The Federal Trade Commission has issued a new notice calling for input into how tech companies handle consumer data, a crucial first step in setting binding rules for the industry. Formally known as an Advance Notice of Proposed Rulemaking (ANPR), the filing calls for public comment on data collection, algorithmic discrimination, and commercial surveillance.

The notice stops short of suggesting specific rules, which are unlikely to come this year. Still, the questions suggest the commission is focused on concrete harms caused by data collection, whether through data breaches, ad targeting, or algorithmic discrimination. There’s particular focus on how large companies use automated decision-making systems that might impact consumers without their knowledge.

Posted in full on the FTC site, questions posed by the notice include “which practices do companies use to surveil consumers?” and “how prevalent is algorithmic discrimination based on protected categories such as race, sex, and age?” Others ask whether the First Amendment or Section 230 might limit the FTC’s authority to regulate such issues.

The FTC has also scheduled a public hearing on the proposed rules on September 8th in which members of the public are encouraged to give testimony on the issue.

“Firms now collect personal data on individuals at a massive scale and in a stunning array of contexts,” said FTC chair Lina Khan in a statement accompanying the notice. “Our goal today is to begin building a robust public record to inform whether the FTC should issue rules to address commercial surveillance and data security practices and what those rules should potentially look like.”

The rulemaking process typically gives the affected companies an opportunity to influence the pending rules, although their role in the process is necessarily limited. Google and Apple did not immediately respond to a request on how they would respond to the ANPR; Meta, parent company of Facebook, declined to comment.

A number of groups have called on the FTC to take action on data privacy, including lawmakers in Congress. In 2021, a group of Senate Democrats wrote a formal letter to Khan requesting new privacy rules from the commission. “Tech companies have routinely broken their promises to consumers,” the Senators wrote, “only to receive wrist-slap punishments after long delay.”

The notice comes exactly three months after the formal confirmation of the FTC commissioner Alvaro Bedoya, who did significant research on data privacy and algorithmic bias prior to joining the commission. The decision to issue the ANPR came after a 3–2 vote, with both Republican commissioners standing in opposition.

Despite sustained pressure for a federal data privacy standard, Congress has mostly stalled on concrete legislation, putting forward a range of proposals that have failed to gain majority support. Most recently, the American Data Privacy and Protection Act cleared committee in the House but is still awaiting a floor vote and faces an uphill battle in the Senate. Similar efforts to strengthen antitrust standards or regulate algorithms have also failed to bear fruit.

“We got to this moment because of years of inaction,” Sen. Amy Klobuchar (D-MN) told The Verge in a January interview, describing a still-pending bill to prevent discrimination in app stores. “A lot of people talk a big game, but nothing has passed.”

In response, many of the most urgent tech regulation challenges have fallen to the Federal Trade Commission. The commission is currently engaged in an ongoing lawsuit seeking to unwind Meta’s acquisition of Instagram and WhatsApp and, in July, filed to block the company from acquiring a VR software studio. In the wake of the Supreme Court repeal of abortion rights, President Joe Biden also called on the commission to protect data that might put abortion seekers at risk.

Update 1:41PM ET: Updated to reflect that Meta declined to comment.