The FTC Used the Word "Staggering" and They Weren't Talking About Your Screen Time
Inside the 129-page federal report that confirms your paranoia was justified
By Cat Casey | The Shield Blog
Part 2 of 12 in the "Who Sold My Data?" Series
In September 2024, the Federal Trade Commission released a 129-page report on social media data practices.
The title was bureaucratic: "A Look Behind the Screens."
The findings were damning.
The FTC—not privacy advocates, not journalists, not conspiracy theorists, but federal regulators with subpoena power—concluded that social media companies have "engaged in vast surveillance of consumers in order to monetize their personal information while failing to adequately protect users online, especially children and teens."
Vast surveillance. Their words, not mine.
They looked behind the curtain. What they found should terrify you.
The Companies Investigated
The FTC studied nine of the largest social media and video streaming companies:
- Amazon (including Twitch)
- Apple
- Meta (Facebook, Instagram, WhatsApp)
- Google (YouTube)
- X (Twitter)
- Snap (Snapchat)
- ByteDance (TikTok)
- Discord
Together, these platforms reach virtually everyone who uses the internet. Billions of people. Multiple hours per day.
The FTC sent detailed orders requiring these companies to disclose their data practices. What they received back painted a picture of an industry built on surveillance.
"Staggering" Data Collection
The FTC didn't mince words. From the report:
"The amount of data collected by large tech companies is simply staggering."
What do they collect? Let me quote directly:
"They track what we read, what websites we visit, whether we are married and have children, our educational level and income bracket, our location, our purchasing habits, our personal interests, and in some cases even our health conditions and religious faith."
This isn't speculation. This is what the companies disclosed under legal compulsion.
They know what you read. They know if you're married. They know your income bracket. They know your health conditions. They know your religious faith.
And they monetize all of it.
Indefinite Retention
The FTC found that these companies "collected and could indefinitely retain troves of data."
Indefinitely. Not "for a reasonable period." Not "for as long as necessary to provide the service." Indefinitely.
That photo you posted in 2012? Still there.
That message you sent in 2015? Still stored.
That search you made in 2018? Still logged.
That location data from your phone in 2020? Still retained.
The data never goes away. It accumulates. Every year, the profile gets richer. Every year, they know you better than they did before.
And there's no expiration date.
Data From People Who Aren't Even Users
This part is particularly chilling.
The FTC found that these companies collect data on non-users—people who have never created an account, never accepted terms of service, never clicked "I agree" to anything.
How?
If you receive a link to a Facebook post, Facebook logs that you clicked it. If you visit a website with a YouTube embed, Google captures data about you. If a friend uploads their contact list, these platforms now have your phone number and email address.
The FTC wrote that data was collected from non-users when they "receive a link or access the platform."
You don't have to sign up. You just have to exist in a world where these platforms exist. That's enough for them to start building a profile on you.
"Some Companies Unable to Identify All Data Collected"
Here's something that should make you pause.
When the FTC asked these companies to disclose what data they collect and who they share it with, some companies couldn't answer.
They collect so much data, from so many sources, through so many systems, that they don't have a complete picture themselves. The surveillance apparatus has grown beyond the ability of its operators to fully describe it.
The report notes that some companies couldn't identify "all data points collected" or "all third parties they shared data with."
They're collecting more data than they can track. They're sharing with more parties than they can name.
And this is supposed to be fine. This is supposed to be the normal cost of using social media.
Data Brokers Feed the Beast
The FTC discovered that these platforms don't just collect data directly. They purchase information from data brokers to supplement their profiles.
What kind of information? The report mentions data about "consumers' offline lives."
So it's not just what you do on the platform. It's what you do everywhere else, too. Your purchases. Your location history. Your public records. All of it flowing into social media profiles to make their targeting more precise.
The platforms have become data aggregators, pulling in information from across the data broker ecosystem and combining it with what they observe directly.
You're not just being watched on Facebook. Facebook is buying data about what you do when you're not on Facebook.
Users "Lacked Any Meaningful Control"
The FTC was particularly critical of how platforms handle data when it's fed into AI systems.
They found that users "lacked any meaningful control over how personal information was used for AI-fueled systems."
The algorithms that decide what you see, what ads you get, what content is recommended—they're trained on your data. They're personalized to your behavior. They're designed to predict and manipulate what you do next.
And you have no control over it.
You can't see how the algorithm models you. You can't correct errors in its understanding. You can't opt out of being training data. The AI knows you, shapes what you see, and you have no say in any of it.
Deletion Requests Ignored
Remember all those privacy tools? The "download your data" buttons and "delete your account" options?
The FTC found that some companies were not actually deleting user data in response to deletion requests.
You pressed delete. You thought it was gone. It wasn't.
The data stayed in backup systems. In machine learning models. In archives. In places the "delete" button didn't reach.
This isn't a bug. This is the companies deciding that your data is too valuable to actually delete, regardless of what you request.
Children and Teens Especially Vulnerable
The report emphasizes that these practices pose particular risks to young users.
Children and teens are more susceptible to:
- Addictive design patterns
- Targeted advertising manipulation
- Data collection before they understand consent
- Privacy violations that follow them into adulthood
The FTC found that despite policies claiming to protect minors, the actual practices of these companies failed to adequately safeguard young users.
As we covered in Article 10 of this series, TikTok's "child safety" review lasted 5-7 seconds per account. Amazon kept kids' voice recordings forever. These companies say the right things and do the opposite.
What the Report Recommends
The FTC didn't just document problems. They called for action:
For Congress:
- Pass comprehensive federal privacy legislation
- Strengthen COPPA protections for children
- Give the FTC more enforcement authority
For Companies:
- Minimize data collection to what's actually necessary
- Delete data when it's no longer needed
- Give users real control over their information
- Stop collecting data from non-users
- Actually honor deletion requests
For Users:
- Be aware of the scale of data collection
- Exercise available privacy controls
- Think carefully about what you share
The recommendations read like a wish list. They require political will, corporate cooperation, and user action—none of which exist in sufficient quantities.
The Industry Response
What did the social media companies say about this report?
Mostly nothing. Or vague statements about their commitment to privacy. Or assertions that they disagree with some findings.
Business as usual.
A 129-page federal report documenting "vast surveillance" didn't change anyone's practices. The companies are too big, too profitable, and too central to modern communication to feel threatened by criticism.
They've weathered worse. They'll weather this. And the surveillance will continue.
What You Can Do
Immediately:
Audit your privacy settings on every platform. They change constantly. What you set two years ago may not still be in effect.
Review connected apps and services. Third-party apps you've granted access to can still pull your data.
Download your data. See what these companies actually have. The process varies by platform, but all major services offer this option.
Consider deletion. If you don't actively use a platform, delete the account entirely. Dormant accounts are still data sources.
Use privacy-focused alternatives. For messaging, consider Signal. For search, consider DuckDuckGo. Every platform you replace reduces your exposure.
For the longer term:
Support federal privacy legislation. The U.S. lacks comprehensive privacy law. That needs to change.
Vote for candidates who prioritize privacy. Make this a political issue.
Use tools that protect you. Apps like ZoraSafe can reveal which services are collecting data and help you manage your exposure.
The Bottom Line
The FTC spent years investigating social media companies. They had subpoena power. They got documents no journalist could access.
What they found was vast surveillance. Indefinite data retention. Collection from non-users. Companies that couldn't even identify all the data they were hoarding. Deletion requests that weren't honored. AI systems users can't control.
And their conclusion? These companies "failed to adequately protect users."
That's the federal government telling you that the platforms you use every day are surveilling you at a scale that regulators describe as "staggering."
This isn't paranoia. This is a 129-page official finding.
The platforms where you share your life, stay in touch with friends, get your news, and spend hours every day—they're not social networks. They're surveillance infrastructure.
The FTC looked behind the screens. What they found was exactly what critics have been saying for years.
We were right to be paranoid. We just weren't paranoid enough.
Next week: "Meta Makes $16 Billion a Year From Scam Ads and Budgets $1 Billion for Fines. Do the Math." — When getting caught is just a line item.
About the Author: Cat Casey is the CEO of ZoraSafe and has spent 20+ years in cybersecurity. She read all 129 pages of this report so you don't have to (but you can—it's public).
The Shield Blog publishes weekly investigations into the companies profiting from your data and the practical steps you can take to fight back. Subscribe to get each article in your inbox.
Sources: Federal Trade Commission, "A Look Behind the Screens: Examining the Data Practices of Social Media and Video Streaming Services," September 2024; FTC press release and summary; related FTC enforcement actions.