What is the FTC's Role in Online Safety | FOSI 2025 Annual Conference

Well, thanks for having me. I'm really happy to be here. So I'll talk about this a little. I want to resist slightly. There are a lot of the same issues with AI that we have with other technologies. But this technology is unique in one important way. So as the internet sort of began flourishing, the internet basically made it possible to do more quickly and more efficiently things we were already doing. It made commerce more quick and efficient. Made communication more quick and efficient. AI is different. You couldn't have necessarily predicted the direction in which the internet was going to go but it was taking things human beings were already doing and just basically eliminating a lot of transaction costs and searching costs. AI is different. The people creating it don't know really what it is. They're often surprised by their own work on it. They don't know which direction it's going and neither do we. And as a regulator and law enforcer if you don't know the direction in which the technology is going my instinct and I think this is one of the ideological questions that voters will get to decide in upcoming elections is in the face of new technology do we want sort of regulatory ambition or regulatory humility. And my view is in order to let the technology develop and in order to make sure that the United States stays at the forefront of the development of this technology and that the innovation doesn't shift somewhere else particularly to an adversary, we need a touch of regulatory humility. And you can sort of look out over the globe and see how different policies are handling the same question. Europe has decided like we want comprehensive regulation sort at the infancy of the technology. I think that's a terrible mistake. And I think generally the United States's view is what it view has been for a couple centuries with new technology which is we're a country of pioneers. We're a country of innovators. We're a country of risktakers. And that's why we've been sort of the engine of innovation and development for the whole world since the late 18th century. But in order to keep that the regulators need to take a somewhat hands-off approach step back and say the developers don't know where this is going or what it is how we don't know where it's going or what it is if we sort of come up with a scheme of regulation aimed at something today by tomorrow it will have lapped us already. Now I think that's sort of the default approach. But we also don't want to sort of create a system where the tradeoff for innovation is children. Where there that ends up being sort of the grist for the innovation mill. And so at the FTC I've got a couple powers the ones you read about in the newspaper all the time. I can sue people if they're breaking the law and I have the power in some limited circumstances to issue regulations. The third power that is not talked about as much, but when Congress created my agency, they understood to be just as important as sort of the direct law enforcement power is this 6B power that you mentioned under 6B of the statute, which gives me the power effectively, I'm going to reduce it to layman's terms a little, but effectively to issue subpoenas to businesses to require them to turn over information of the type they would turn over in a law enforcement investigation, but not for the purposes of me bringing a law enforcement action for the purpose of me writing a study, releasing that study to the public to Congress and allowing that study to inform policy choices that Congress is going to make or that the states are going to make or that other parts of the federal government are going to make, including the FTC when it decides whether and how to enforce our very generally worded statute, section five of the FTC act in this new context. So the 6B study we issued a couple months ago went to basically most of the major AI chatbot developers and said we want data from you not just data we want documents on how your chat bots are affecting children. What research do you have on it? What safeguards do you have in place? How do you understand children to be interacting with these? What effects do you understand them to be having on children? And are you like doing anything about the data you are collecting on children? And that is sort of consistent with I think President Trump's general approach to AI which is embodied in the American AI action plan which is we want to win the AI race against our adversaries. America's sort of competitive advantage is a hospitable regulatory climate. We want to foster that hospitable regulatory climate but we have to continue protecting American families and especially children from the development of this technology. So the point of the study is figure out what is in fact going on in this rapidly developing technological landscape. And then once we understand that that can inform both regulatory and policy choices and inform how we at the FTC understand enforcement of our very generally worded section five statute to protect children and families. So I think the 6B is sort of the perfect approach here which is understand before enforcement. I think blindly racing into regulation or enforcement is very likely to have second order effects that we will regret. But proceeding with enforcement once we have a good understanding of how this works and also giving Congress and the states an opportunity to see how it's working as they are making their own regulatory and policy choices I think is the best way to proceed.

We're two things on the 6B study. We're very early. The data is only just sort of starting to arrive since we just issued the orders. And generally, as is always true when the federal government issues noncriminal compulsory process, you ask for a lot and then there's a series of negotiations where the company says, "What exactly are you looking for because we know what we have and you don't." And so we're working through that. We also don't release any of the information we get except in the written reports. So I don't know exactly when that will be. We tried to make the study broad enough to get at what we care about, but limited enough so that companies can turn over stuff relatively quickly without us having, for example, to going to court to enforce the 6B orders so that we can get the study out there. In terms of our legal authority, I'm going to divide it into basically two buckets. The first is privacy. I mean the whole internet is sort of built on this exchange between us and companies on the internet where we normally for a lot of the services we use we don't pay dollars for their use. We instead hand over a lot of private information about ourselves. That sort of happens in the background. You don't really know that you're doing it. Consumers have gotten more sophisticated about this in the last 10 years. But generally this exchange is happening so in the background that even a consumer aware of it is not aware in the particular moment that every click every keystroke is providing data about the user to the internet company. But that's sort of how the internet economy is built. You know we're not if you I'm a DuckDuckGo guy. But if you're using Google, for example, you're not laying down your credit card in order to do a search, but you are turning over troves of data to Google every time you conduct a search so that they can monetize that through advertising. And so Congress, we do not have a general federal privacy law that's been the subject of political dispute now for a long time. But we do, dating back to 1998, have a privacy law aimed at protecting children. The Child Online Privacy Protection Act or COPPA and the FTC has promulgated a rule which it has updated from time to time including just this year aimed at protecting children 13 and under online. So that's the first one. We've already brought a bunch of COPPA action since I became chairman. One of the first things I told the staff in January when the president appointed me to the chairmanship was bring me COPPA cases. As many COPPA cases as you can find. Yes, there are inadequacies in COPPA. It was a law written in 1998. It's 2025. There are definitely inadequacies, but we ought to push this thing to its absolute limit and protect as many children in as many ways as we possibly can. We are right now looking at additional amendments to the COPPA rule that we just updated in 2025. So this is one of our highest priorities. So that's sort of the privacy bucket on the children's side, right? The FTC has over the course of the last 20ish years, depending on which one you consider our first one, developed what experts call the common law of privacy. There have been dozens of cases that the FTC has brought under section five. About data, data security, actual privacy, like the hoovering up of data by companies from consumers. We almost never litigate these. We actually have only really ever litigated one and we're litigating it right now. It's called FTC against Kachava in the District of Idaho. Most of these have been consent decrees and through these consent decrees the FTC has sort of established what it understands section 5's privacy rules to be. And for those who are not familiar, section five is a incredibly generally worded statute for purposes of, the area we're talking about right now, the prohibition that Congress added to the FTC Act in 1935. That's how old this is. Prohibits unfair or deceptive acts and practices. That's it. That's what we're working with. A 1935 law that has those nine words. And so a lot of our work has been in deception. In other words, internet companies make representations to consumers that they're going to protect their data a certain way. They're going to use their data a certain way. They're only going to collect certain types of data. The FTC learns that that's not true. That's relatively straightforward. The trickier one is unfairness. As a very famous judge in New York once said, unfairness is in the eye of the beholder. And so the FTC has sort of tried to figure out what the bounds of unfairness are when you're collecting people's data. But that's sort of our bucket story.