The FTC has adopted an expansive rulemaking agenda. A recently finalized rule banning noncompete agreements was immediately met by several suits challenging its legality. Nevertheless, observers expect that the FTC will soon publish a proposed rule addressing “commercial surveillance,” which may include “data security collection, the use, retention, and transfer of consumer data, automated decision-making systems, discrimination based on protected categories, and consumer consent.”

Once proposed, the Commission will receive some more comments, refine the rule based on those comments, and then finalize the rule. In short, there’s a long way to go before this rule is enforced and a lot of factors could shape its final contents.

Still, it’s important to analyze the legal barriers facing a final rule on this topic. This essay aims to do just that. Assuming the proposed rule becomes a finalized rule, it will surely be met by substantial scrutiny. An outline of the likely legal challenges that it will face suggests the rule may have a short life span. If that’s the case, then the FTC may want to think twice before using its already limited resources and tapping into a depleted bank of political capital.

Background on the FTC and its Authority (or lack thereof) to Regulate Commercial Surveillance

Section 5 of the Federal Trade Commission Act declares as unlawful “unfair or deceptive acts or practices.” The FTC, pursuant to the Magnuson-Moss Act, the FTC Improvements Act of 1980, and the procedures therein, may promulgate “rules which define with specificity acts or practices which are unfair or deceptive acts or practices[.]” The procedures “therein” are not insignificant—and that’s as intended.

Lawmakers aimed to constrain the FTC’s rulemaking authority following a spate of Commission actions that suggested it had become unmoored from its proper position as a creature of Congress. Designed as “an investigating and advisory body,” the FTC drew Congress’s ire when it acted more like a mini-Congress with its own public policy agenda. One particular action—a failed attempt to prohibit TV advertisements from targeting children—resulted in The Washington Post referring to the FTC as the “National Nanny.” The moniker stuck, and Congress responded.

Congress went so far as to fire the Nanny for a few days—lawmakers withheld funding from the Commission, which forced it to shut down for a spell. Later, the Commission earned only the tepid support of Congress—the FTC was saddled with numerous restraints and subjected to increased oversight. Congress insisted that the Commission inform certain committees of its proposals and plans. Lawmakers also limited the sorts of unfair or deceptive acts or practices that the Commission may target. The Commission must have “reason to believe that the unfair or deceptive acts or practices which are the subject of the proposed rulemaking are prevalent” prior to issuing a notice of proposed rulemaking. That prevalence determination can come about through two avenues: one, the Commission has “issued cease and desist orders regarding such acts or practices,” or two, “other information available to the Commission indicates a widespread pattern of unfair or deceptive acts or practices.”

For decades, the FTC seemed to pick up on the hint suggested by these hurdles—don’t tread on Congress’s terrain—and held back from issuing substantive rules. Chair Khan and her Democratic colleagues have opted to instead revive and arguably enlarge the Commission’s rulemaking authority. Hence, their willingness to initiate the rulemaking process to address “commercial surveillance,” defined by the Commission as “the business of collecting, analyzing, and profiting from information about people.”

The Commission’s Advanced Notice of Proposed Rulemaking (ANPR) on commercial surveillance from August of 2022 included 95 questions, many of which (such as those below) indicate that the FTC is weighing a substantial, wide ranging rule. Here are three of the questions:

  • To what extent should the Commission, if at all, make regular self-reporting, third-party audits or assessments, or self-administered impact assessments about commercial surveillance practices a standing obligation?
  • To what extent should the Commission rely on third-party intermediaries (g., government officials, journalists, academics, or auditors) to help facilitate new disclosure rules?
  • To what extent should new trade regulation rules prohibit certain specific commercial surveillance practices, irrespective of whether consumers consent to them?

Unsurprisingly, given the breadth of the ANPR, scholars, stakeholders, and Commissioners themselves have debated both whether the FTC has the authority to proceed with this rulemaking and, if so, the extent of that authority. The remainder of this essay covers three topics of debate—selected based on their likelihood of undermining whatever rule the FTC attempts to finalize.

Threats to the Viability of a Commercial Surveillance Rule

Major Questions Doctrine

Under the Major Questions Doctrine, Congress “must speak very clearly if an agency is to be authorized to undertake actions of great political and economic significance.” Professor Cary Coglianese notes that the Supreme Court has yet to develop a clear test for what qualifies as "major." Instead, his review of the case law suggests that "major" is in "the eyes of the beholder."

Given that test, a majority of the Court seems likely to stare down the FTC’s commercial surveillance rule, even if the finalized rule is significantly narrower than as suggested by the ANPR. The ANPR contains all the ingredients of a fully-baked MQD case: major economic impact (acknowledging that "[c]ompanies' lax data security practices may impose enormous financial and human costs. Fraud and identity theft cost both businesses and consumers billions of dollars, and consumer complaints are on the rise") and major political impact (noting "recent steps taken by lawmakers to advance federal privacy legislation").

In the eyes of any Justice already skeptical of the FTC specifically or agency power generally, this may look quite a lot like a major question. What’s more, since the ANPR, the odds of Congress passing its own comprehensive privacy act seem to have increased—lending weight to the argument that this is exactly the sort of question Congress aimed to keep for itself.

Chair Khan maintains that such a rule nevertheless falls within the Commission’s authority given its purported role as the “country's de facto law enforcer in this domain.” It is true that, as the ANPR puts it, the FTC "enforces a number of sector-specific laws that relate to commercial surveillance practices.” Yet those specific, finite delegations from Congress may actually cut against the idea that the FTC has the authority to issue a cross-sectoral rule—especially from the perspective of skeptical Justices.

Whether the Major Questions Doctrine poses a small or significant threat to the final commercial surveillance rule will depend on the rule’s scope. It may be the case that the FTC has anticipated this challenge by curtailing the topics covered by the proposed and, eventually, finalized rule. In that world, this doctrine would be far less of a threat. Based on the reach of the FTC’s recent noncompete rule, however, the odds of the FTC going small on this rule are slim. The upshot is that the Major Questions Doctrine will likely pose a severe threat to the viability of the Commission’s commercial surveillance rule.

Non-Delegation Doctrine

Since 1935, the non-delegation doctrine has been the equivalent of a Little Leaguer playing in Major Leagues—present, but ineffectual. Under the prevailing test, Congress need only “lay down by legislative act an intelligible principle to which the [executive official] is directed to conform” to avoid violating the separation of powers set forth in the Constitution. “[T]he notion of an ‘intelligible principle,’” according to Professor Phillip Hamburger, “sets a ludicrously low standard for what Congress must supply.” That low standard explains why almost every delegation of legislative power from Congress to an agency has been upheld.

The current Supreme Court seems poised to resurrect a stronger version of the non-delegation doctrine. If that’s indeed the case, Justice Gorsuch’s test from Gundy may become the new threshold for congressional delegations. Pursuant to that test, Congress may only delegate power (1) “to ‘fill up the details’; (2) to make the application of a rule dependent on certain executive fact-finding; or (3) to assign nonlegislative responsibilities to either the judicial or executive branch.”

If the finalized commercial surveillance rule were subject to this test, it is unclear whether it would fail. On the first prong, the presumably broad reach of the commercial surveillance rule will likely result in the Justices having a high degree of skepticism that the FTC is merely “fill[ing] up the details” on Congress’s behalf. On the other hand, if the Justices confine their analysis solely to the text purportedly authorizing the rule—to “define with specificity acts or practices which are unfair or deceptive acts or practices”—there’s surely an argument to be made that all the Commission is doing is defining some terms based on its expertise and experience.

Yet, that argument has some cracks. If the Justices read into the text that Congress expected the Commission to lean on its competition-related expertise in setting those definitions, then they may argue that the definition of practices related to data collection and broader privacy matters amounts to much more than filling up the details. Moreover, Congress’s movement on a privacy bill of its own undercuts the notion that it intended for the Commission to step into this policy quagmire.

The second prong is a poor fit because the Commission is doing far more than finding facts in developing and promulgating nationwide rules. The third prong also is a glass slipper a couple sizes too small—this is not an instance of the executive branch using executive or judicial powers.

A stronger non-delegation doctrine seems inevitable in light of the new composition of the Supreme Court. But it is far from clear how much stronger the transformed doctrine will be. If the Court adopts some version of Justice Gorsuch’s test, then the commercial surveillance rule may be its first victim.

Arbitrary and Capricious Review

All agency actions must be the result of reasoned decision making. Per the Administrative Procedure Act (APA), courts must set aside rules found to be “arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law.” Rules may fail this standard for a variety of reasons, such as failing to consider relevant factors, analyzing too few studies or only studies supportive of the agency’s stance, and overlooking important and relevant information. Analysis by Professor Benjamin Eidelson of recent decisions by the Roberts Court in which agency rules failed this standard may signal a particular focus among the Justices on accountability—in other words, ensuring agencies operate with sufficient clarity and transparency so that they can be held accountable by the public for their actions.

Whether the FTC’s rule will survive this test depends on the reasoning it offers for its provisions. Recent Commission action suggests that the FTC will do its homework and likely some extra credit. In late 2023, the Commission finalized the Combating Auto Retail Scams (CARS) Rule. Less than a month later, the National Automobile Dealers Association (NADA) challenged the rule as being arbitrary or capricious. The NADA contended that the Commission failed to thoroughly analyze the costs and benefits of the rule. With that litigation pending, the FTC opted to pause enforcement of the rule. Assuming the FTC learns from this episode, the commercial surveillance rule should survive this test.


A decision to forge ahead with the rulemaking process carries significant costs. For one, there’s the matter of staff resources. The next stages of the rulemaking process, specifically analyzing what will likely be thousands of comments in response to the proposed rule, are incredibly time-intensive. Given low staff morale, problems with retention, and already sparse resources, it may be wise to save FTC resources for a more promising fight.

It is also worth asking if the decision to move ahead with a likely loss would chip further away at the Commission’s reputation. The CARS Rule has so far done little to help the public and much to hinder the Commission’s ability to tackle other issues. Likewise, the FTC has taken hits for bringing novel merger claims that have so far proven unsuccessful. And, of course, the recently finalized noncompete rule is already the subject of multiple suits. Finally, carrying on with the commercial surveillance rule seems particularly questionable given that doing so may also distract from congressional efforts to pass a law on the same topic through a more deliberative and open process.

The decision to move forward with the rule should also be weighed against other, uncontroversial actions more aligned with the FTC’s mandate and capacity. There’s no shortage of work for the FTC to do that Congress and the courts have already OK’d. The Commission might benefit from scoring some conventional wins before again pushing the bounds of its expansive but limited authority.


Any finalized rule on commercial surveillance is bound to face stiff legal headwinds. In particular, it is unlikely that an aggressive rule will survive review under the Major Questions Doctrine. Given that plausible, if not probable, outcome and renewed efforts by Congress to legislate on similar topics, Commissioners may want to consider significantly curtailing the scope of the impending proposed rule and, ultimately, the scope of the finalized rule.

Note from the Editor: The Federalist Society takes no positions on particular legal and public policy matters. Any expressions of opinion are those of the author. We welcome responses to the views presented here. To join the debate, please email us at [email protected].