The Federal Trade Commission published a new report about social media platforms and video streaming services’ data collection policies, and the results are damning if not unexpected. The report, which was released on September 19th, found that these platforms not only surveil consumers but often retain vast troves of data indefinitely about users and non-users alike — and suggests they can’t be trusted to regulate themselves.

Given the billions companies stand to earn from collecting and monetizing user data, “self-regulation has been a failure,” the report says. “Predicting, shaping, and monetizing human behavior through commercial surveillance is extremely profitable — it’s made these companies some of the most valuable on the planet — and putting industry in charge has had predictable results.”

The problem, the report finds, lies not with one particular company’s business model but with industry-wide incentive structures that reward harvesting, collecting, and monetizing user data. “While lucrative for the companies, these surveillance practices can endanger people’s privacy, threaten their freedoms, and expose them to a host of harms, from [sic] identify theft to stalking,” FTC chair Lina Khan said. “Several firms’ failure to adequately protect kids and teens online is especially troubling.”

The report is based on questions the FTC sent to nine companies in December 2020 under section 6(b) of the FTC act, which lets the commission conduct studies without a specific law enforcement purpose. The orders were sent to Amazon (which owns Twitch), Facebook, YouTube, Twitter, X, Snap, ByteDance (owner of TikTok), Discord, Reddit, and WhatsApp, and focused on these companies’ data-collection and retention practices, as well as how these practices affect children and teenagers.

Among the findings in the 129-page report is the fact that even people who don’t use these platforms had their data collected. The companies acquired consumer data from a variety of sources, including advertisers and data brokers, advertising tracking technology, and inferences from algorithms, data analytics, or artificial intelligence. Companies can retain this data indefinitely, the report found — and some didn’t delete users’ data in response to user deletion requests. Instead, some companies de-identified data rather than deleting it, while others would only delete some data.

The report ends with recommendations to curb these practices, which the document says are incentivized by the companies’ business models. The FTC encourages Congress to pass comprehensive privacy legislation to limit surveillance. In the interim, the commission suggests that companies limit their own data collection policies, stop using “privacy-intensive ad tracking technologies,” and implement greater privacy protections for teenagers.