In the same guidance, the agency also notes that companies open themselves up to FTC enforcement actions if they fail to uphold their privacy commitments, such as by retaining or using PII generated ...