The Federal Trade Commission and Consumer Protections for Mobile Health Apps

I. Introduction

The mobile health (mHealth) industry is no longer “emerging.” Ready or not, for better or worse, it is here. According to the PEW Research Center, more than three-quarters of Americans now have a smart-phone ¹ and more than half of smartphone users are collecting “health-associated information” in some way with those smartphones. ² There has been a proliferation of mHealth apps. Reports indicate more than 325,000 of them are available via the Google Play Store, Apple App Store, and elsewhere, ³ and projections for the global mHealth app market — of which North American is considered the leading region and the U.S. is the leading country within that region — are that it will generate more than $111 Billion U.S. dollars by 2025. ⁴ The mHealth apps are diverse and have been described as falling into one of four different types: informational, diagnostic, control, and adapter apps. ⁵ Through mHealth apps and other apps not typically considered by users to be health-related, personal data are being generated and aggregated at unprecedented levels. The data flow in and out of the mHealth apps, connecting with gadgets and online platforms. Researchers have been able to leverage this trend and potentially involve a wide range of participants (across many geographic and jurisdictional boundaries) with the Apple ResearchKit ⁶ and Android ResearchStack. ⁷ Understanding the consumer protections available to mHealth app consumers outside of any formal research project is critical when trying to detangle the research-related risks with those arising simply from participation in ordinary, everyday life in the 21st Century. Additionally, an understanding of generally applicable laws is an essential prerequisite to any serious policy discussions about the need for, or design of, specific laws tailored to mHealth apps and related technologies.

The Federal Trade Commission (FTC) is the best-suited agency in the United States to provide both well-calibrated and well-timed governmental protections for technology consumers in modern society, yet it remains remarkably under-appreciated. This commentary explores the consumer protections for mHealth apps and related technologies provided by the FTC, describing in Part II key aspects of the FTC’s structure and authority, highlighting in Part III the recent activities to promote competition and consumer protection with mHealth apps and enforcement actions the FTC has taken against app developers, and proposing in Part IV modest policy recommendations to strengthen its powers as a formidable consumer watchdog.

II. FTC Structure and Consumer Protection Authority

The FTC — or Federal Technology Commission as it has been dubbed critically on occasion ⁸ — has a 105-year-old history ⁹ that illustrates it is, by design, poised and primed to address the rapidly changing and emerging technologies and accompanying uncertainty. Indeed, the FTC has, since its inception, been the arbiter of technology. As legal scholar Christopher Hoofnagle has remarked, “Saying that the FTC has suddenly become a technology regulator is … ahistorical. It treats technology as something that exists today, forgetting the innovation and social implication of technology from decades past.” ¹⁰

The FTC was created in 1914 with the enactment of the Federal Trade Commission Act ¹¹ and began its work six months later in March 1915. ¹² Organizationally, the FTC consists of the Bureau of Competition, Bureau of Consumer Protections, and Bureau of Economics ¹³ and is led by a bipartisan group of five commissioners (no more than three may be affiliated with the same political party) who are appointed by the President subject to confirmation by the Senate to serve seven-year, staggered terms. ¹⁴ The creation of the FTC has itself been described as a “radical innovation,” ¹⁵ given the breadth of powers (a mix of judicial, legislative, and executive functions) that were entrusted and delegated to a single governmental agency to carry out its mission. ¹⁶

Scholars and policymakers have been giving fresh attention to the FTC’s ability to serve as the nation’s primary privacy regulator, increasingly recognizing that the deluge of data raises important questions about appropriate limits on data practices and whether the sector-specific federal approach to privacy rights in the United States ¹⁷ remains workable. Pressure for federal privacy policy reform in the U.S. is arising domestically from the individual states setting their own consumer privacy (e.g., California) ¹⁸ and data broker transparency (e.g., Vermont) ¹⁹ approaches and internationally from countries setting their own data protection approaches (e.g., the European Union’s General Data Protection Regulation and China’s Cybersecurity Law and Information Security Technology – Personal Information Security Specification). While this attention is merited and while the FTC can enforce data privacy and security via the FTCA, the consumer protections afforded by the FTC go far beyond privacy and data-related issues.

With the creation of the FTC in 1914, Congress charged the agency with an inherently compound mission: to promote fairness and competition in the marketplace. Initially Section 5 of the FTCA focused the FTC on the prevention of “unfair methods of competition in commerce.” In 1931 the U.S. Supreme Court narrowly interpreted this phrasing to imply that the statute protected businesses (not consumers directly) and thwarted FTC action against unfair business tactics (no matter how repugnant or egregious) unless there was corresponding harm to business competitors. ²⁰ Congress responded in 1938 with passage of the Wheeler-Lea Amendments that specifically allowed the FTC to prevent not only “unfair methods of competition” but also “unfair or deceptive acts or practices.” ²¹ By maintaining broad statutory language in Section 5 even with these changes, Congress reiterated its commitment to empowering the FTC to be adaptive, able to — on a moment’s notice — promote competition and protect consumers as new circumstances require. According to Hoofnagle, skeptics of entrusting the agency with so much power were persuaded by limits imposed by the agency’s purpose being “preventative, cooperative, and not penal.” ²² The FTC was further strengthened in the 1970s by judicial rulings affirming its broad powers to define unfair practices ²³ and by additional legislation ²⁴ enabling, for example, the agency to appear in court on its own behalf and take action against practices “in or affecting commerce.” Congress pushed back and adjusted the agency’s powers in 1980 when it perceived the FTC to be overzealous in its efforts, imposing limitations on the FTC’s rulemaking authority, asserting the potential for legislative veto, and declining to reauthorize the agency until 1994. ²⁵

This historical context of how the current FTCA prohibits “[u]nfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce” ²⁶ and the refinement of the FTC’s powers over time makes abundantly clear that the FTC is the agency uniquely situated, capable, and qualified to address the challenges raised by technological innovations. Whenever Congress is either oblivious to the issues, at an impasse over how to address them, or perhaps even distracted by unrelated pressing matters, the FTC has existing statutory authority to take the first steps. This is what distinguishes the FTC from other agencies that have to wait for congressionally delegated powers to respond to most technological innovations. For example, in the absence of congressional action, the Food and Drug Administration (FDA) has performed mental gymnastics to contort direct-to-consumer genomic interpretation and predictive algorithms as “medical devices” in order to act within the boundaries of its authority specifically defined in the Food Drug and Cosmetic Act (FD&C Act). ²⁷ Similarly, in the area of wearables and other “internet of things” consumer products, the Consumer Product Safety Commission (CPSC) has a limited focus on protecting consumers from physical injuries only. ²⁸ In this extraordinary and essential “first responder” role, the FTC should be brave and bold, taking swift and decisive actions that promote businesses and protect consumers. This approach allows technologies and industries to mature without extensive governmental meddling and allows a better assessment of whether existing laws are sufficient or whether new specific legislation is necessary.

The FTC’s Bureau of Competition and Bureau of Consumer Protection work in tandem to “facilitate the exercise of consumer sovereignty,” with the former ensuring that business practices do not artificially restrict options available to the consumers and the latter ensuring that business practices do not obstruct the consumers’ abilities to choose from among the available options. ²⁹ Importantly, with its preventative mission, the FTC is able to take action even before harms occur from practices violating the FTCA. Furthermore, the FTC has numerous tools at its disposal, including the ability to host workshops; conduct research; generate reports and white papers; publish consumer advisories, brochures, and educational materials; file amicus briefs; investigate individual corporations to gain insights about specific industries and otherwise hidden business practices; develop formal rules and standards for entire industries; issue guidance; publish press releases; monitor consumer complaints; prosecute alleged violations; adjudicate matters; and supervise business compliance with contracts. ³⁰ Through its enforcement of Section 5 of the FTCA, the FTC works to ensure that business practices are free from a wide variety of undesired conduct, including unfairness, deception, unsubstantiated claims, false advertising, and anti-competitive activities. ³¹ Examples of violations include price fixing, predatory pricing, anticompetitive mergers, unreasonable horizontal or vertical restraints, overt coercion, undue influence, deception, and incomplete or confusing information. ³²

In the mHealth app space, anti-competitive practices relate to platform dynamics (e.g., Apple, Google, etc.) and how a powerful few corporations might hold consumers captive, monopolize the entirety of a mobile device user’s experience, control consumer access to apps or data they generate, limit the rate of innovation or app options by dictating app features, and more. ³³ FTC commissioners have acknowledged, for example, that “[d]ata are a competitive asset” and that network effects can “lead to barriers to entry that grow over time rather than diminishing.” ³⁴ The FTC watches out for methods of competition that would lower the quality, raise the prices, reduce choices, and reduce rates of innovation. Unfairness in the mHealth app space includes (but is not limited to) lax data security and privacy measures. ³⁵ While the FTC has under-utilized the unfairness doctrine in the past 20 years, it is particularly poised for a comeback ³⁶ and would proceed in predictable ways given the standard is codified (enabling the FTC to act when an act or practice “causes or is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers themselves and not outweighed by countervailing benefits to consumers or competition.”). ³⁷ Importantly for mHealth app developers, the FTC continues to show a tendency to use deception principles, ³⁸ and the FTC’s standard for proving deception does not require the agency to establish intentions to deceive or actual deception; rather, the FTC must show that a material representation, omission, or practice is likely to mislead a consumer and this standard is viewed from the perspective of a reasonable consumer. ³⁹ Substantiation of claims is related to deceptive practices and false advertising, and the FTC will consider numerous factors to determine the veracity of a claim. ⁴⁰ In the mHealth space, this could include the FTC specifying the science ⁴¹ that must be available at the time a claim is made to support purported health benefits.

III. FTC Enforcement Activities Involving mHealth Apps

As briefly summarized in this section, the FTC has been relatively active in its approach to mHealth apps, engaging in targeted enforcement against app developers who engage in deception and false advertising; providing guidance and interactive tools to assist app developers; issuing relevant reports; and hosting a range of topical workshops and hearings.

IV. Conclusions and Policy Recommendations

The FTC is an extraordinary agency with broad powers that enable it to be adaptive, proactive, and rapidly responsive (if it so chooses). This is in stark contrast to most administrative agencies, which must carry out their policy missions within rigid, fixed boundaries. The FTC embodies the “flexibility and practicality” needed by Congress for implementing policies to ensure fairness in emerging technologies and markets ⁸⁹ and necessarily must consider new practices “as they arise in the light of the circumstances in which they are employed.” ⁹⁰ As FTC Commissioners Rohit Chopra and Rebecca Slaughter have observed, “It was no accident that, over one hundred years ago… Congress wanted an expert administrative agency with broad and flexible authority to ‘hit at every trade practice, then existing or thereafter contrived, which restrained competition or might lead to such restraint if not stopped in its incipient stages.’” ⁹¹

There are, however, challenges on the horizon for the FTC. Despite all of the activities that the FTC has done in the past decade to promote competition and ensure consumer protections in mHealth apps, the position ⁹² of FTC Chief Technologist has been vacant since April 2018, and it remains unclear as to whether the current FTC Chairman Joseph J. Simons will fill that vacancy or pivot the FTC in a different direction. ⁹³ The Office of Technology Research and Investigation (OTech), created in 2015, has gone silent on its webpage and Tech@FTC blog, ⁹⁴ and the FTC reportedly only employs five full-time technologists. ⁹⁵ Additionally, Congress appears interested in tweaking the FTC’s authority, ⁹⁶ but it is not yet clear whether the result will augment or limit the FTC’s efforts relevant to mHealth technologies: changes to the FTCA to make it easier for the FTC’s oversight to reach non-profit entities (e.g., to challenge anti-competitive price-fixing within the health care industry) and common carriers (e.g., to regulate technology platforms more effectively in coordination with the FCC) and to impose civil penalties (e.g., for data privacy violations) would be welcomed, but other proposed changes could inhibit the FTC’s agility that goes to the core of its mission. ⁹⁷ Furthermore, while many recognize that the FTC has scant resources with which to fulfill its tremendous responsibilities and acknowledge the FTC was in deregulatory crosshairs in decades past, ⁹⁸ new calls for an expansion of the FTC’s powers — as opposed to clarifying them delicately and with specificity — just might invite the Supreme Court’s revival of the nondelegation doctrine, ⁹⁹ which could jeopardize the FTC’s very existence. Complementary consumer protections are available among the states and enforced by state Attorneys General, ¹⁰⁰ but a weakened or dismantled FTC could have catastrophic effects for consumers and businesses in mHealth. Champions of the FTC and its work might be wise to exercise restraint in their requests of Congress at this time.

As highlighted in Part III, much of the FTC’s activities taken thus far regarding mHealth apps have focused on providing reports and tools to educate consumers and app developers on important priorities (e.g., privacy by design and anti-discrimination by design). The few enforcement actions taken against app developers have focused on deceptive practices; however, a shift in focus toward anti-competitive business methods and unfair practices is needed. Few technology platforms (such as Google and Apple) dominate the market, shaping opportunity for both consumers and businesses. The FTC should look not only at the app developers but upstream to the technology platforms when searching for effective means with which to promote fairness and competition for mHealth apps. Whether consumers and businesses would be better off if these technology giants were broken up, or, alternatively, if it would be more effective for the FTC to leverage the app stores (wielding considerable control over which apps are made readily available to consumers) to spread best practices is yet unclear. Technology platforms dominating the electronic health record market through health care system partnerships (such as Epic) are also ripe for FTC anti-competitive scrutiny. By focusing efforts on the technology platforms, the FTC might help consumers and businesses while avoiding supervisory burdens that would accompany settlement agreements and consent decrees with individual mHealth app developers. The unfairness doctrine also holds considerable potential to help prevent the proliferation of Big Data-driven discrimination facilitated by data generated by mHealth apps and subsequent processing by data brokers.

Ultimately, a pro-science, pro-consumer, pro-business, and pro-innovation future for mHealth apps is possible, but we need the FTC to realize it.