The FTC’s new 2026–2030 Strategic Plan is a roadmap that explains the agency’s goals over the next five years. Currently, there are only two commissioners out of the intended five. Both commissioners voted in favor of this plan. While it is thus possible that the FTC’s plans may change as the roster of commissioners increases, the plan nevertheless is a helpful document for companies to review when designing their privacy and data security programs.
The plan outlines the FTC’s three goals, the first of which relates to privacy and data security. In explaining this first goal, which is to protect consumers from unfair or deceptive acts in the marketplace, the FTC lists several key program areas. This signal for companies what the FTC may focus on in the coming months – and years. These include (1) fighting deception and “high‑dollar harm;” (2) addressing “unlawful conduct” relating to privacy and data security; (3) holding BigTech “accountable” for actions that result in harm to children or that “undermine the online marketplace;” (4) protecting workers; and (5) taking action against deceptive or unfair practices in the ticket sales industry.
One of the objectives for FTC consumer protection that the plan outlines is for the FTC to take actions to deter these practices “without unduly burdening legitimate business activity.” The mechanisms that the plan lays out are not new. They include collecting consumer reports through online portals like reportfraud.ftc.gov, and sources like law enforcement agencies and Better Business Bureaus. The FTC will continue to use its enforcement powers to bring suit against those who it believes are violating privacy laws, including COPPA or Section V of the FTC Act. The report notes that the FTC will use success measures like how much money is returned to consumers and the number of orders that enjoin unfair and deceptive practices.
Putting It Into Practice: This report signals that the FTC will continue its mission to stop unfair and deceptive trade practices. In designing privacy and data security compliance priorities, keep in mind the concerns the FTC lays out in this plan. Steps companies might take include “premortems” to identify possible failure points that could result in high dollar harm.