What's Happening?
The Federal Trade Commission (FTC) has issued a warning to companies regarding the use of previously collected user data for training Artificial Intelligence (AI) models. The FTC emphasizes that existing privacy policies govern the use of data, and companies cannot
retroactively apply new, more permissive policies to data collected under older, stricter terms without user consent. This stance is rooted in Section 5 of the FTC Act, which prohibits unfair or deceptive practices. The FTC has indicated that quietly rewriting privacy policies to allow AI training on old data can be considered both unfair and deceptive. The agency has a history of enforcing this principle, dating back to a 2004 case, and has applied it to AI contexts, stating that companies must honor the privacy promises made at the time of data collection.
Why It's Important?
This FTC guidance is crucial for U.S. businesses, particularly those in the technology and AI sectors, as it clarifies that the rapid evolution of AI does not exempt them from long-standing consumer protection laws. Companies that have amassed large datasets over time and now seek to leverage them for AI training must meticulously review their historical privacy policies. Failure to do so could result in significant legal and financial repercussions, including fines and, notably, 'algorithmic disgorgement'—the forced deletion of AI models trained on improperly used data. This remedy, which the FTC has applied in previous cases, could dismantle a company's core asset and business model. The warning also extends to enterprise contracts and model vendor agreements, where 'no-training' clauses or default settings could inadvertently lead to violations of a company's privacy promises to its users.
What's Next?
Companies are advised to undertake a comprehensive audit of their privacy policies, tracing back to the inception of data collection, to map which policy versions covered which datasets. They must clearly define what 'training' means for their AI initiatives and assess whether these activities align with their historical privacy commitments. For any new uses of old data, especially those involving AI training, companies are urged to provide clear notice to users, ideally through direct communication channels like email, and obtain explicit consent if the changes are material. If obtaining consent is not feasible, companies should restrict AI training to data collected after an updated, more permissive policy has been clearly communicated and accepted. Furthermore, businesses must scrutinize their enterprise contracts and model vendor terms to ensure that third-party AI services do not inadvertently violate their privacy obligations.
Beyond the Headlines
The FTC's stance underscores a fundamental tension between the innovative potential of AI, which often thrives on vast datasets, and the imperative to protect individual privacy rights. This regulatory approach highlights the ethical responsibility of companies to maintain transparency and uphold trust with their users, even as technological capabilities advance. The concept of 'algorithmic disgorgement' introduces a powerful deterrent, signaling that the economic value derived from AI models built on ethically questionable data practices can be entirely nullified. This could lead to a shift in how companies approach data governance, prioritizing privacy-by-design principles from the outset of AI development. It also emphasizes the need for ongoing vigilance and dedicated personnel to ensure that privacy policies evolve in lockstep with AI roadmaps, preventing future legal and reputational damage.
