UNFAIR ARTIFICIAL INTELLIGENCE: HOW FTC INTERVENTION CAN OVERCOME THE LIMITATIONS OF DISCRIMINATION LAW.

• Author: Selbst, Andrew D.

INTRODUCTION 1024 I. THE BENEFITS OF FTC INTERVENTION 1029 A. The Broader Scope of Discrimination as Unfairness 1029 1. Domains 1029 2. Actors 1032 3. Harms 1036 4. Business Practices 1042 B. The FTC as a Regulatory Agency 1044 1. Advantages as a Litigant 1044 2. The FTC Compared to Other Agencies 1047 II. THE FTC'S AUTHORITY TO REGULATE DISCRIMINATORY AI 1049 A. Unfair Practices 1051 1. Substantial Injury 1051 2. Not Reasonably Avoidable 1058 3. Cost-Benefit Analysis 1061 B. Deceptive Practices 1068 C. External Challenges to FTC Authority 1070 1. "Unfairness Does Not Include Discrimination" 1070 2. Major Questions Doctrine 1072 III. ADAPTING THE DATA SECURITY MODEL 1077 A. A Risk Mitigation Approach 1079 B. The Flexibility of a Common Law Approach 1082 C. Parallel Challenges to the FTC's Authority 1086 D. The Alternative: Magnuson-Moss Rulemaking 1090 CONCLUSION 1091 INTRODUCTION

Discriminatory artificial intelligence is unfair. (1) Until very recently, the Federal Trade Commission, the United States federal agency charged with regulating "unfair or deceptive acts or practices" in commerce, (2) has not sought to address the harms stemming from discriminatory AI. Increasingly, however, the FTC is demonstrating a willingness to take a much more aggressive enforcement stance than it has at any other time in the last forty years, and that includes a clear interest in using its existing authorities to rein in discriminatory AI. (3)

This intent was formally announced in the Commission's August 2022 Advanced Notice of Proposed Rulemaking (ANPR). (4) The ANPR focuses on regulatory rules for commercial surveillance and data security broadly, and notably includes a number of questions about "algorithmic discrimination" and "discrimination by automated decision-making systems." (5) This was followed shortly by an enforcement action by the FTC which explicitly claimed for the first time that a business could be liable for discrimination not only under discrimination law, but under the FTC Act as well. (6)

In this Article, we argue that FTC intervention in this space is a positive and overdue development. The Commission can do a lot of good by applying its authority to address unfair and deceptive acts and practices to discriminatory AI. (7) Surprisingly, though the discriminatory harms of AI have been frequently discussed in the last decade of legal literature (8) and scholars have occasionally suggested a possible role for the FTC, (9) there has been no full-length scholarly treatment of the benefits of the Commission's involvement in regulating discriminatory AI and its legal authority to do so. (10) We provide that treatment here.

The FTC's consumer protection authority is most useful when the Commission can fill gaps in existing legal regimes. The Commission's flexible authority allows it to be nimble and adjust to new developments and changing circumstances. This is why the FTC has always been a central regulator of new technological development (11) and has become the de facto data protection regulator in the United States (12)--the Commission reacts and fills the gaps in existing law. But this presents a puzzle: Why does the FTC want to get involved in regulating discriminatory AI when we already have an extensive list of civil rights laws? And why is that a good idea?

As with other instances of technological development, the landscape of decisionmaking has changed. Where discrimination laws were designed to prevent harmful decisions by people, today many of these decisions are technologically mediated or delegated to automated procedures, which increasingly include AI. There are some aspects of these automated decisionmaking procedures that traditional civil rights laws can likely address, but a new technological reality means new gaps to fill. Indeed, while public statements by the FTC suggest that its initial focus is on regulation of those activities that can already be addressed by discrimination law, (13) there are also hints that it aims to go further. In Commissioner Slaughter's words: "Civil rights laws are the logical starting point for addressing discriminatory consequences of algorithmic decision-making.... [But] in many cases, existing civil-rights jurisprudence may be difficult to apply to algorithmic bias.... So, we must consider what other legal protections currently exist outside of direct civil rights statutes." (14)

Thinking about discrimination as unfairness confers several advantages that have so far been overlooked. It allows the Commission to regulate commercial domains, actors, injuries, and business practices that existing discrimination laws are unlikely to reach. These benefits may not be obvious because we typically think of discrimination as a separate problem from consumer protection, but where a large commercial industry creates products that discriminate or enable discrimination, the two merge, necessitating new ways to think about the problem. And though it might on its face seem incongruous to address discrimination with consumer protection authority, the FTC's actual charge is to regulate commerce broadly, (15) so there is no reason that the FTC's authority could not apply to issues of discrimination. (16) To be sure, the problem of discriminatory AI is multifaceted, and we do not argue here that FTC oversight is the best or only way to address it. We have in the past argued for application of and revisions to discrimination law, (17) the use of additional procedural protections, (18) the adoption of documentation standards, (19) and the introduction of impact assessment requirements. (20) Instead, this Article argues that the FTC can play a unique--and so far overlooked--role in the larger set of regulatory responses that are necessary to rein in discriminatory AI, and further argues that the Commission should focus its efforts there.

The Article proceeds in three Parts. In Part I, we identify key advantages of FTC intervention. One set of advantages stems from the Commission's expansive scope of authority, which allows it to address activities, actors, harms, and business practices that are beyond the reach of most antidiscrimination statutes. Two additional advantages stem from the FTC's capabilities as a regulatory agency, as compared to those of individual plaintiffs or plaintiff classes and to those of other enforcement agencies.

Part II addresses the Commission's legal authority. The FTC Act defines unfair acts and practices with a three-part test: (1) a likelihood of substantial injury to consumers; (2) the injury is not reasonably avoidable by consumers themselves; and (3) the injury is not outweighed by countervailing benefits to consumers. (21) Generally, to be unfair, something need not be otherwise illegal, but the Commission may take inspiration from established public policies, (22) and for the most part, it will not be difficult to find that discriminatory AI constitutes an unfair business practice. Part II also addresses deception and external challenges to the Commission's authority.

Part III examines one way that the FTC could go about this work. Over the last two decades, the Commission has addressed data security by developing a program of enforcement that amounts to a pseudo-common law approach, by issuing guidance and settling enforcement actions with public consent decrees that demonstrate the best and worst practices respectively. There are several interesting parallels between data security harms and discriminatory AI that lead us to think that the data security model could be a good one to build on. The other regulatory model that the FTC could--and seems likely to--pursue is the creation of trade regulation rules to affirmatively define what practices are unfair. (23) We focus on the common law approach because of the interesting parallels, because it is an established model that would likely be the easiest for the FTC to replicate, and because it would be worth pursuing in parallel to rulemaking, but we briefly discuss the rulemaking option as well.

1. THE BENEFITS OF FTC INTERVENTION

   There are several reasons that FTC intervention into the regulation of discriminatory AI would be a positive development. Currently, the regulatory scheme that is most directly applicable to discriminatory AI is the set of civil rights laws, which include Title VII, the Equal Credit Opportunity Act (ECOA), and the Fair Housing Act (FHA), among others. Algorithmic and Al-based decisionmaking poses challenges to enforcement of those laws in ways that have been documented at length in other scholarship. (24) Our interest here is slightly different. The FTC's Section 5 authority will indeed allow it to replicate some of the successes of those civil rights laws, but more importantly, the FTC's reach is broader. In this Part, we identify six benefits to FTC intervention that can help it reach beyond the structural and procedural limitations of discrimination law as applied to AI.

   1. The Broader Scope of Discrimination as Unfairness

      The FTC's broad and flexible authority to regulate unfair practices allows it to reach circumstances that should be deemed unfair because they are discriminatory, even though they are not contemplated by discrimination law. This includes domains outside those targeted by specific statutes, actors that the statutes do not reach, harms that are not specifically enumerated in the statutes, and business practices that promote discrimination but are not themselves discriminatory.

      1. Domains

         One major benefit of FTC intervention to address discriminatory AI is the Commission's ability to reach domains other than those already regulated by discrimination law. Most discrimination law applies to specific domains, such as employment, (25) credit, (26) and housing, (27) and is focused on concrete decisions within those domains, such as whether to hire, lend, or rent a home. Other laws consider discrimination in contracting (28) or access to...