Episode 37: Rescuing Privacy and Consumer Protection w/ Samuel Levine

Summary

Podcast Title: The Monopoly Report
Host: Alan Chapell
Guest: Samuel Levine
Episode: 37: Rescuing Privacy and Consumer Protection
Release Date: July 9, 2025

---

Introduction

In Episode 37 of The Monopoly Report, host Alan Chapell engages in an insightful conversation with Samuel Levine, the former Director of the FTC’s Bureau of Consumer Protection. The discussion delves into the evolution of the Federal Trade Commission's (FTC) approach to privacy and consumer protection, particularly highlighting the pivotal shift from the Reagan-era deregulation to a more assertive stance under Lina Khan's leadership. They explore the challenges and successes in enforcing consumer protection laws, the interplay between antitrust and privacy regulations, and the future of privacy legislation in the digital age.

---

Samuel Levine’s Role and the FTC’s Mission

Background and Responsibilities
Samuel Levine served as the Director of the FTC's Bureau of Consumer Protection, overseeing a broad spectrum of enforcement, rulemaking, and policy areas, including privacy, data security, digital advertising, and consumer reporting.

[02:43] Samuel Levine: "If I had to describe that at one mission, it would be making sure markets are fair for consumers, consumers and fair for businesses."

FTC’s Dual Mission
While commonly perceived as having two primary missions—antitrust enforcement and consumer protection—Levine emphasizes that these are intrinsically linked under the broader goal of ensuring fair markets.

---

Historical Shift: From Reagan to Lina Khan

Reagan-Era Deregulation
Levine traces the FTC’s historical shift back to the early 1980s during the Reagan administration, a period marked by significant deregulation efforts. The FTC reduced its focus on unfairness, concentrating predominantly on deceptive practices.

[05:18] Samuel Levine: "You can trace that history very directly to the Reagan Years where ... they stopped bringing unfairness cases."

Impact on Privacy and Consumer Protection
This shift laid the groundwork for a privacy regime where consumer protection was limited to ensuring accurate disclosures, neglecting broader unfair practices that could harm consumers even with full disclosure.

[06:18] Alan Chappelle: "The abandonment of unfairness in the early 80s and the real focus on just tell consumers what you're going to do. Doesn't matter what you're going to do, so long as you tell them that was a problem."

---

FTC’s Renewed Focus on Unfairness Under Lina Khan

Reinvigorating Consumer Protection
Under Lina Khan’s leadership, the FTC began to tackle the previously neglected aspect of unfairness, addressing practices that harm consumers beyond mere deception.

[04:55] Samuel Levine: "We have authority to challenge those practices if it's causing harm. And that's been one of the key focuses of our work over the last couple years."

Notable Cases and Enforcement
Levine highlights significant cases, such as the lawsuit against data broker Kochava, where the FTC successfully argued that invasion of privacy constitutes an actionable injury under the FTC Act, even without financial loss.

[14:42] Samuel Levine: "The judge rejected them. This was in Idaho, and the court said, actually invasion of privacy alone can be an actionable injury under the FTC Act."

---

Antitrust vs. Consumer Protection: Shifting Priorities

Durability of Antitrust Changes
Chapell observes that antitrust reforms, influenced by figures like Lina Khan, have gained more traction and durability compared to privacy enforcement changes, which appear more vulnerable under shifting political landscapes.

[14:42] Alan Chappelle: "It seems like the antitrust changes have at least thus far proved to be a little bit more durable than the changes to privacy enforcement."

Political Dynamics and Consumer Protection
Levine discusses the challenges consumer protection faces under conservative administrations, which may prioritize deregulation and view robust consumer protection as antagonistic to business interests.

[15:06] Samuel Levine: "We have yet to see what the privacy work will look like. ... Consumer protection has to be part of that equation."

---

Regulating Privacy: Scale and Scope

Differentiating Between Large and Small Firms
The conversation addresses the complexity of creating privacy regulations that appropriately distinguish between the data processing capabilities of large tech giants like Google and smaller ad tech companies.

[22:07] Samuel Levine: "There's not a direct correlation always between the size of a company and how much data it processes."

Systemic Risk in Privacy Regulation
Levine draws parallels with financial regulation, suggesting that privacy laws should consider systemic importance, imposing stricter oversight on companies whose data practices pose significant risks.

[22:35] Samuel Levine: "We need to identify your benchmark there merit heightened scrutiny... analogous in privacy law."

---

Self-Regulation vs. Federal Privacy Legislation

Limitations of Self-Regulation
Levine critiques self-regulation in the privacy space, citing its poor track record and the necessity of a strong enforcement backbone to make it effective.

[26:58] Samuel Levine: "Self regulation can be a complement. ... it can not be a substitute for enforcement."

Need for Comprehensive Federal Law
Both host and guest agree on the insufficiency of self-regulation and the urgent need for robust federal privacy legislation to establish clear, enforceable standards.

[25:30] Samuel Levine: "If privacy regulation just entrenches the dominance of incumbents... that is not the kind of privacy protection we want to see."

---

The Do Not Track Syndrome and Its Implications

Challenges with Do Not Track (DNT)
Chapell and Levine discuss the shortcomings of the Do Not Track initiative, highlighting how it was co-opted by large tech companies to maintain their dominance while offering superficial privacy improvements.

[33:43] Alan Chapell: "They were very, very much geared towards larger entities and first parties... designed to put those companies out of business and enable big tech to dominate."

FTC’s Response and Future Directions
Levine explains the FTC’s attempts to address first-party data usage and the complexities involved in regulating it effectively.

[38:27] Samuel Levine: "Companies like Goodrx and Better Help ... cannot share sensitive health data for purposes of targeting ads without affirmative express consent."

---

Notice and Choice: Critique and Alternatives

Fundamental Flaws of Notice and Choice
Levine critiques the notice and choice paradigm, arguing that it places unrealistic burdens on consumers to understand complex privacy policies and failing to offer meaningful protection.

[43:37] Samuel Levine: "No human has enough time to read every privacy policy for every digital service they use... It’s a profound failure."

Potential for Hybrid Regulatory Models
They explore the possibility of hybrid models that incorporate baseline protections with mechanisms for consumer consent, akin to how food labeling operates alongside safety regulations.

[50:18] Samuel Levine: "Baseline protections ... and then for particular uses, if there's really benefit, ... allow some consent mechanism."

---

Conclusion and Future Outlook

Alan Chapell and Samuel Levine conclude by emphasizing the necessity for comprehensive federal privacy legislation to complement enforcement efforts. They advocate for a balanced approach that protects consumers while allowing innovation, urging policymakers to learn from past regulatory successes and failures.

[53:04] Alan Chapell: "Samuel Levine, this has been an absolutely wonderful conversation... Subscribe to the [e-mail]... And thanks for listening."

---

Key Takeaways

• Historical Context Matters: The FTC’s approach to consumer protection and privacy has been significantly shaped by historical regulatory philosophies, particularly those from the Reagan era.

• Unfairness as a Priority: Renewed focus on unfair practices beyond deception is essential for effective consumer protection in the digital age.

• Regulatory Balance: Effective privacy regulation requires distinguishing between different scales of data processing and addressing systemic risks without stifling innovation.

• Beyond Self-Regulation: Self-regulation alone is insufficient; robust federal legislation with strong enforcement mechanisms is necessary to protect consumer privacy effectively.

• Rethinking Notice and Choice: The traditional notice and choice framework is inadequate for modern privacy challenges, necessitating new models that provide baseline protections and meaningful consumer consent.

---

Notable Quotes:

• Samuel Levine [05:18]: "There was a real focus on, let's just make sure consumers have the right information and otherwise stay out of the way."

• Samuel Levine [14:42]: "Invasion of privacy alone can be an actionable injury under the FTC Act."

• Samuel Levine [22:35]: "It's quite different when United House Right has a massive data breach and it shuts down much of our healthcare system."

• Samuel Levine [43:37]: "Consumers should read privacy policies and if they don't like it, they should not use that service... Maybe that made sense 25 years ago, I don't think so."

---

This comprehensive summary captures the essence of the episode, outlining the key discussions on the FTC's evolving role in consumer protection and privacy, the impact of historical regulatory shifts, and the pressing need for effective privacy legislation.

Transcript

[Alan Chappelle]

Alan I'm Alan Chappelle, host of Market, where we talk about the big issues impacting digital media, from privacy to antitrust and the impact of big tech. We take the big ideas and break them down to help you see the future of the ad space. Join me wherever you listen to podcasts. Welcome to the Monopoly Report. The Monopoly Report is dedicated to chronicling and analyzing the impact of antitrust and other regulations on the global advertising economy. If you are new to the Monopoly Report, you can subscribe to our weekly [e-mail] and you can check out all of the Monopoly report [e-mail] I'm Alan Chappelle. This week my guest is Samuel Levine. Mr. Levine served as the director of the FTC's Bureau of Consumer Protection, where he oversaw enforcement, rulemaking and policy work across a wide range of areas including privacy, data security, marketing, financial services, digital advertising, consumer reporting, algorithmic decision making, and small business financing. Before his appointment as Director, he served as an attorney Advisor to Commissioner Rohit Chopra. Prior to joining the FTC, Mr. Levine worked for the Illinois Attorney General, which where he prosecuted predatory for profit colleges and participated in rulemaking and other policy initiatives to promote affordability and accountability in higher education. I am really excited to get Sam's thoughts on the history behind the FTC shift on privacy and consumer protection during the Lina Khan era. There's been lots of coverage around the shift away from the Reagan era approach to antitrust, and having read the recent law review article that Sam co authored with Lynn Lena Khan and Stephanie Wen, I want to get Sam's thoughts on how the Reagan era may have equally shifted consumer protection and privacy enforcement, and more importantly, how the Khan FTC looked to challenge that entrenched enforcement approach. By the way, the article Sam co authored is titled After Notice and Choice Reinvigorating Unfairness to Rein in Data Abuses. I'll point to it in my LinkedIn page. So let's get to it. Hi Sam, thanks for coming on the pod. How are you?

[Samuel Levine]

I'm well. It's great to be here.

[Alan Chappelle]

Well, I really appreciate you giving me a couple of minutes of your time. So most of my audience, which is really the the digital media community, most of them have a sense of the role of the FTC generally. But would you mind sharing what your role was as Director of the FTC Bureau of Consumer Protection?

[Samuel Levine]

Certainly. So the probably audience knows the FTC is quite an old agency founded in 1914 during the Progressive Movement and two primary missions, though I see them as I really think of it as one mission though. The common view is the FTC is two missions. Enforcing the competition laws, making sure companies aren't engaged in monopolization, unfair methods of competition, and enforcing the consumer protection laws and in particular the FTC act which prohibits practices that are unfair or deceptive. I think if you, if I had to describe that at one mission, it would be making sure markets are fair for consumers, consumers and fair for businesses. My role at the FTC was the consumer protection half of that mission. Making sure companies were not engaging in unfair or deceptive practices. That's a pretty broad term. Happy to get into that if that's helpful, but our jurisdiction and work span just about the whole economy. We worked on privacy, on fraud, kids and teens and their mental well being, you name it, we were involved really. You know, we only had about 450 people in the Bureau of Consumer Protection, but I think we really punched above our weight how much we were able to achieve for the American people.

[Alan Chappelle]

Yeah, I've always thought of it as a say what you do and do what you say type of a role where you guys would monitor that, at least as far as the, the, the ad tech community was concerned.

[Samuel Levine]

Yeah, it's worth noting though, that is certainly true. You need to do what you say and you need to say what you're going to do. But one of the things we really tried to do over the last four years, you know, unfair. So the authority is prohibiting unfair deceptive practices. What you just described is really the deception prohibition. You got to do what you say, you got to say what you're going to do. One of our priorities over the last four years, and I'm sure we'll get into this, was looking at the other half of that authority, unfairness. And what that involves is practices that are harmful to consumers. Even if you disclose them away, even if you include them in the privacy policy, the FTC has authority to challenge those practices if it's causing harm. And that's been one of the key focuses of our work over the last couple years.

[Alan Chappelle]

Yeah, and one might argue, I mean that, well, firstly that unfairness cases are generally speaking a little harder to bring. But also perhaps, and these are my words, that the FTC had under focused a bit on the unfairness and had focused a lot of its efforts, you know, prior to the Khan administration on the, the deceptive practice portion.

[Samuel Levine]

I'm happy to respond. Now I think the FTC absolutely under focused on unfairness and you can trace that history very directly to the Reagan Years where when, you know, Reagan came in and there was this big effort to deregulate and shrink the size of government, the FTC in many ways was ground zero. And one of the first things the FTC leadership did in that era was they stopped, largely stopped writing rules and they largely stopped bringing unfairness cases. There was a real focus on, let's just make sure consumers have the right information and otherwise stay out of the way. And I know we'll get into this, but if you look at the privacy regime you've lived under for the last quarter century, where there's this ridiculous fiction that consumers can protect themselves from reading disclosures, I think you can trace that directly. The abandonment of unfairness in the early 80s and the real focus on just tell consumers what you're going to do. Doesn't matter what you're going to do, so long as you tell them that was a problem.

[Alan Chappelle]

Yep. No, and this is a great point. I mean, so I do want to get into this a little bit because I think, broadly speaking, you know, the Khan FTC had successfully pushed back on two historical impediments to regulatory the FTC's regulatory power. You referenced one of them. There's sort of been a good deal of discussion around reframing of antitrust law and what I would characterize as a move away from the. The Chicago school. But there's a second trend, and that's what I think you were really getting at, where there's a consumer protection trend which also derived from the 1980s philosophy of getting governments off our backs. I'm just curious, like, how did you guys, as you were. You were thinking this through? Because I think this is the part that gets under. Discussed. The antitrust stuff, I feel like gets. Gets discussed a bunch, but not so much on the consumer protection side. So I really would love to get your thoughts on how that came about.

[Samuel Levine]

Yeah, absolutely. I think the whole way I got into consumer protection, I've been in it my whole career. My legal career is I was doing foreclosure defense during the financial crisis. This was when I was in law school, actually, and I was practicing law under supervision of a professor. And I was shocked and frustrated that the government allowed lenders to give these exploding mortgages to my clients. I questioned why that was even legal. And I questioned, even during the Obama administration, why so little was being done to help homeowners and hold these large financial institutions and their executives accountable. And over the years, especially after joining the ftc, I started to explore that history. And here again, I Think you can trace that shift to the early 1980s where the FTC issued a policy statement on unfairness where it said, markets are largely self correcting and we can generally rely on consumers to. I'm paraphrasing. We can generally rely on consumers to protect themselves so long as they have accurate information. That was a really profound shift. And it wasn't only privacy that it impacted. If you look in the early 90s, many calls on the FTC to challenge the marketing of tobacco products to kids. I'm not talking vapes, of course. I'm talking Joe Camel and the future director of the FTC's Consumer Protection Bureau. My predecessor vigorously lobbied on behalf of the tobacco companies and the FTC said, sorry, we can't do it. Our Fairness Authority can't reach it. Fast forward a decade later. You see the explosion in subprime mortgages and FTC sat on the sidelines and you had that same consumer protection director, my predecessor, going to Congress and saying, we're going to make sure that subprime lenders tell the truth, but we are not going to do anything to. He said this explicitly. We are not going to do anything to discourage subprime lending. That would be inappropriate. And I think. And you can fast forward to the student loan crisis after, you know, in the last 15 years and you see similar dynamics. There's so many of the financial and social crises we've had over the last few decades. I think stems at least in part from this attitude that markets are fine on their own, government should stay out of the way and just make sure that promises are kept. That, to me was the wrong vision for economic governance. And I'm glad that we started to architect a shift over the last few years and I'm hopeful that will endure. But we can talk about that.

[Alan Chappelle]

Yeah. It's absolutely fascinating to me how many of the things that we are currently suffering from right now can be traced back to the 1980s.

[Samuel Levine]

I'm a consumer protection guy, but it's a much bigger story, as you know.

[Alan Chappelle]

Yeah. So this, this particular thing may have fallen through the cracks of history a little bit, but I can remember one of your predecessors at the FTC Bureau of Consumer Protection, I think it was David Vladek, who. And it might even extended to Chair Leibowitz, but they were talking about ethereal harms, harms to someone's dignity being potentially actionable under section 5. And so over the past few years, it seems like your office took similar positions. But I'm curious, how were you able to move past Talking about ethereal harms to actually enforcing against those types of harms.

[Samuel Levine]

Here again, and we could talk about whether the harms are really ethereal, but the way I would put it is non financial harm harms that are not consumers directly losing money. And here again, I want to do a little bit of history here because in that same policy statement where the FTC said that markets were self correcting, it said that even though Congress simply said go after unfair practices, the FTC on its own, without any statutory basis said we're really only going to focus on financial harms. Non financial harms, they gave an example of emotional distress are not going to be actionable. I can't emphasize enough this was a agency veto of congressional directive, right. This was not in the FTC Act. And that really continued to shape the FTC's privacy work in the early 2000s. The chairman of the FTC, Tim Buris, he would take the position that unfairness simply can't reach information sharing, data sharing practices because of the limits self imposed in the 1980 policy statement. I think David Vladek and others during the Obama administration, David's a friend of mine and I'm a great admirer of him and his whole career began to question that and say these are real, you know, when, when you can track someone down and stalk them like these are real harms. When a company can learn what medication I'm taking without my knowledge and use it to target me with ads, they that's a real invasion of my privacy and harm to my dignity. But you're right, there was a lag, I think, in bringing cases to follow up on that. That is something we very much tried to do over the last four years. We brought a whole series of cases, challenges as unfair, the sharing of sensitive health data, the sharing of especially sensitive location data by data brokers, the sharing of browser data. And we did not allege consumers lost money. We alleged it was likely to harm them either their dignity or their well being or their safety. I think there were a number of reasons why we had success here. I think the biggest one, you know, first, you know, we have an outstanding teams of lawyers and economists and technologists that played a big role in it. But you also can't ignore what was happening in the real world. Just a couple days ago you had a tragic shooting of lawmakers in Minnesota. And we now know that the alleged shooter was finding their addresses through data brokers. In 2022 you had the Dobbs decision, which of course made it allowed states to prohibit abortion and Here again, there was a. Well, all these data brokers out there are making it very easy for anyone, including law enforcement, to track down whether people are visiting abortion clinics. This is going to have real world impact. And I should say it's not. This is not just a left wing concern. Anyone concerned about political liberty, economic liberty. If I'm a conservative or I should say if I'm a gun owner, I don't know that I want to be tracked by these data brokers. So I don't think of it as left or right. I think about as sort of fundamental American values of our. Our independence and our privacy. So we really tried to translate those values into our enforcement work. We won a really significant programmatic victory when we sued a data broker called Kochava. The company moved to dismiss our complaint, basically parroting arguments that the FTC itself had made in the early 1980s that there's no financial injury alleged. They didn't use the word ethereal, I don't think, but maybe they could have. And the judge rejected them. This was in Idaho, and the court said, actually invasion of privacy alone can be an actionable injury under the FTC Act. And we got bipartisan support for that case and enthusiastic bipartisan support for that case. And I think that reflects the shift we have begun to see in consumer protection, mirroring the shift we've begun to see in antitrust.

[Alan Chappelle]

Well, and that's something I wanted to ask you about because from my vantage point at least, I think we've seen a pretty significant shift from the Biden area to the Trump 2.0 era when it comes to changes in antitrust law. And it seems like the antitrust changes have at least thus far proved to be a little bit more durable than the changes to privacy enforcement. Why do you think that's the case?

[Samuel Levine]

It's a really difficult question. I think it's something I've thought about a lot and I don't know the answer to. But a couple points I will raise. First, I think, especially during the COVID lockdowns, a lot of the claims of what happened then are not true. But there was certainly a sense, and there was some basis for this, that large tech companies were silencing certain disfavored voices, certain disfavored political opinions. And I think that was a wake up call for many conservatives that you really can't disentangle corporate monopoly from political control. In an environment where large companies control the means of communication, those companies have a lot of power to shape the political discourse in a way that rightly raised concerns with people on the political right just as it's raised concerns with people on the political left. I think that helps to explain the heavy focus in this new Trump administration on stopping, you know, big tech cartel. They use that term, censorship cartel. I think they used that term. Now, it remains to be seen how that work plays out. Are they using antitrust to target political enemies? Are they narrowly focused on censorship by tech companies? Or are they going to examine monopolies in agriculture and all sorts of other industries in grocery, where we have a serious consolidation problem? I think that remains to be seen. But you're right, we haven't even seen those gestures yet in the world of consumer protection. And on the contrary, we see this administration taking an absolute wrecking ball. The Consumer Financial Protection Bureau, which is going to be, it already is quite disastrous at the ftc, it's a different story. The FTC Bureau of Consumer Protection that I led is still going, it's still bringing cases. I think we have yet to see what the privacy work will looks like. Here are my two sources of optimism. I have plenty of pessimistic, plenty of reasons to be pessimistic, but I'll share two reasons to be optimistic. First, some of our biggest initiatives that were not privacy, this administration has continued. So we finalized a rule to make subscriptions as easy to cancel as they are to enroll in. It's been challenged in court by just about every big industry you would think would challenge it in court. The Trump administration is vigorously defending that rule, which is not something we should take for granted given how they've rules and the junk fee rule, which prohibited hidden resort fees by hotels and hidden fees by companies like Ticketmaster and the concert space. This administration, you know, they, they've rebranded it, they sort of tied it to President Trump, but they're enforcing it. And my hope is that they will see, and I think they're already seeing with junk fee, that this kind of work has broad popular support. This is the kind of thing that's not only legally sound and economically sound, but is politically popular. And it's my hope that they see that work paying dividends for them, even though it was launched and completed under the previous administration, and that they realized that if they're really going to be a party of working class people, which is what they profess to be, then consumer protection has to be part of that equation. Stopping low income and middle income people from getting ripped off has to be part of that equation. And if they want to be a political party that safeguards People's political liberty, which is another concern that they say really animates them, then they have to be concerned with privacy because you know, if folks like Rand Paul and others are concerned about big government surveillance and they should be, they should be concerned about big tech and big data commercial surveillance because there's really no distinction anymore. So I, I hope that there's a, a, a realization of that on the right. But I think there's a lot of sorting out to do within that political movement about what approach they're going to take. And then you see this every day. The Reagan era government hands off industry or maybe a new Trumpian vancy envision of more government involvement.

[Alan Chappelle]

So in, in my view, two thoughts, the Mark Mador speech, which came off to me at least as a pretty thorough repudiation of the Chicago school, and the Robert Bork view of antitrust enforcement, boy, that's going to be hard to walk back. I'm not going to say they can't do it, but that's really hard to walk away from. And my second observation is that from a conservative mind view the precise location as a harm argument is probably there's a straighter line for them to make in part because you said, even if they don't necessarily agree with the mindset that says maybe we need to protect people who are getting reproductive healthcare in places where, where that's restricted, they can certainly see the idea that a precise location that enables reidentification to somebody, which enables stalking, that, that is a pretty tangible harm.

[Samuel Levine]

I think that's absolutely right. I would certainly encourage folks to read Medder speech. I can't remember the name of it now, but I remember how much it angered erstwhile allies on the right, like you know, folks, you know, chamber of commerce type folks who said, well this, it doesn't sound very conservative, but he was exactly right. It's really a return to some of the origins of, of conservatism and likewise on, on the consumer protection side, which you know, he didn't really get into in his speech and I think it remains to be seen how he's going to approach that. But giving large companies and then effectively the government to the ability to track where we are all day long, wherever we go to, does not sound very conservative to me. Does not sound like something the founders would have felt comfortable with. That's why we had a fourth Amendment. It does not sound like something conservatives who may be in, you know, minority religious communities who may be engaged in political protests, does not sound very conservative to give companies the ability to track that. So I hope that we are seeing the beginning of a shift. But candidly I think in the consumer protection world we have to learn a little bit from the success in the antitrust world of changing hearts and minds and ultimately policy.

[Alan Chappelle]

I would agree. So I've made the point that one of the biggest challenges that I have with almost every privacy law is that they don't adequately distinguish between the scale and the scope of data being processed. We sort of do that in the US or historically at least with respect to ISPs and telcos. But the idea that the standards set for Google or Apple are practically identical to the rules for some tiny ad tech company seems at best problematic to me. I would love your thoughts on this. Do you agree? Do you disagree?

[Samuel Levine]

Do we have to be concerned from both a consumer side and any trust side with or are we, are we going to treat the Googles of the world the same way as we're going to treat a small ad tech firm? And the answer is challenging. So you know, the first point is that and in our regulatory work we had to grapple with, with this quite directly is there's not a direct correlation always between the size of a company and how much data it processes.

[Alan Chappelle]

The EU is struggling with that a little bit as they revamp the gdpr. Right?

[Samuel Levine]

Absolutely. And I, I sympathize. It's not easy. I have not seen any sort of straightforward solutions to this. I think that is a real concern. One thing that I think about is where in other areas of regulation that are more developed, how have we approached this problem? If you look in financial regulation, especially post Dodd Frank financial regulation, you do see a distinction between systemically important financial institutions and much smaller ones. And for systemically important financial institutions are subject to higher oversight. This Consumer Financial Protection Bureau, one reason it's so dangerous that they're being shut down is they also have the ability to designate certain institutions as larger participants which can subject them to heightened supervision by the cfpb. So there's this notion that even though we have laws applied to the whole, you know, sector wide large companies that pose particular systemic risks to consumers to privacy, you can identify your, your benchmark there merit heightened scrutiny. Historically in the U.S. you know, we don't have a supervisory regime in place for large tech companies. I think they're real questions whether we should. But I think that is one path forward. The financial architecture is not perfect, but it recognizes that even though a corner payday lender can cause immense harm in their communities and should be subject to strict state and federal regulations on, you know, the kind of loans they can offer. They don't pose the kind of systemic risk. And I do think that's analogous in privacy law. You know, it's, it's, it's one thing if the bakery down the street has a data breach. I'd be embarrassed by people knew, you know, my chocolate, my chocolate chip cookie law. But it's quite different when United House Right has a massive data breach and it shuts down much of our healthcare system and exposes consumers most sensitive health information. The concept of systemic risk and systemic importance is one that's a little bit foreign to literally to US Privacy enforcement, but I think is one we have to take seriously.

[Alan Chappelle]

No, I think that makes sense. And the challenge there. So it's funny, I think we're in alignment in that, that there should be some kind of approach so as to distinguish different companies based on. I hate to use the word harm, but you kind of know what I mean. But the mischief that they might be able to cause. I think the challenge then becomes, all right, well, how do you set up those categories? And then how do smart business people figure out how to game the categories? But I think we've reached a point where doing nothing isn't working for us and that we need to do something. And maybe that's the federal privacy law that everybody's been talking about at least as long as I've been in the privacy space, which is over 20 years.

[Samuel Levine]

Yeah, I think that's exactly right. And look, the financial architecture post Dodd Frank was not perfect at all. Big banks today are bigger than they were then. But at least, you know, Dodd Frank was the process of a lot of stakeholder input. It did lead, I think, to real protections for people that have made our financial system more resilient than it was 20 years ago. You now see industry trying to roll back a lot of those protections. You see agencies that have not actually followed up with the rulemaking obligations we had. But all in all, would I rather have, you know, sort of the financial regime or there at least was a comprehensive law that was the product of stakeholder engagement and addressed real problems in the privacy space. I would. And I think the sad thing is it took a global financial crisis to spur the passage of Dodd Frank and a Congress absolutely capable of writing laws. I don't know if that's going to be possible in the privacy space. You know, if we had a more functional Congress, it would have happened a decade ago or more.

[Alan Chappelle]

Well, okay, so in the absence of congressional input here, I'm going to turn to self regulation. And what do you see as some of the primary opportunities and challenges presented by self reg with respect to privacy in the digital media space? I mean, can self reg work or is there something that is endemic about self reg or the digital media space that renders it ineffective over the long term?

[Samuel Levine]

I don't think self reg is necessarily ineffective, but the track record is very poor, not only in the privacy space, but in many other industries I've been involved in. You know, if you look at the early history of the Internet in the late 90s, first in the Clinton administration, the FTC, I think still breathing the air of the 1980s around, you know, government hands off said over and over they issued the series of reports in the late 90s, privacy seems to be a big problem on the Internet. What are we going to do about it? We're going to see if self regulation is going to work. That seems to be the best approach. It was bipartisan and report after report, and we document this in a law review article that came out, the FTC said, well, self regulation has not been working, but we're going to give it another chance. We're going to give it more time. Uh, we're going to keep waiting. And of course it never worked. In 2002, the then chairman, or late 2001, Tim Uris, the then chairman of the FTC, said something similar. He said, I don't think we need privacy legislation. It appears that tech companies are taking privacy seriously. This was the same time that Google was suddenly discovering that they could mine people's search data to target them with ads. The birth, I think, of the surveillance economy. Then you fast forward to the Obama years. I'm sure you remember these battles. Well, there was this whole idea that companies were going to adopt do not track protocols voluntarily. Those went absolutely nowhere. I mean some browsers I think still you can do not track, but websites don't even honor them. And I think the lesson from this is that if self regulation works, you need a strong enforcement backdrop. It can be a compliment for enforcement. It cannot be a substitute for enforcement. You know, one of my big jobs at the FTC in addition to privacy was national advertising. Now national advertising is not per making sure it's truthful. National advertising is not perfect. I see deceptive ads, you know, from time to time. But you do have a pretty robust self regulatory system there where companies will file complaints about each other. There's an organization and national advertising division associated with the Better Business Bureau that will review those ads and make determinations. Companies don't clean up their ads, they refer cases to the FTC and we will sue frequently. And you know, it works decently well and it's endured across administrations. But I do think self regulation can be a compliment. But this notion that some of my predecessors adopted that it can be a substitute for real laws is belied by every time it's ever been tried in any industry ever. And I think we have to learn from that history.

[Alan Chappelle]

So I agree with a couple of things that you're saying. I think that self reg in the ad space, it did not develop quickly enough with the times. I don't think that's a disputable point. And I think that in retrospect what, what that ended up, the net output of that was some of the state rules that many of us in the ads base are currently complaining about because there was a regulatory void and that void was not filled by Congress. And for a long time, arguably, and I'm oversimplifying, but arguably that void was also not covered by self regulation or at least not covered well enough. And the net result of that was that you have all these states coming in. But that's not actually my real problem with the approach of the last decade. My real problem with the approach is look, as a business person I get you want to have a low rule set as you can possibly have. However, the net net of that is that there are two constituencies who really, really impact for not having a high enough rule set. The first constituency are the shady people, the people like who are really just looking to manipulate. And then the second constituency is big tech. And so for those of us who are trying to eke out a good living trying to innovate and trying to, to build something on some level, having a particularly low rule set is not necessarily our friend.

[Samuel Levine]

Yeah, no, I, I, I think that's right. And this is the point I, I tried to make all the time at, at the ftc. I mean there was this notion that vigorous consumer protection enforcement and this is completely parallel by the way on the antitrust side. The vigorous consumer protection enforcement is anti business. We heard from businesses all the time that wanted to do the right thing. I strongly believe most businesses want to do the right thing. And most businesses are honest. I consider myself pro business but they compete with people who cheat. I mean junk fee is a great example. It's a little more probably relatable to people than privacy. If I'm a hotel and want to advertise my prices, honestly. But my competitor is artificially lowering their advertised price and then charging fees on the back end. I'm at a major competitive disadvantage. I can't compete. So I, I have to engage in the same deceptive practice. If I'm going to stay in business. Businesses should not have to make that choice. And the notion that there's this dichotomy between vigorous enforcement and common sense regulation and competitive markets, business formation and flourishing, is wrong. Clear rules of the road are what enabled small businesses and large businesses to compete in a level playing field. That's a lesson that's been learned across industries that I wish and I hope will take hold.

[Alan Chappelle]

So I want to circle back. You made a comment about the do not track days and I was somebody who sat within the W3C attempting to create a do not track standard. Now you and I are coming at this from probably different vantage points. So I'm just going to share what it felt like from my perspective to be in the room. A group of browsers got together and they said, we are not going to let anybody else touch data to target ads, but we are still going to continue sending search data to Google, the scope of which was significantly larger. And all of this is going to be in the name of privacy. That's, that's my first observation of that. Second observation is that it was very, very much geared towards larger entities and first parties. Now that's great if you're the New York Times, but if you're a small ad tech company, that entire process was designed to put those companies out of business and enable big tech to dominate. And I think that was a mistake. And that's one of the reasons I think the whole thing finally imploded. I would love your reaction to that.

[Samuel Levine]

I mean, I think there were, there were legitimate motivations as well. I'm happy to credit that. But you know, you see this all the time. When Google started not really rolling out, but talking about eventually, maybe someday rolling out this privacy sandbox and you know, the messaging was, you know, deprecate cookies. We're going to protect people's privacy, privacy. This is going to solve the problem that policymakers have warned about, people have complained about for a long time. Well, I don't think it's a coincidence that it would have been really good for Google because for tech giants, a had decades to collect massive amounts of data on every human on the planet, just about they have this built in incumbency advantage. So suddenly if you, you know, shut the gate, close the gate, makes A lot harder for upstarts. But they also, as you alluded to, plenty of first party data. They don't need third party data. One of the things we started to do at the ftc, we really needed more time to build this out because we were starting from. Nothing is looking at first party use in addition to sharing with third parties. And that was quite new. You know, we, we brought a case against the telehealth company that was using people's data, wasn't sharing, but was also sharing it. But we specifically allege they were using people's data on, I believe it was their, it was addiction treatment service to directly target them with ads that in a way that compromised the privacy. And this didn't get a lot of attention in the case, but it was very deliberate on our part. We said this was an unfair use of people's, of people's data. What we were trying to do was lay the groundwork for a broader examination of how large companies, you know, the biggest companies are often not sharing sensitive data with brokers, they're using it themselves. That's what's in their interest. That doesn't remove the privacy concerns, certainly especially given the size of these firms. So we were starting to build toward more enforcement and guidance rulemaking potentially in that area. Obviously that was cut short in November. But it's my hope for the same reason we've been discussing, that the new FTC and the new conservative leadership will pick that up because they're absolutely right. If you have and you've seen this abroad, at least you've seen indications of this. If privacy regulation just entrenches the dominance of incumbents and entrenches their ability to collect whatever they want and put others at a competitive, create a moat around their business. That is not the kind of privacy protection we want to see.

[Alan Chappelle]

Yeah, I completely agree. And one other observation, and I think I alluded to this earlier in our discussion of the business community sort of gaming certain things. The concept of first party data is one of the more oft gamed terms where, you know, if you collect it on the New York Times, but then it's being used, you know, three clicks down, it's no longer first party data. The agency, the agency. Holding companies love to like claim everything. They buy a data broker and they say, oh yeah, that data broker, no, now it's first party. As if by magic. And that's one of the challenges and one of the reasons that I'm sort of, I'm a little bearish on the idea that first party data gets kind of an automatic exemption.

[Samuel Levine]

I think you're right to be bearish. And you know, the simplified version of this is for all my friends who constantly ask me why was I searching for a shoe on Safari and then seeing an ad for that shoe on Facebook. You know that, that might not have technically involved transferring of data from one entity to another, but that kind of, that kind of web tracking is exactly what so called first party data represents. And it speaks to how even if you put really strong limits on the sharing of data, if you're not looking at first and grant first party use is tough, like they're tougher. The line drawing there is tougher, but you have to start somewhere. And if you're not putting limits on first party use, you're not really addressing the problem that most people are seeing every day.

[Alan Chappelle]

Yeah, I would agree with that. So cookie deprecation, you know, so the idea of cookie deprecation by browsers really is sort of a wonderful synergy as between competition issues and privacy issues. And I'd love to know how the FTC was thinking about that because you really do wear both hats.

[Samuel Levine]

Yeah, we were having a lot of conversations about it and you know, without getting into too much detail, we were well aware of what the competition and markets authority was doing as well. You know, they were monitoring sandbox carefully. You know, they issued at least one report analyzing some of the harms they were considering. It was something we were tracking a lot was whether is this going to be a positive development for privacy one and there were, there were, there were questions about that, whether some of the substitute tracking technologies that Google was considering really would have been more privacy protective than cookies. So that was one inquiry. And there was also interest in whether this kind of move would entrench again, I'll zoom out from talking about any particular company would entrench, would entrench the dominance of the incumbents. These are really difficult problems to wrestle with. It is why I think, you know, the five years ago you see a lot less of this down, which I think is telling. The big move in Washington was let's create a data protection regulator and their sole job would be to enforce a data, you know, a federal privacy rule. I think that would have been a mistake, at least to the extent that same agency didn't also have competition authority. Because you know, we, we see this in the meta trial, we see this in the, there's a huge overlap between privacy work and competition work, especially in an environment where you have such powerful big tech incumbents and if you're only looking at these markets through one lens, what you risk is creating an environment where you might be protecting privacy in a narrow sense. You're entrenching the ability of big tech incumbents to surveil us constantly and to deepen and to deepen that competitive mode that prevents upstarts. You know, I won't talk about what the right solution is because I don't know what the right solution is. But the starting point is looking at these challenges through both lenses.

[Alan Chappelle]

It's been a really fun five years. I think that even if the competition and markets authority were, were Jo had joined us for this, I think in retrospect they might have gone in a different direction initially. Now, having had the benefit of seeing where all this led to, what I'm hoping is, is that this provides a little bit of a lesson to the DOJ as they look to set up technical committees and, and other things is that some of these big companies are really, really, really good at setting up these types of processes in ways that just sort of waste everybody's time.

[Samuel Levine]

It's a brilliant move. Again, I'm not talking about any company in particular, but I'm curious for your take on this do not track probably delayed momentum on real privacy legislation in Congress in the early 2000s. You know, a bunch of promises by tech companies that they were going to post privacy policies and honor fair information principles probably contributed to the FTC saying we don't need privacy legislation. I've seen this in other industries where they kind of, they look, we're doing some self regulation and you know, the temptation for a regulator who has way too much on her plate and you know, has a much smaller budget than jurisdiction is to say, okay, well it looks like they see us, they're validating the concern, they're taking the problem seriously. Let's wait and see how it goes. And I'm certainly sympathetic to that for all the reasons I said. But the fact is most American companies are not going to push forward initiatives that are not directly in their self interest. I mean, that's capitalism. I don't even fault them for that. I fault regulators who are overly credulous when these promises are made.

[Alan Chappelle]

Well, yeah, so I would agree with you. I might add, Do Not Track was a great sales pitch. It was a buzzword. It was an easy button. And in Washington D.C. if you're out there offering an easy button, you're going to have a lot of uptake on that because it sounds simple. And the problem is, is that it's great to have something that stops tracking, but if nobody in the room agrees what tracking is and nobody in the room wants to negatively impact their business, by that definition you're going to spend years and years spinning your circles. So I've got one more question for you. This gets to your article, which by the way, I thought was excellent, the law review article that you and Ms. Khan and another colleague had published recently. So the concept of notice and choice in privacy circles has been much discussed and often maligned. Daniel Sola made a really good point in that it places too much work on the individual in order to be effective. So what's your biggest beef with notice and choice? And are there instances where it can work effectively? And then maybe. I've got a couple follow up questions.

[Samuel Levine]

And so the concept of notice and choice, you know, we alluded to earlier, it's this idea that, well, consumers should read privacy policy. We'd FTC commissioners say this, consumers should read privacy policies and if they don't like it, they should not use that service or visit that website. Maybe that made sense 25 years ago, I don't think so. But it certainly doesn't make sense today for so many reasons. And I'll just go over them briefly. No human has enough time to read every privacy policy for every digital service they use. Even if they do read them, they're unlikely to understand them. I've read these. I don't always know what they're saying. Even if they do read them and they do understand them, companies have taken the position they can change them at will, sometimes without even notifying people or simply without getting their affirmative consent. So it's not even rational to read them. And then even if all of those things were solved, even if companies had to stick to the policy and you had time to read them and on and on and on, you don't really have a choice. In many markets, the people are completely reliant on digital services. You know, if I'm trying to drive from out to visit someone in a rural community, like I'm, I'm going to need, need an online map service and I'm not in a position to negotiate, you know, what kind of data is collected from it. So it's a profound failure. We were certainly not the first people to say that, but at the ftc I think we were very outspoken about it and I think that made a difference. But you're right, great scholars like Dan and others had really led the charge on that. I think one point that we really tried to make in the article was that notice and choice was not an isolated regime in privacy. That was the broader move in consumer protection. I talked earlier about subprime mortgages. This view that consumers just need to read the loan terms, that we don't actually need baseline limits on the kind of financial products people are sold is a direct analog to notice and choice. I call it notice and choice for everything you asked. When notice and choice can work, you know, at its most fundamental, when you're at a grocery store and you're buying a product, you have a notice of what the price is going to be and you have a choice of whether you want to buy it. So at a very fundamental level, notice and choice is just fine for simple transactions where the notices of a salient characteristic like press. But when you try to govern a whole regime not based on baseline protections, but based on placing this enormous burden on consumers who understand incredibly complex data flows, what you get is no protection at all. And that's really the regime we've been living under now for decades. And I know again the big point of that article was that that was no accident. That was no inevitability. It was born of a philosophy advance in the early 1980s. The markets are self correcting and consumers should protect themselves.

[Alan Chappelle]

So I would agree that that notice and choice is at best imperfect. But I want to poke a little bit at some of what, what you're saying. So you use the food label example. Now it's somewhat helpful because I can see that, you know, these type of peas have you know, 3 grams of protein and this other one has 4 grams. So I'm going to go with the one with the four grams. That said, I don't know what the hell the red dye number seven is and I don't know what artificial colors and flavors are. And so like they are only somewhat helpful if I'm trying to make a decision as between product A and product B. And I wonder, and I'd love for you to refute this, but I wonder if sometimes we are challenging a online privacy notice as needing to be perfect when in sometimes it might just be good enough.

[Samuel Levine]

Well, let, let's stick to food because I think it's, I, I, I, I do think it's analogous. You have a balance and I'm not an expert in food regulations. This is based on my experience walking through grocery stores. Okay, but you have, you, you have a balance, right? You have, I know how much the canopies costs, I know what the protein content is, I know what the, you know, the. I, I know the basic nutrition. I might not know some of the words in the ingredient list because those aren't in the, the core nutrition label, but in the background. And you see this now with RFK Jr, you know, trying to root out artificial dyes, you have certain baseline protections. Like, you know, you, you can't have too much lead, probably any lead in your products. Uh, if your products pose health risks, they're going to be recalled. Um, certain ingredients. You know, there was a huge crackdown, I don't know, 10, 15 years ago on trans fats, and you saw just trans fats being eliminated from product. Do you see this balance between, we're going to disclose a certain amount that's, no pun intended here, digestible for people, but there are also going to be disclosures that we know may not be effective, but in the background, there are basic rules that protect the worst kinds of ingredients, the worst kinds of health risks. I think you can analogize that to privacy, where there's never going to be a perfect regulatory regime either, where government just sets the terms of every transaction and how much data is going to flow between the consumer and the provider. That is never going to happen. Nor is it going to happen where companies can simply disclose everything and consumer's just going to sort it out among themselves. You do need some balance. And inevitably when you have that balance, they're going to be issues, right? There's going to be. Maybe government wasn't anticipating there's a use case that was beneficial. Maybe there's too much burden on consumers, maybe there's too much burden on businesses. There's a really difficult line drawing and privacy. But I would love to have those discussions. We're starting from a place of basically zero baseline limits on what companies can collect and how people can use data. So I think the first step is getting some of those core protections that can't be disclosed away, just as you see in the food contest. And then we can have the very important discussions of when do we want a heavier hand by the state and when do we feel more comfortable leaving it to the market, leaving it to individual transactions between consumers and businesses, or.

[Alan Chappelle]

That so far I'm actually encouraged by how you're characterizing this. Where I think we may agree a little less is conceptually, I think there are some places where we've said, you know, in certain contexts, you can't touch location data, you can't touch certain types of health data. We may disagree on. You know, cancer to me is different than vitamin B. User, but fair enough. So the challenge though is as a practical matter, you know, where do you ultimately draw that line? Because I agree that there should be some prohibitions and honestly I wish if the ad tech community had done one thing and really stayed out of the identifiable world, I think that we would have been in much, much better shape.

[Samuel Levine]

Well, I think that's certainly right. So you know, in terms of the line drawing, I'm certainly not saying we did it perfectly at the ftc. But one thing you can look at and it's not a market wide regulation, but if you look at some of the orders against individual companies, you know, we see companies like Goodrx and Better Help and a number of data brokers is we often had a two tiered regime like for our health privacy cases. And I'm simplifying a little bit. Companies simply cannot share sensitive health data for purposes of targeting ads. But the company said to us, and we recognized there were legitimate purposes that might benefit consumers for sharing health data, what we said is okay, if you want to. So you have this baseline prohibition. If you want to share health data, you need to get the affirmative express consent of the consumer. We defined affirmative express consent to mean they need to actually click yes. It's not opt out. And the company can't use dark patterns, manipulative design techniques to try to trick people. People. Now you might say well isn't that notice and choice and it is some version of that. But if you look at the orders of a whole, this is a kind of hybrid I'm talking about there are strong baseline protections. And then for particular data uses that may be beneficial, there's an affirmative express consent regime that allows consumers to affirmatively opt in. That is harder to do market wide. I don't think it's impossible. You see it in and a number of state laws but that is the kind of balance, I mean this, this isn't about eliminating all consumer choice or eliminating consent as a function. You need some degree of that. To me the notice of choice regime is about there won't be baseline protection. And the move we tried to make is baseline protections. And then for particular uses, if there's really benefit, then you know, we'll allow some consent mechanism.

[Alan Chappelle]

Well, it sounds like you and I should roll up our sleeves and we'll put together a federal privacy law only.

[Samuel Levine]

For it to die at the end.

[Alan Chappelle]

Of the lecture to hold a lot of promise and then to completely fail.

[Samuel Levine]

Yes.

[Alan Chappelle]

Samuel Levine, this has been an absolutely wonderful conversation. I really appreciate you taking the time to Talk to me Sam.

[Samuel Levine]

It's been a great conversation. I think we covered a lot, from the labeling of hand peas to the deprecation of cookies. I must be hungry for breakfast. But it's really been great talking to you.

[Alan Chappelle]

To you as well. Have a good day.

[Samuel Levine]

Thanks. Take care.

[Alan Chappelle]

That was a really interesting conversation. I hadn't fully considered the idea that the pushback of the Reagan era approach to regulation extended beyond antitrust and into privacy and consumer protection. I feel like Sam and I agreed a bit more than we disagreed when it came to regular regulating privacy, and it didn't seem like he was completely down on either self regulation or the concept of notice and choice as privacy tools. Rather, his criticism is that each of those tools can be helpful, but that neither Self Reg nor Notice and Choice as a framework should be the only tools in the toolkit. And I would generally agree with that. I didn't mean to specifically call out the ad industry self regulation approach, except to say that I think self reg could have gone a bit further. I'm hoping to have more of these types of discussions with current and former policymakers. Please subscribe to the show@monopolyreport pod.com or on Spotify, Apple, YouTube, or wherever you listen to your podcasts. And thanks for listening.

[Samuel Levine]

Thank you for listening to the marketexture podcast. New episodes come out every Friday and an insightful vendor interview is published each Monday.

[Alan Chappelle]

You can subscribe to our library of.

[Samuel Levine]

Hundreds of executive interviews at marketecture tv. You can also sign up for free for our weekly newsletter with my original strategic insights on the week's news at News marketure tv.

[Alan Chappelle]

And if you're feeling social, we operate.

[Samuel Levine]

A vibrant Slack community that you can apply to [e-mail].