The hits just keep on coming from the FTC. It recently published guidance warning companies that "it may be a deceptive or unfair practice for a company to adopt more permissive data practices, for instance, to start sharing consumers' information with third parties, and only inform consumers of this change through a retroactive amendment to its terms of service or privacy policy".
In plain English, what this means is that the frequent practice of many car dealers and finance companies of simply updating a privacy policy online when there is a change in information sharing practices may not provide enough notice to consumers.
Say, for example, a dealer or related finance company brings on a new extended service contract provider and in that relationship it's agreed that the finance company will share customer information of those customers that didn't purchase the contract at the time of sale with the extended service contract provider, so that the provider can market to them. This is a departure from the company's existing practice of not sharing any information with third parties. Not updating the privacy policy to reflect this change would be problematic in its own right, but now the FTC is saying that updating it without further explanation may also be unfair or deceptive. The FTC was nice enough to use the word "may", but I'm pretty sure they mean "is".
The FTC focused on Artificial Intelligence relationships in its announcement, but its warning went noticeably broader by specifically referencing sharing personal data with third parties.
Also, be aware that many states have adopted their own privacy laws that require notification to consumers of any material change in their privacy policies. The message is pretty clear: updating a privacy notice on a website isn't enough to provide meaningful notice of a more permissive change in information sharing practices, and companies need to consider their existing privacy practices when entering into new relationships and ask themselves how they will deliver actual notice of the change to its customers and consumers.
Please reach out to Ignite if assistance is needed on any privacy notice related issues or if you'd like to review your practices.