Twin Inadequacies in the FTC’s Recent Biometrics Policy Statement

In the spring of 2023, the FTC released a policy statement addressing biometric information and technologies using or purporting to use such information. The policy statement contains a remarkably broad definition of “biometric information” and describes a variety of business practices that could violate § 5 of the Federal Trade Commission Act by being either “deceptive” or “unfair.” In spite of the policy statement’s comprehensiveness, however, it has two substantial inadequacies. First, the policy statement’s definition of “biometric information” is overly broad and will introduce unnecessary legal uncertainty for businesses by encompassing items not commonly thought of as “biometric information technologies” or not associated with the same risks. Second, the policy statement lacks any substantial analysis of when the potential risks to consumers associated with a business use of such technologies may be outweighed by benefits to consumers or competition, and the Federal Trade Commission Act requires such analysis before the FTC can declare any practice unlawful on account of being “unfair.” The absence of this sort of cost-benefit analysis in the policy statement indicates that the FTC will likely focus on bringing “deception” charges, as the FTC has similarly done in the past when regulating data privacy. In turn, this focus on “deception” will likely result in a relatively passive and reactive regulatory regime centered around increased disclosure by businesses. Additional disclosures will not significantly benefit consumers, however, as information asymmetries make it difficult for them to weigh the risks associated with the business use of biometric information. Moreover, potential mismanagement and misuse of biometric information technologies can put consumers at risk of experiencing irreparable harm, which necessitates a proactive regulatory regime that can prevent harms before they occur. To address these twin inadequacies, the FTC should first narrow the definition to avoid covering information that is not commonly considered biometric. Then, the FTC should explicitly perform the cost-benefit analysis required to determine when the listed considerations which suggest that a business practice is “unfair” may render that practice unlawful, which will allow the FTC to focus more on “unfairness” charges and thereby enable more proactive regulation of this field. Revising the policy statement in this manner will allow it to strike the right balance between the commercial and noncommercial interests of consumers and businesses alike.