Introduction
Protecting consumer privacy rights presents a particular challenge given the prevalence of data breaches. This Article notes that current law is woefully inadequate in protecting the privacy rights of consumers. Notably, the law fails in the following four areas: (1) classification of consumer data, (2) lack of a comprehensive approach, (3) after-the-fact focus, and (4) limited accountability for third parties. Although it may be impossible to eliminate all data breaches, more regulations can bolster protection without restricting technological advancements. This Article proposes a contractual approach to privacy protection for consumers. It argues that the creation of mandatory implied contractual terms of data privacy, regulated by the Federal Trade Commission (FTC), is necessary to better protect consumers from data breaches. Part I conceptualizes data acquisition practices, proposes a data reclassification solution, and analyzes trade-offs incurred by further regulations. Part II provides background on the discombobulated state of consumer privacy governance and how implied contractual terms solve the law’s pitfalls by providing a comprehensive solution. Part III provides the following six arguments in favor of the implementation of implied contractual terms: (1) the FTC possesses the requisite authority to regulate implied contractual terms, (2) current precedent’s policy implications align with the proposed contractual terms, (3) the addition of implied terms of data privacy enables a cause of action before a data breach occurs, (4) contractual obligations promote data minimization for businesses collecting consumer information, (5) the focus of the law shifts to holding more parties responsible, and (6) there is a clear path that the FTC may follow to implement the implied contractual terms of data privacy. Part IV addresses anticipated criticisms.