- FTC는 페이스북과 인스타그램 등을 운영하는 메타플랫폼과 구글 유튜브, 틱톡 등 13개 플랫폼을 운영하는 9개 기업의 이용자 데이터 수집 및 사용 방법에 대한 연구를 통해 이같이 주장함
□ 보고서에 따르면, 대부분 무료 서비스로 제공되는 이들 플랫폼이 특정 이용자를 대상으로 하는 광고에 개인 정보를 제공해 수익을 올렸으며, 개인 정보 가운데에는 어린이와 청소년 정보도 포함됨
- 이 기업들은 또 개인 정보 브로커를 통해 서비스 이용자가 아닌 사람들의 정보도 구입하는가 하면, 다른 서비스에 연결된 계정으로부터 정보를 수집하기도 함
- 개인 정보로는 이용자의 연령, 성별, 사용하는 언어 정보는 물론, 교육과 소득, 결혼 여부 등이 포함됨
- 이용자들이 쉽게 개인 정보 수집을 거부할 수 있는 방법은 제공되지 않았고, 민감한 정보는 이용자가 생각하는 것보다 훨씬 더 오래 보관되는 경우가 많았음
□ FTC는 이 보고서가 연방 개인정보 보호법과 함께 기업이 개인 정보를 수집하고 사용하는 방식에 대한 규제의 필요성을 보여줬다고 강조함
- 리나 칸 FTC 위원장은 성명에서 “감시 관행은 사람들의 사생활을 위험에 빠뜨리고 자유를 위협하며, 신원 도용에서 스토킹에 이르기까지 다양한 피해에 노출될 수 있다”고 언급함
[출처] 美FTC “SNS, 이용자 대규모 감시…상상 초월한 개인정보 수집” (2024.09.20.) / 연합뉴스
목차
Preface i
Executive Summary iv
1. Summary of Key Findings v
2. Summary of Competition Implications vi
3. Summary of Staff Recommendations vii
I. Introduction 1
II. Legal Framework Applicable to Social Media and Video Streaming Services 4
III. Background Information About the Companies 8
IV. Data Practices 15
A. Data Collection, Use, and Disclosure 16
1. The Companies Generally Collected Vast Amounts of Data About Users and Non-Users 17
2. The Companies Generally Collected Data from a Variety of Sources, Both On and Off of the SMVSSs 21
3. The Companies Generally Used Consumer Data for a Variety of Purposes 24
4. The Companies Generally Shared Data with a Variety of Entities, Including Affiliates and Other Third Parties 25
5. The Companies Generally Implemented Some Restrictions Governing Sharing with Outside Third Parties, But Had Fewer Restrictions Governing Disclosure to Corporate Affiliates 28
B. Data Minimization, Retention, and Deletion 30
1. Data Minimization Efforts Varied and Did Not Always Match Stated Principles 30
2. Data Retention and Deletion Policies Varied Across the Companies 31
C. Consumer Rights Under GDPR 33
1. Rights Afforded Under the General Data Protection Regulation Were Not
Automatically Afforded to American Consumers 33
D. Key Findings 36
V. Advertising Practices 38
A. Targeted Advertising Poses Privacy Risks to Consumers 40
B. Targeting Capabilities 41
1. Targeting Similarities and Differences 41
C. Targeting Based on Sensitive Categories 43
1. Profound Threats to Users Can Occur When Targeting
Occurs Based on Sensitive Categories 44
2. Children and Teens 45
D. Privacy-Invasive Tracking Technologies 46
E. Key Findings 47
VI. Algorithms, Data Analytics, or AI 48
A. The Companies Relied on Algorithms, Data Analytics, or AI to Carry Out Most Basic
Functions and to Monetize Their Platforms 49
1. Content Recommendation, Search, and Boosting or Measuring User Engagement 51
2. Safety, Security, and Content Moderation 52
3. Inferring Personal and Demographic Information About Users and Non-Users 53
4. Advertising and Targeting 54
5. Other Purposes to Inform Their Business Strategy and Product Decisions 55
B. The Personal Information that Powers Algorithms, Data Analytics, or AI Came from Sources Including Offline Activity, Inferred Data, or Data from Third Parties 55
C. Use of Personal Information by Algorithms, Data Analytics, or AI Raises Privacy and Other Concerns for Users and Non-Users 58
D. Algorithms, Data Analytics, or AI that Favor Engagement Can Have Negative Mental Health Consequences for Children and Teens 63
E. The Differing and Inconsistent Approaches to Monitoring Algorithms,
Data Analytics, or AI 65
1. The Responsible People and Oversight Structures Varied—Only Some Had Dedicated AISpecific Teams 66
2. The Frequency of Testing Varied Widely 66
3. The Way Companies Monitored and Tested Also Varied 67
4. Companies Reported Limited Human Review 68
F. Key Findings 69
VII. Children and Teens 70
A. Policies and Procedures for Child and Teen Users 73
1. The Companies Generally Restricted Children from Creating SMVSS Accounts and
Afforded Them Other Protections 74
2. The Companies Generally Did Not Restrict Teens from Creating SMVSS Accounts and
Treated Them Like Adult Users 75
B. Policies and Procedures for Parents or Legal Guardians of Child/Teen Users 76
1. Most Companies Gave Some Rights to Parents/Legal Guardians
With Respect to Child Users 76
2. Very Few Companies Gave Any Rights to Parents/Legal Guardians of Teen Users 77
C. Self-Regulatory Organizations 77
D. Key Findings 77
VIII. Competition Implications 78
IX. Conclusion 79
Staff Recommendations 80
1. Data Practices Recommendations 80
2. Advertising Recommendations 82
3. Algorithms, Data Analytics, and AI Recommendations 82
4. Children and Teen Recommendations 83
5. Competition Recommendations 84
