How the FTC’s Approach to Privacy, Security, and AI Enforcement May Change Under Trump 2.0

The election of Donald Trump is likely to have a significant impact on the Federal Trade Commission’s (FTC’s) approach to privacy, data security, and other technology-related aspects of consumer protection, including artificial intelligence (AI). 

While many of the particulars will be determined by whoever becomes the agency’s chair, we expect to see meaningful shifts from the current FTC (under Chair Lina Khan) with respect to both substantive enforcement priorities and a return to more traditional enforcement.

Initial Control of FTC 

Lina Khan is the current chair of the FTC, which is led by three Democratic commissioners (including Chair Khan) and two Republican commissioners. After the inauguration, one of the two sitting Republican commissioners, Melissa Holyoak or Andrew Ferguson, will be designated chair of the FTC by the President on at least an acting basis. While Chair Khan, whose term expired on September 25, 2024, can remain at the agency as a non-chair commissioner until the Senate confirms someone to take her seat, the FTC chair of the party that lost the presidential election typically departs by or soon after the inauguration.

However, even if Chair Khan departs, that would leave a 2-2 split between Republican and Democratic commissioners until her seat is filled. During this period, the Republicans will face limits on their ability to advance an enforcement or deregulatory agenda without bipartisan support.

As to how long it may take to seat a replacement for Chair Khan and create a majority of Republican commissioners, in the past, it often took six months or even a year or longer for a Commission seat at the FTC to be filled at the start of a new president’s term. For example, in the first Trump administration, it took over a year for the President to nominate and the Senate to confirm Joseph Simons to serve as FTC chair, and it took about six months for President Biden to have Khan seated as chair. However, it is reasonable to expect the new administration to round out the FTC with a third Republican commissioner far more quickly than in prior years when the FTC had less visibility.

Expected Policy Changes 

Once the new chair is seated and Republicans have a majority on the Commission, we can expect to see noteworthy shifts from the approach of the Khan FTC. That said, we expect the FTC will remain an active enforcer with respect to privacy, data security, AI, and other technology issues notwithstanding the concerns about Chair Khan voiced by a number of the supporters of the incoming president and Republican members of Congress. As background, under the first Trump administration, the FTC brought record-breaking privacy civil penalty actions and was a vigorous enforcer on a wide variety of technology-related consumer protection issues. And the dissents of the current Republican commissioners—a roadmap for their views and what we may see in the majority under the new administration—show us not an abnegation of enforcement but enforcement with adjusted substantive priorities and a return to a more traditional approach to the FTC’s enforcement tools.

As to what those changes will look like, many particulars will only be known after the new chair is in place, but we may see changes from current FTC practices in at least the following respects:

• Pullback on rulemaking. One of the first acts of the FTC led by Chair Khan was to streamline longstanding procedures for rulemakings under Section 18 of the FTC Act (also called “Magnuson-Moss” rulemakings). Section 18 empowers the agency to issue rules prohibiting unfair or deceptive acts or practices under Section 5. Since then, the FTC has initiated an avalanche of rulemakings, many under Section 18. These rulemakings have often been controversial with Republican commissioners and members of Congress. We therefore expect to see a number of pending rulemakings (e.g., the Commercial Surveillance and Data Security Rulemaking) languish or be formally ended and some recently finalized rules adopted over Republican dissents rescinded and/or not defended in court challenges (e.g., the Negative Option Rule regarding recurring subscriptions). In addition, Congress may nullify recently adopted rules via the Congressional Review Act. At the same time, the pending Children’s Online Privacy Protection Rule is less controversial and may be completed in the new administration if it is not finalized before the inauguration.   
• Fewer novel interpretations of the law. The Khan FTC frequently relied on novel and expansive interpretations of FTC statutory authority in its rulemakings and enforcement actions (e.g., a broad new interpretation of the Restore Online Shoppers’ Confidence Act and expansive use of “notice of penalty offense” letters). Under Republican leadership, the FTC will likely return to more established theories of FTC authority. 
• Shifts in substantive priorities. Technology, including privacy and data security, will likely remain a priority of the agency—but with a focus on issues with across-the-aisle interest and likely without the current FTC’s pejorative terminology like “commercial surveillance.” In particular, youth privacy and online safety are likely to remain a priority, along with sensitive data such as health information. The FTC is also likely to explore some new areas, such as how social media platforms engage in content moderation and make deplatforming decisions. AI-related issues are likely to remain a priority, but the incoming administration has indicated a much greater interest in the power and potential of AI and a desire not to hinder U.S. innovation in this area. Thus, for AI, we are likely to see greater FTC reliance on tried-and-true theories about exaggerated and unsubstantiated claims about the capability of AI-powered goods and services and less use of aiding-and-abetting-type theories to render AI-powered software and platforms liable for deceptive or unfair practices by others (as under the FTC’s proposed supplemental rule on AI impersonation) or application of Section 5 to allege that AI systems perpetuate discriminatory outcomes based on protected classes. Finally, bread-and-butter areas like consumer fraud are likely to be emphasized to a greater degree than under the Khan FTC. 
• More nuanced approach to individual liability. Under the Khan FTC, there was a surge of interest in individual liability against executives, including at larger and more established companies, in privacy and other consumer protection cases regardless of whether the FTC alleged the individual had direct involvement or authority over the alleged unlawful conduct. We expect the new administration to follow a more restrained approach to individual liability by considering more closely the individual’s role vis-a-vis the conduct at issue. 

In sum, although there are reasons to expect substantial changes to its priorities and enforcement approach, the FTC is likely to remain active on privacy, data security, AI, and other technology issues during the second Trump administration.