The Federal Trade Commission (FTC) has long been aggressive in holding businesses accountable for the commitments made to consumers in online privacy policies. Among the related issues that the FTC has revisited over the years is the validity of changing data use practices after a business acquisition or merger.
In a recent public statement by the FTC staff via an FTC Business Blog post on March 25, 2015, the FTC reiterated this view. Referencing Facebook’s acquisition of WhatsApp in late 2014, the FTC staff noted its previous public warnings to Facebook about honoring the privacy promises that WhatsApp had previously made to its users, especially in light of the fact that Facebook’s privacy policies were much less restrictive than those employed by WhatsApp.
The recent FTC statement suggests several options that an acquirer might take following a merger or acquisition:
1. Continue to honor the target company’s privacy promises made before the merger or acquisition.
2. In the event of a material change in privacy practices involving data collected before the closing, inform affected consumers and obtain affirmative consent to the new practices.
3. In the event of a material change in privacy practices involving data collected after the closing, affected consumers must be informed in some prominent manner so that consumers may exercise a choice in the matter, although obtaining affirmative consent to the new practices may not be required.
For more information on Consumer Data, contact your Cybersecurity and Data Privacy Counsel at Smith, Gambrell & Russell.