms and making charges through those payment mechanisms. 

And a final example I’ll give in this regard is that in the AT&T and T-Mobile cramming cases, the FT[C] alleged that these carriers allowed third parties to cram unauthorized charges on consumers’ mobile phone bills. The order required them to obtain consumer consent before adding these charges to mobile bills in the future. And obviously, that had a big effect on third party’s ability to do their billing through these carriers. 

So those are all examples of whether these orders are obtained through consent or in court. Orders inevitably have a big effect on third parties because companies don’t operate in the vacuum. Now, discussion of these cases leads to another point. In many of these cases, the FTC pursued a platform or other large player in the ecosystem and also could have but didn’t sue the hundreds of marketers, identity thieves, apps, and crammers that also took part in the alleged violations. 

So like many enforcement agencies, the FTC used its prosecutorial discretion to take action against a clearly culpable party that would have the greatest impact on compliance without suing all of the smaller guys. Yes, those smaller guys, those third parties were affected by the orders, but the alternative would’ve been that all of those guys would’ve been sued themselves.

So with all of that context, I now want to turn to Google and YouTube because that’s the focus of this discussion. I don’t see, with that context, Google and YouTube — the Google-YouTube case being a dramatic new front in commission cases at all. It gets a lot of attention. It got a lot of attention. It resurrected controversy about the COPPA rule itself, but as to enforcement, it’s another instance of the Commission pursuing a large culpable actor to achieve wide spread compliance without suing hundreds of companies, many of them small.

The kid-directed channels that were involved in that case, they were directly liable for alleged violations of COPPA, which in this case was the collection by the ad network, YouTube, of persistent identifiers to serve ads on those channels. YouTube was also liable because the allegations were that YouTube did this collection with actual knowledge that the channels were kid directed channels.

The FTC could have pursued all of them, but it chose to focus on YouTube. While the order only applies to YouTube, it does affect the channels, the third parties that operate through YouTube and serve YouTube ads. But it affects them just as any YouTube policy would and does. YouTube has many policies about how channels operate on YouTube. And it affects those channels just as the third parties were affected in many of the cases I just described, in the multi-level marketing cases, in ChoicePoint, in the in-app purchase cases, in the mobile cramming cases. So to me, it falls right in line with the kind of effects on third parties we see in both settled cases and litigated cases we’ve seen through the years. 

Now, to the extent this is another line of concern or criticism about consent orders, I just want to make some final remarks about that which is a key question to ask when you’re talking about all the flaws in the consent order process, whether it be due process or effects on third parties, a key question to ask is what are the alternatives? And are they better? 

So I know from experience that most companies, at least most companies I dealt with, liked the voluntary consent option. And many companies would be very upset if that were taken away and they were forced to choose between to litigate or completely stop whatever they were doing.

Another question, if there were fewer consents, there would be less enforcement, and would that be good for the health of the marketplace and for legitimate companies that want to see their bottom-feeding competitors under order? You want to ask that. Would reducing the number of consents, and thus reducing the amount of enforcement, would that lead to more aggressive rulemaking? Or would it lead Congress to pass more laws? 

Because after all, if the FTC loses its ability to bring a certain level of enforcement, it’s going to have to raise compliance in other ways. And so I would ask that — there’s a lot of talk about unintended consequences, and I would ask that we be very careful about them here. 

Okay, I’m over my time, so I’ll stop. Thanks very much. I’m happy to take questions later. 

Neil Chilson:   Thank you very much, Jessica. I really appreciate that. Sean, you have deep experience negotiating these consent orders on behalf of clients. Could you take some time to tell us what you’ve learned about the process and in particular, how does negotiations consider the effects on third parties? 

Sean Royall:   Sure. I’m going to keep my comments reasonably high level. I’m not going to talk about the specifics of any matter that I’ve been involved in as counsel. But I have been involved in negotiating consent orders in quite a number of FTC matters over the years, both in the antitrust and consumer protection side but particularly on the consumer protection side. And I’ve been involved in order violation cases, more than one.

Just starting at a very high level, it’s an interesting dynamic when you’re representing a company before the FTC. It’s being investigated and typically in the later stages, you’re engaged in strong advocacy, often to persuade the FTC that you believe that there’s really fundamentally a problem in the underlying merit of the claim that’s being asserted, whether it’s legal or factual or both and seeking to persuade the FTC not to take action.

There’s an interesting thing that I’ve seen happen in quite a number of cases. And it does have something to do with the effect of orders on third parties, but in quite a number of cases that I’ve handled, there is sometimes this tipping point where we’re fighting, we’re fighting, we’re fighting against the FTC, which may be fighting back very strongly on its own in terms of the merits of its claims and their need for some type of enforcement, but the tipping point I’m referring to is a point in time where the party under investigation, the respondent, comes around to the view that now, wait a minute. Maybe settling this matter, maybe working out a consent order with the FTC is not such a horrible outcome. 

And part of what I’m getting at is particularly, if you’re the first in in an industry where you’re the focus, as Jessica said, the FTC has prosecutorial discretion. Sometimes they come after a particular player before they come after others or maybe only come after one prominent company. There is, in an odd way, a sort of privileged position to being that company, and it’s not a view that most companies in that situation would come to quickly. 

But I’ve seen it happen a number of times where deep into the matter in advocacy, companies come around to the view that now, wait a minute. There may be an advantage to being in the situation we’re in because we have the opportunity to sit down with the leaders of the FTC and to work out the terms of a settlement that we can live with because obviously, you don’t want to enter into any FTC settlement that you don’t think you could live and comply with.

And we can negotiate the details of that. We can do that in a way that’s very sensitive to the terms of our business and unique sensitivities of our business. And that order, in many respects, may, as a de facto matter, apply to the rest of the industry, to our competitors, to other companies that are not in the room and are not participating in those discussions. 

Now, I say de facto because Jessica’s obviously right. An FTC order only binds the parties to the order, those who are named and although theoretically could affect parties that have acted in some way to aid and abet a violation of the terms that Jessica used. 

But as a de facto matter, often FTC orders are setting standards that others in the same industry, similar businesses can expect will likely be applied to them and that if they want to be compliant, if they want to avoid FTC enforcement against their own operations, they need to take very seriously the terms that have been negotiated in an order that technically only applies to their competitor. 

So I do think that that’s a phenomenon that is interesting that is not always but sometimes, something that actually does persuade companies to shift at some point in their strategy to embrace the consent order process and work to negotiate something that they feel they can live with and that they feel may give them potentially some advantage position going forward in the industry where others within the same industry as a practical matter are going to be required to comply with the same standards. 

This negotiating an FTC consent order — and there’s certainly some of these matters that are not that complicated, but there’s some and some I’ve been involved in that are extremely complicated. And one thing that you have to always appreciate is it’s of, needless to say, paramount importance that you, before entering into a consent order with the FTC, are absolutely sure that you have the wherewithal and the means to comply with the order. And that should be obvious.

On the other hand, you don’t appreciate that. I think you don’t ever quite appreciate that as well until you’ve been through an order enforcement action. And again, I’ve been through that process for a number of different clients, and you see what the effect can be of potential ambiguities in the language, in the obligations of the original consent order. And there are also issues that can come up with respect to third parties, third parties that you rely upon in some respect for your business, your operations and that you’re accountable for. 

And Jessica mentioned that you need to give notice to third parties. Well, there’s also, again, following up in assuring compliance on behalf of your own personnel and third parties that you will be held accountable for. And when you go through an order violation investigation and process, again, you appreciate all the more just how careful and thoughtful you need to be in negotiating the terms of a consent order to begin with and in thinking ahead to all the scenarios, all of the situations that could affect whether you’re able to comply fully. 

And, again, if there are ambiguities in the order, you may believe that you’re complying fully. You may have an interpretation of the order, but you may later learn that the FTC staff has a different view. 

And one thing that has been true, Jessica would support and reiterate, if there’s anything that the FTC takes seriously, and of course, the FTC takes lots of things seriously, but I don’t think there’s anything the agency takes more seriously than enforcement of its own orders. That is of huge institutional interest to the agency and it’s not a partisan matter at all. Enforcing prior orders of the Commission is an extremely serious thing, something that the agency does take very seriously. And the consequences can be quite dramatic. 

Now, one other just general comment is — and I do think it supports what Jessica was saying, that there can be benefits to private parties of the FTC consent order process. There certainly often comes a time, even when the party under investigation has strong genuine convictions and believes that the FTC’s claims lack merit but that they still believe that the most rational solution, the preferred solution is not to litigate against the FTC but to embrace a consent order. 

And having that option available in some situations is certainly preferred to litigation for a host of reasons, even if you believe that your positions in litigation would have merit and have a significant chance of prevailing. But litigating against the FTC is a risky proposition. It’s something that can have reputational effects, even regardless of what the ultimate outcome is. There are lots of reasons why companies may find it rational to choose to settle as oppose to litigating, even if they feel like they have strong meritorious positions. And when you get into an order violation context, the stakes of litigating against the FTC can go up even higher. 

Now, one thing, just as a detail that I would mention — and the kinds of companies that we’re talking about, large platform companies and tech companies, this is relevant to them. But when you’re dealing with an order enforcement action where there’s civil penalties on the table—which would be not uncommon at all when you’re dealing with enforcement of a prior order that the FTC alleges has been violated—in those situations, in order to obtain civil penalties, the FTC has to work with the Department of Justice. The FTC cannot obtain those civil penalties on its own, and that’s an interesting procedural aspect of these types of cases.

Traditionally, the Department of Justice has shown a pretty deferential approach to the FTC, particularly where you have a unanimous commission acting. But there are all kinds of complication that can arise or potential complications that can arise if there’s less than a unanimous — or I mean less than a full commission and there’s some dissent. 

But even where the Commission itself has a consensus view, the Department of Justice does have a say, a potential, independent voice in the process in terms of how civil penalties are handled, how any related federal court proceedings are handled and that that’s just another aspect of this that can complicate things. 

One last thing and then I’ll stop and we can pick up on details and questions, but Jessica was speaking about how all this can affect third parties, and I think everything that she said is absolutely right, that the reality is that FTC orders can affect third parties in a host of different ways. 

And one of the points that I was making is that it can affect third parties in a way that can work to the advantage of the party that’s entering into the order, even if there’s nothing anti-competitive or nothing improper about it, but it’s just a practical reality that where you’re working to set, in effect, standards that can affect and extend across an entire industry, that there’s some benefit to the company that’s in the position of being able to negotiate those standards.

Neil Chilson:   Great. Thank you very much, Sean. Gerry, YouTube represented many companies on the other side of the table from the FTC in settlement negotiations, and I know you have a lot of thoughts about the settlement process and the effect on third parties. So I would love to hear your take on this.  

Gerard Stegmaier:   Sure. So, Neil, I want to thank you and The Federalist Society for having me here today and giving me the great opportunity to go third when I now have about 64,000 questions for Sean and Jessica. So that’s a great opportunity, and I’ll try and use my eight minutes quite quickly and imagine all of my questions for each of them will go unanswered.

But I approach this, I think, in a little different way in terms of thinking about this discussion topic, which is from my perspective, you’ve begged a really important question, Neil, in putting together this panel are what are the implications and consequences of our current system design? And are those implications desirable or undesirable? And I think Jessica did a magnificent job of highlighting the perspective of a career FTC official on a lot of the desirable things and really openly begging the question well, if you have a better idea or there’s something else, we certainly want to hear it, but let’s not throw out the baby with the bath water. 

And what I want to suggest too, in terms of this topic, I went and looked up what decree is, Neil, and the decree is an order usually having the force of law. And I think that really begs a critically important question, Neil. I’ve testified before Congress on due process implications and considerations of the FTC’s Section 5 authority, and no one here, I think, would dispute, that that authority is exceedingly broad. 

And so in some respects, if you are a company out there, and let’s use Sean’s example, right? You’re not first in. You didn’t fight the good fight, argue all the arguments. You now have to live with the standard. But what I want to suggest is for all of those other companies who aren’t first in or aren’t big enough or can’t afford some of the folks on this call and folks that do these kinds of things, figuring out what the law is at the FTC is often like trying to perform eye surgery on a greased pig with a hammer. And if you’re the pig, that’s a really, really awkward, bad place to be.

And so when we think about the third-party implications, I think what we’ve heard here today is that everyone’s saying well, you know, it is what it is and it’s kind of always been that way. But there isn’t any suggestion that that is actually desirable. And I think what Sean raised, in a way that I think is really thoughtful, is for us to think a little bit about when we think about the third-party implications to think about what it means to have state action, because effectively, the FTC isn’t accountable to any of us at the ballot box. 

And its doctrine is somewhat insular, and I don’t use the phrase Mandarin in an unflattering way, but it is a very particular area and practice of law. And a lot of the things that you’re hearing, you’ll know, you won’t hear a no unless you do it. You wouldn’t necessarily know that the content of your complaint in your consent decree is generally going to be largely, completely not negotiable but for glaring factual errors. And I’d love to hear Sean and Jessica’s perspective on that. 

You’ll also find that significant aspects of the decree itself will generally be presented to you in negotiation as being nonnegotiable because they are standard. And yet, I would suggest to you that a lot of times, they are negotiable or they’re non-standard. But if you didn’t know that because you didn’t have the resources to, for example, analyze and chart every single order that’s ever been issued ever, and I know a lot of our colleagues in this bar do that sort of work. And then when you say well, you did it differently in this other one, they go oh, that’s okay, that’s reasonable. 

But especially in areas around enforcement, and I think Sean made some really strong points there, and Jessica left some feedback as well. In the areas of enforcement, that — just as DOJ is involved in the one hand things that go to the fine print and legalese and the back end of the orders that people may be non-inclined to pay attention to, I think everyone on the call would agree that we’ve seen, at least in our, let’s say, last two decades of our relevant experience, that it turns that the fine print often really matters a lot, whether it’s fencing-in relief or the fact that civil penalty authority exists or that those third and fourth and fifth and sixth companies coming in as the platform may try and negotiate a different order. And the Commission may feel pressure to specifically harmonize the orders as we’ve seen – whole lot of different moving pieces here. 

Now, you had asked me a couple of specific questions, and I want to cover — make sure I cover those, Neil, in my rift here. So you said, “Gerry, talk about problems with the consent process.” I’m going to be counter intuitive here and say I think many aspects of the consent process actually work quite well and are very effective for the lot reasons that people already identified. 

But with respect to your second question about some of the unintended consequences, I just want to quote Jessica back, right? Things where there’s the greatest impact on compliance. And so this process where a very interested party can effectively set the rules has quite powerful implications for competition and innovation. And I think we would be naïve to believe that that isn’t in fact the case.

Now, whether that is a good thing or not, we’ll go through a couple of orders quite quickly. And I won’t name the parties, but I’ll tell you what’s happened in the marketplace. You enter into a massive, massive settlement and possibly have corporate governance changes. And all of a sudden, you see teams of lawyers from outside law firms sweeping in and auditing and reviewing and analyzing all kinds of companies in ways that they’ve never been scrutinized before at massive costs because effectively, we’ve deputized an Am Law 50 law firm to keep their client out of trouble.

So when Sean says, “Make sure you have the resources,” it’s really a significant point because the Commission takes these things very seriously.

A second example is that if an order goes beyond the law, and I think Nomi is a great example of that. The YouTube order is a good example of that. There are a number of other orders where I think they’re acknowledged to go beyond what the law requires in terms of the relief. And you’ve put that into a platform context, in other words, an influential player in a position to set standards by virtue of share even if they’re not a monopoly, but they’re significant enough, the resulting standards where they want to not be near the line and stay away from the line have radical consequences. 

And this’ll be, I think, probably the last point, and then I’d get into discussion. But remember, when we talked about unfair and deceptive practices, especially in privacy and data security, we’re also often talking about specifically regulating protected First Amendment activity. And so if the result of that decree is that it has a material effect on protected speech activities that are not unfair or deceptive, right, that’s almost effectively, in my view, potentially per say unconstitutional. 

And there’s a great case out there, [inaudible 40:20]  in the Tenth Circuit, that looked at and talked about this, about substantial state interests for privacy and just came right out and said yeah, privacy is important, but the First Amendment is equally if not significantly more important. So when we think about the systems level and we think about unintended consequences, and a lot of these privacy and data security cases when you read the Commissioner’s statement, you see a theme coming through, I think, which is the umbrage is unactionable, and if we can’t point to consumer injury, maybe these are cases we shouldn’t have brought. 

And when you blow that through into the third-party consequences, Jessica suggested that we could’ve prosecuted every single one of those child directed sites, and we would have but I think that that’s actually a bit of an overstatement because the Commission certainly doesn’t have the resources to do that. And instead, this choke point approach, it creates some really rough frontier justice. 

And I come back to that greased pig analogy, right? If you’re the person that’s going to have that surgery done on you, you don’t want it done with a hammer. But the reality is that the consent decrees are very, very imprecise and the ripple effect of a small change on the front end, in terms of the ecosystem on the back end, is quite obvious.

And I’ll close with this because you had us talking about YouTube and that is if you look at innovation and development of products, specifically a target in built for the children’s market, and I used to represent 65 percent of venture backed software companies in the United States, you’ve found that for most of the last 20 years, products for kids were a virtual wasteland. They weren’t being built. And why weren’t they being built? Because people were terrified of civil penalty authority and not complying with those rules. 

So we can say whether that’s good or bad, I’m not going to take a position on whether COPPA is good or bad. Actually, I think it’s fantastic in terms of its aspiration. But the consequence is that products weren’t built. And so once we start flowing that down through consent decrees to companies, the same types of things invariably happen, especially for people who don’t have the resources. And I’ll pause there because I’m sensitive to our remaining time.

Neil Chilson:   Thank you very much, Gerry. That was great. It’s been an amazing discussion. I think we’ve talked about greased pigs. We’ve talked about two types of effects on third parties that I can boil down, these sort of intentional effects. Jessica mentioned the ones that are intended by the FTC, and Sean suggested that sometimes there can be effects on third parties that are intended by the defendant. 

We’ve also talked about some of the unintentional effects on third parties. Gerry highlighted some of the unintentional effects on innovation in the COPPA context. I do want to let each of you talk, maybe make one point in response to the other participants. But I wanted to make sure we have enough time for audience questions. 

But I also want each of you to keep in mind the question that I think Jessica did a really good job of laying out the fact that obviously, FTC orders have effects on third parties. The question I’d like each of you to think about, and maybe we can talk about it now or we can talk about it in Q&A, is are there types of effects on third parties that are worse than others or some that cross the line that we think shouldn’t be put into effect in a consent decree that affects third parties? 

With that, I want to turn to Jessica to maybe give one point in response and then quickly to Sean and Gerry and then maybe during that, we can have our audience be thinking of questions. And then we can move through that process quickly. Thanks. Jessica?

Jessica Rich:   So from — I’ll think about your question for later but for my one point, I just want to address something that Gerry said which is that there’s a certain amount of — and by the way, I found both panelists, I found that very insightful and interesting those remarks so thank you. But that it is what it is. It’s always worked that way, and that’s why we like it. 

And I skipped over a more full-throated discussion of the consent process because I wanted to get to the third-party issue, but I believe, and I worked with it for a long, long time in many different contexts, that it’s an affirmatively good process. There’s many elements of due process, much more than — it surprises people actually when they hear about it. There’s many bites of the apple that people have. There’s lots of opportunity for negotiation. 

To the large extent — and one of you, I think it was Gerry, acknowledged this. To a large extent, the boiler plate is really just the monitoring stuff, but there is a lot of leeway for creativity. And in fact, in the in-app purchase cases, which Sean can’t talk about specifically, but those cases all involve competitors. And if you look at the two orders that were obtained in the case, they’re different. 

Each company negotiated provisions that fit their own business model. So yes, Sean represented the first one and that may have been an advantage from his perspective, but the orders are different. They’re not just boiler plate. And I guess I’ll leave it there to give others the opportunity to make their points. Thanks.

Neil Chilson:   Great. Thank you for being brief. Sean, anything to add?  

Sean Royall:   Yeah. I can say a few things. I agree. I think the comments that the other panelists have been excellent. In speaking to something that Gerry said, he referred to situations where the Commission feels the need to harmonize orders. And I have been in that situation too where I haven’t represented the party that’s been first in, and it can be very frustrating where the FTC is locked in on an approach or a template, if you will, for what the consent order needs to look like or key terms need to look like. And the FTC can be fairly rigid about that.

But Jessica is also right that there are situations where the negotiations do lead to some differences across orders. So I think both things are true, and it just depends on the circumstances. 

One thing that I want to say. I was saying earlier that, certainly, there are situations where it is the rational thing for the company under investigation to enter into consent order even if they believe that they have strong positions in litigations. But what I will say — I don’t want to be understood to be endorsing and blessing and seeing no drawbacks to the FTC consent order process. 

The very fact that that may be true, that a respondent believes ultimately that the most rational outcome may be a consent order, the FTC can in effect exploit that. And the FTC does use leverage, and when it believes that it has a situation where a party is likely going to find it to be the most rational outcome to pursue a consent order, I’m not saying that due process is being violated, but the FTC can be very forceful and insisting on things in a situation where it’s difficult to resist the FTC because you don’t have a great alternative. 

And not saying, again, that there’s a lack of due process, but the FTC, it, in those situations, I think, uses the reality of the circumstances to gain strength in negotiation and often to push through aspects of an order that are really unpalatable to the company that’s on the other side, even if ultimately they do agree to it.

Neil Chilson:   Great. Thanks, Sean. Gerry, just one point and then hopefully we can get some audience questions. 

Gerard Stegmaier:   Sure. So speed round. FTC got five billion reasons not to have their authority tested in one of these settlements. So a critical component of this discussion from my perspective is that there’s a host of recent jurisprudence that potentially puts some of the FTC’s theory and doctrine seriously at risk in court cases. 

And so I agree with Sean about the settlement component and the use of that dynamic. However, it’s also been my experience that the Commission recognizes that there are cases and things that — is this the case to prove that point? And so I’ve found the consent decree process to be a really good opportunity for advocacy all the way around that, a great experience.

And then just to react briefly to Jessica. I didn’t want to suggest that the consent decree process is static. So my experience has been from a systems perspective that it’s evolved and vacillated over time, which is a dynamic positive aspect of it. But other than that, I’ll pause, Neil, because I know you want to get to audience Q&A. 

Neil Chilson:  Great. I appreciate it. There’s tons to talk about, but let’s get some questions from the audience. 

Mike Dougherty:   This is Mike Dougherty, the CEO of LabMD. And I’ve been listening intently, and I’m going to try to form this into a question. However, my experience about third party — and I’d like to have you somewhat define what you mean by third parties, and due process. My company had no due process. It was a 700,000-cancer detection laboratory that was completely steamrolled by an agency who was run rogue without due process. So I had to wait nearly a decade to get the facts out of what they were doing behind the scenes, which the inside process of the legal process never worked. 

And what we found out was that the FTC was actually working with a third party, a cybercriminal. And when these facts got put into the front of the FTC in courts of law, they just dropped the bone and ran and acknowledged that they were very bad parties, but there was no internal change. 

And in the consent decree process, we, at the time, which was about 2013, all the prior consent decrees, which were by primarily small companies in cyber security, were cookie cutter the same. And I spoke to several CEOs after they signed, because that was the only time I could find out they existed, and they are universally demoralized by the violation of trust they thought they were given in cooperating because the post-settlement consent decrees made these companies look terrible in the marketplace. 

And that was the fundamental reason why I felt I was in a lose-lose situation. But for the sake of time, I won’t even talk about how the bag was over our head in discovery until we got into outside litigation.

But the fact that the agency can work so unbelievably unethically and then blow it off as a one-off and dance on graves of dead medical facilities, unfortunately, is very true, although what I’m saying sounds extreme. But how, then, how does an agency with so much power, doing something so wrong — and read the Eleventh Circuit ruling and report recommendation, don’t listen to a word I’m saying. Read what the Eleventh Circuit said about the FTC’s behavior. It was released and approved word for word. 

So how do you correct yourself within your own body with the power you have? 

Neil Chilson:  Thanks for the question. We have a couple former FTC people on the call, including myself. Anybody want to tackle that?  

Jessica Rich:  Well — can you hear me? This is Jessica.

Neil Chilson:  Yup.

Jessica Rich:   So there’s a lot on the public record about the case, and I’m not at the FTC anymore and I’m not involved in any of the details anymore. So I think it would be a mistake to get in a colloquy back and forth, Mr. Dougherty, on this line. But so much of this is a matter of public record, so I’m going to decline to get into a discussion on this. 

Gerard Stegmaier:   So Jessica, if it’s okay, I will react, actually. And I have never been at the Commission. And I’ve testified with my pen and oversight hearing on this. And I think that, Mike, I disagree with your characterization about there not having been any change. And I think there have been a couple of things that are significant.

The first is I referred to your prosecution as stop and frisk, black-box justice. And in the ensuing years, remember, I commented on this, the non-static process. I think the guidance from the agency on what reasonable security is has changed radically. I think arguments about when and whether they would receive Chevron deference in taking steps to bolster that have improved.

I still have concerns about blogging by the staff being the law and some of those elements in the order process that I’ve written extensively about. But I don’t think it’ll be fair to the Commission or the folks who work there to suggest that the criticisms around data security orders and enforcement generally have not been heard. I think not only have they been heard, but they’ve been reflected even in the orders. 

And I will come back to the Nomi case as a great example or even to look at Commissioner Phillips’ recent comment in looking at consumer injury as being part of the public interest standard. So whether it has actually changed and effectively materially changed, we could argue about that all day long, but I think we can point to a whole bunch of things that are different now than when that case was brought. And I think are a direct result, frankly, of your persistence in bringing and pursuing your case but also from other people in the bar and around agreeing that we can do things better. 

Neil Chilson:  Great. Next question, I think we have time for one more, if we’re quick. 

Ryan:  Hi, my name is Ryan. Thanks, everyone, for the talk. It sounds like from your comments that many third parties are in the kind of position that if the FTC and the defendant were in a civil litigation, the third party might be able to intervene or at least argue for an intervention under Rule 24 of the Federal Rules. 

So it seems like the consent order might impair their interest, and the defendant might not adequately represent their interest. In fact, the defendant’s often a competitor of the third party. So is there any analog to Rule 24 in the consent decree process? And if not, do you all think there should be? Thank you.

Gerard Stegmaier:  So I think others might have much more specific experience, but I would just say that people can and do comment and participate actively when consent decrees are released. But I think, unfortunately, as much as we might like the agency to have a much larger public profile and a more, I don’t want to say participatory process, the reality is most businesses aren’t paying attention to what happens at the Commission. And the ones that are tend to be very, very large and have significant interest in competition policy in my experience. 

Jessica Rich:  So let me jump in. So Gerry’s right that there is a comment process with administrative orders that allows people to comment on a proposed order. And frequently — not frequently, but sometimes, an order is changed due to third party comments. The Commission also is a fairly informal place, and generally if third parties, witnesses, etc., reach out to the Commission and want to talk about something, the Commission staff can’t talk about non-public matters. But people can come in and express their concern about issues to provide a broader context, and they do.

But my main point wasn’t that third parties are materially affected in orders in a way that should give them standing and would be comparable to the type of situation that would lead to intervention in the cases. My main point was that every company exists in an ecosystem, and any action or order against any of these companies is going to inevitably affect third parties period.

One, you get an order against someone that limits their ability to sell their data to fraudulent companies, that’s going to affect the marketplace. And it doesn’t mean that everybody affected should have standing or needs the ability to make all its arguments. It’s just the way the economy works. And it’s no more than what happens when a company changes its policies and it affects its partners.

And so that was my main message, not so much that all of these third parties have interests that rise to the level of standing in a case.

Neil Chilson:  Great. I see that we’re out of time. I really appreciate the panelists for their very insightful comments. Great questions from the audience. I assume there’s many more questions out there that we haven’t got time to get to, but I really appreciate all of you listening and participating. And Nate, I’ll turn it back to you. 

Nathan Kaczmarek:   Yes. I want to echo Neil’s thanks to our panelists. We’re grateful for their time and their opinions today. We welcome listener feedback by email at [email protected]. Thank you all for joining us.

View more