"However, "there's no initial fining authority under Section Five of the FTC act," says Jacobs. Instead, businesses essentially get one free pass where they don't have to pay a fine, but are typically slapped with other kinds of enforcement."
"But while the FTC's enforcement on privacy issues is limited, it also faces some challenges. For instance, FTC v. Wyndham, a pending lawsuit over data security enforcement, could result in a curbing of FTC enforcement on many of these issues if it is successful."
Here’s why the FTC couldn’t fine a flashlight app for allegedly sharing user location data