"Sensitive information" is hard to accurately define,
but the Federal Trade Commission (FTC or the Commission) seemingly
knows it when it sees it. The lack of definition is troubling.
Businesses and the FTC have skirmished over what
"reasonable" security is for years, and reasonableness
frequently hinges on sensitivity. The FTC has not defined
"sensitive information," and given its vast power as a
consumer-protection enforcement agency, continued guessing games
exacerbate regulatory uncertainty and embolden prospective
plaintiffs in class-action litigation.
On January 9, 2018, the FTC declared that posting intimate
images of people with names and contact information violates the
FTC Act.1 While recognizing such images as
"sensitive" may be easy (and nonconsensual, public
distribution could certainly be "unfair") recognizing how
the FTC makes such determinations outside of obvious cases is more
difficult.2 The consequences of this black-box oversight
are increasingly
