As tech companies dive into artificial intelligence, many turn to their user base for information to train their bots. However, the Federal Trade Commission warned the tech giants that there are restrictions in place to protect consumers’ private information, and stealthily altering privacy policies could violate fair business practices.
The FTC said training AI to develop products like chatbots for banks and retailers is a lucrative endeavor, but AI has a “continuous appetite” for more data.” The Commission said “data is the new oil” in terms of developing AI in that it is driving innovation while also lining the pockets of those who design it.
The FTC released a statement on February 13 outlining how companies need to protect users with straightforward information on collecting consumer data and how they plan to use it.
“These companies now face a potential conflict of interest: they have powerful business incentives to turn the abundant flow of user data into more fuel for their AI products, but they also have existing commitments to protect their users’ privacy,” the statement reads.
Companies outline how they protect consumers — and what data they can or can’t use — in the Terms and Conditions, which are notoriously long and filled with legal language. A study by Statista said Microsoft’s terms and conditions had more than 15,200 words, which would take the average reader more than an hour to read. That’s a big part of the reason another study by the research group found more than 97% of people don’t read these contracts. At best, people skim through to the accept button.
That’s why the FTC said that companies can’t simply change the conditions of the agreements so that the privacy policy no longer restricts how the company uses customer data data. The agency said companies need to alert users when policies are changed and cannot do so retroactively. Those who do so quietly to avoid consumer backlash “reneges on its user privacy commitments” and risks “running afoul of the law.”
“It may be unfair or deceptive for a company to adopt more permissive data practices – for example, to start sharing consumers’ data with third parties or using that data for AI training – and to only inform consumers of this change through a surreptitious, retroactive amendment to its terms of service or privacy policy,” the FTC said.
The FTC has gone after companies for breaching customer privacy protection guidelines. Last June, the FTC said 1Health.io, a DNA health test kit manufacturer previously known as Vitagene, failed to properly secure customers’ sensitive genetic and health data and lied about deleting customer data. The company retroactively changed its privacy policy without notifying or gaining consent from customers. The FTC required the company to strengthen protections for genetic information, and third-party contract labs were mandated to destroy all consumer DNA samples retained for more than 180 days.
“A business that collects user data based on one set of privacy commitments cannot then unilaterally renege on those commitments after collecting users’ data,” said the FTC. “Especially given that certain features of digital markets can make it more difficult for users to easily switch between services, users may lack recourse once a firm has used attractive privacy commitments to lure them to the product only to turn around and then back out of those commitments.”
The FTC said, “There’s nothing intelligent about obtaining artificial consent,” and reiterated it will continue pursuing companies who change the rules without properly notifying and gaining user consent.