FTC settlements that allow tech giants to choose third parties for privacy assessments spare the agency resources but may lead to conflicts of interest
Tony Romm / Washington Post :
Context & Ripple Effects
This 2018 reporting flagged a design choice inside FTC consent decrees: rather than auditing tech giants itself, the agency lets each company hire its own third-party privacy assessor, trading direct oversight for conserving scarce enforcement resources. The risk Tony Romm identified — that an assessor paid by the company it audits faces a built-in conflict of interest — was tested a year later when commissioners approved the record $5B Facebook settlement, the largest penalty ever levied under this structure.
The follow-on coverage explains why the delegation persists: the FTC's own budgetary constraints and personnel churn make hands-on monitoring of every decree impractical, so outsourced assessment is less a philosophical preference than a capacity constraint.
First-order effects
- Companies operating under FTC privacy decrees select and pay their own compliance assessors, meaning the depth of scrutiny depends on each firm's choice of auditor rather than on agency staffing.
- The FTC frees enforcement resources for other matters, but its visibility into ongoing compliance now runs through reports commissioned by the companies being monitored.
Second-order effects
- Assessment firms face a client-retention incentive against the very giants they audit, tilting findings toward leniency — which surfaces only after violations compound into headline penalties like the $5B fine that closed the FTC's 16-month Facebook probe.
- As data-hoarding draws antitrust attention alongside privacy scrutiny — the DOJ antitrust chief has warned that vast consumer-data stockpiles raise competition concerns — the same thin-agency, delegated-oversight model gets stretched across more regulatory fronts than it was designed for.
Third-order effects
- If the pattern holds, US privacy enforcement structurally shifts from continuous regulator audits to periodic company-funded reviews backed by large ex-post fines — a regime where deterrence depends on penalty size rather than detection quality.
- That structure pressures future settlements toward ever-larger headline fines as compensation for weaker upfront oversight, and invites Congress or state attorneys general to fill the monitoring gap the federal agency cannot staff.
The trend: US privacy regulation is converging on a self-reporting model in which cash-constrained agencies set terms but delegate verification to the regulated companies themselves.