The Federal Trade Commission has been actively flexing its authority as a privacy regulator in recent months. The agency has been especially focused on identifying data practices it views to be “unfair”, thereby essentially creating substantive obligations for how companies are permitted to use data. The FTC’s recent enforcement action and order against Avast Limited is one example of this trend.