White House Nominates FTC Consumer Protection Chief Christopher Mufarrige as Commissioner

The official who has run the Federal Trade Commission’s consumer protection work for most of the past two years has been nominated to help lead the agency. On November 9, 2026, the White House sent the Senate the nomination of Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection, to be a Federal Trade Commissioner for a seven-year term. The same message formally withdrew the stalled nomination of WeatherTech founder David MacNeil. For privacy teams, the choice matters more than a typical personnel move. Mufarrige’s bureau has brought the agency’s recent children’s privacy cases, written its age verification policy and launched its AI chatbot study, and his public remarks lay out how he weighs privacy harm. If he is confirmed, those views would carry a commissioner’s vote.

The nomination, and a correction on the seat

Bloomberg News reported the nomination on the evening of November 9 and described it as filling a Republican vacancy alongside Chairman Andrew Ferguson and Commissioner Mark Meador. The White House paperwork is more specific than that. Mufarrige, listed as “of Texas,” is nominated “for the term of seven years from September 26, 2026, vice Alvaro M. Bedoya, term expired.” Bedoya is a Democrat. MacNeil’s nomination, by contrast, was for the term that began September 26, 2025, in place of Republican Melissa Holyoak, who left the Commission in November 2025 to serve as interim U.S. Attorney for Utah.

FTC seats are not legally assigned to a party. The FTC Act only bars more than three commissioners from belonging to the same party. If Mufarrige is confirmed, the Commission would have three Republican members and two empty seats, including the Holyoak seat MacNeil had been nominated to fill. Descriptions of him as taking MacNeil’s place are accurate politically, but not on paper.

MacNeil’s path to the agency never got going. According to UPI, he was first nominated in May 2025 as an ambassador-at-large for industrial and manufacturing competitiveness. That nomination was returned without confirmation on January 3, 2026, and the FTC nomination followed ten days later. It sat in the Senate for ten months before the November 9 withdrawal, and the President announced the same day that MacNeil would become “Special Envoy for Manufacturing.” The Verge reported that the White House wants more Republican nominees confirmed before Democrats take control of the Senate after the midterm elections. As of November 10, no confirmation hearing date for Mufarrige had been publicly announced.

Why a two-member Commission raises the stakes

The Commission has been operating with only Ferguson and Meador. In Trump v. Slaughter, decided June 29, 2026, the Supreme Court ruled 6–3 that the President may remove FTC commissioners at will, overruling Humphrey’s Executor and upholding the removal of Democratic Commissioner Rebecca Slaughter. That ruling ended any prospect of the Democratic seats being restored by litigation. A third confirmed commissioner would give the agency a firmer quorum for votes on complaints, consent orders and rules. And because removal is now at the President’s discretion, commissioners’ views tend to track the administration’s priorities more closely than they once did. That makes Mufarrige’s recent record a reasonable guide to how he would vote.

What his consumer protection record signals

Chairman Ferguson appointed Mufarrige bureau director in February 2025 after serving as Holyoak’s chief of staff and attorney adviser. Earlier, in the first Trump administration, he was a senior adviser to the director and deputy director of the Consumer Financial Protection Bureau. His most detailed public statement of priorities is a March 12, 2026 speech to an advertising law conference, which he gave in his personal capacity. Five themes from that speech and from the bureau’s actions stand out for privacy teams.

1. Children come first. He called protecting kids online the top privacy priority “for both legal and policy reasons.” He pointed to the bureau’s COPPA cases: the complaint against Iconic Hearts, the operator of the Sendit app, which is in litigation and which we covered in our report on the FTC suit against Sendit and its CEO; the Apitor connected-toy case; the Pornhub deception case; and the $10 million Disney order, discussed in our analysis of Disney’s YouTube settlement. The Disney order lets the company stop its video-by-video review if YouTube deploys age verification that can ensure COPPA compliance.
2. Age verification is a tool, not a threat. After a January 28, 2026 workshop, which we summarized in our piece on the FTC’s growing focus on age verification, the Commission issued a February 25 COPPA enforcement policy statement. It says the agency will not bring COPPA cases against operators that collect data solely to determine age, as long as they meet conditions on use, sharing, retention, notice, security and accuracy. Mufarrige called age verification “the most child-protective technology to emerge in decades” and rejected readings of the statement as a pullback, warning of “aggressive action” against companies that claim its protection without meeting its terms.
3. Privacy harm must be shown. He argued that privacy is often a “secondary characteristic” for consumers, so privacy representations may be less likely to be material than claims about price. He tied the bureau’s approach to the February 2026 workshop on consumer injuries and benefits in the data-driven economy, previewed in our note on the FTC’s injury-and-benefits workshop, and highlighted panelists who described benefits of behavioral advertising. Expect a commissioner who asks for evidence of injury before supporting broad unfairness theories about ad tech.
4. Statutes set the agenda. He said the bureau’s privacy priorities “are set by Congress”: Section 5, COPPA, the Fair Credit Reporting Act and the Protecting Americans’ Data from Foreign Adversaries Act. On February 9, 2026 the bureau sent PADFAA warning letters to 13 data brokers, a move we covered in our look at the FTC’s national security warning to data brokers. Data broker enforcement framed as national security looks likely to continue.
5. AI: police deception, don’t regulate the technology. The bureau has pursued AI cases built on false claims, including Air AI, Workado’s accuracy claims for its AI content detector, and Cleo AI. In December 2025 the Commission reopened and set aside the 2024 Rytr consent order, which Mufarrige described as correcting a theory that condemned a tool “simply because it potentially could be used in a problematic manner.” The one AI project aimed at children, the Section 6(b) study of chatbot companions sent to seven companies including Alphabet, Meta, OpenAI, Snap and X.AI, he described as gathering information “without depressing innovation.”

On rulemaking, he called himself “no friend to sweeping, economy-wide rules,” citing the noncompete rule dissents he helped draft for Holyoak, but said he supports “narrowly-tailored rules based on strong empirical evidence” where Congress has granted authority. That fits the Commission’s current preference for case-by-case enforcement over rulemaking in privacy, alongside narrower proceedings on rental housing fees and negative option marketing.

What this means for compliance teams

• COPPA programs need to be current. The amended COPPA Rule’s compliance date was April 22, 2026. A commissioner who ranks children first will keep those cases coming, and mixed-audience services are in scope.
• If you use age assurance, document the policy statement’s conditions. Purpose limitation, deletion, vendor assurances and accuracy testing are the price of the safe harbor.
• Privacy claims are still deception claims. A materiality-focused regulator still enforces broken promises. Make sure your privacy policy, consent flows and AI marketing claims match what your systems actually do.
• Data sales to foreign adversaries are a live risk. Check data broker and data licensing contracts for PADFAA exposure.
• Watch the states. A federal approach that requires proof of harm leaves more room for state regulators such as California and Texas, which are applying their own laws to ad tech.

Frequently asked questions

Is Mufarrige already a commissioner?

No. He has been nominated, which is only the first step. The Senate Commerce Committee must consider the nomination and the full Senate must confirm him. Until then he remains bureau director.

Does the Commission need a third member to act?

The FTC has continued to vote with two commissioners. Adding a third would reduce doubts about quorum and give the agency a tiebreaker on contested votes.

Would his confirmation change the COPPA age verification policy?

Unlikely in direction. He helped shape it and has defended it publicly. The Commission also said it intends to begin a formal COPPA review on age verification, and his vote would bear on that.

Who would run the Bureau of Consumer Protection?

No successor has been announced. The bureau’s priorities are set largely by the Chairman, so a change in director is unlikely to change course quickly.

The person who wrote the playbook

Most FTC nominees bring a record from Capitol Hill, a law firm or academia. Mufarrige brings the FTC’s current consumer protection enforcement record. If the Senate confirms him, companies should expect that record to continue from a commissioner’s seat: active COPPA enforcement, support for age verification, data broker cases framed as national security, and skepticism toward privacy theories that cannot show harm. The White House nomination notice and his March 2026 prepared remarks are the two documents to read first.