RegImpact
ftcproposed· Published 9/25/2025· Effective 9/25/2025

Privacy Act of 1974; System of Records

The FTC is making technical revisions to several of the notices that it has published under the Privacy Act of 1974 to describe its systems of records. This action is intended to make these notices clearer, more accurate, and up-to-date.

What this rule actually says

The FTC is updating its internal paperwork about what employee and applicant data it collects and stores. These are technical clarifications—fixing outdated info, making descriptions clearer—not new requirements. Unless building an AI product that directly interacts with FTC employee records or applicant data, this doesn't change what founders can do with customer or user data.

Who it applies to

  • If you're collecting data from FTC employees or job applicants to the FTC: this applies to you. (Realistically: almost no one.)
  • If you're building an AI scribe, hiring tool, or support chatbot for non-government customers: this does not apply to you.
  • Jurisdiction: US-only. This only governs FTC internal systems, not state or international regulations.
  • Data scope: The rule covers FTC personnel records, employment applications, and HR data. It does NOT cover customer data, user conversations with your AI, or medical records in your AI scribe product.
  • If you're an FTC contractor or vendor: check whether your contract references Privacy Act compliance—unlikely for most indie founders.

What founders need to do

  1. Check if you interact with FTC systems (1 hour): Ask yourself: "Am I building something the FTC itself will use, or am I processing FTC employee data?" If the answer is no, stop here.
  1. If yes, review your data handling for FTC records (2–3 days): Document what FTC data you collect, how long you store it, who accesses it, and your security measures. This is basic privacy hygiene anyway.
  1. Align with FTC notices (1 day): Cross-reference the FTC's updated system-of-records notices (when published in full) against your actual practices. Correct any gaps.
  1. Update privacy policies if needed (1 day): If you handle FTC personnel data, ensure your privacy statement transparently describes FTC-specific handling.
  1. Monitor ongoing updates (ongoing, minimal): The FTC will publish final notices. Skim them once they land; they're unlikely to require operational changes for small teams.

Bottom line

Monitor, but don't act now unless you work directly with FTC data—and if you do, you'd probably already know it.