WASHINGTON • The Federal Trade Commission on Thursday said it was considering adopting new rules to prohibit harmful commercial surveillance and lax data security, saying American consumers are often unknowingly giving up personal information ranging from their menstrual cycles to how they pray.

FTC Chair Lina Khan said “firms now collect personal data on individuals on a massive scale and in a stunning array of contexts.”

The FTC is issuing an advanced notice of proposed rulemaking to address commercial surveillance, the “business of collecting, analyzing, and profiting from information about people.”

The FTC said companies are often incentivized “to collect vast troves of consumer information, only a small fraction of which consumers proactively share.”

“Whether they know it or not, most Americans today surrender their personal information to engage in the most basic aspects of modern life,” the FTC said in its notice.

“When they buy groceries, do homework, or apply for car insurance, for example, consumers today likely give a wide range of personal information about themselves to companies, including their movements, prayers, friends, menstrual cycles, web-browsing, and faces, among other basic aspects of their lives.”

Republican FTC Commissioner Noah Phillips, opposing the rulemaking proposal, said it “provides no clue what rules the FTC might ultimately adopt” and suggested it is a first step “to issue rules that fundamentally alter the internet economy without a clear congressional mandate.”

Also opposing the proposal, Republican FTC Commissioner Christine Wilson said she was worried that opponents of privacy legislation that is currently being debated in Congress would use the FTC proposal as “an excuse to derail” the legislation.

The proposal won praise from Democrats in Congress.

“This announced rulemaking is a tremendous win for consumers, promising strong protections for privacy rights and personal data, and accountability for violating them,” said Senator Richard Blumenthal. “Big Tech’s exploitation of Americans’ private information, anti-competitive behavior, and data breaches have created a crisis that demands action.”

Under the FTC’s existing authority to prohibit “unfair or deceptive acts” it cannot seek fines for a first offense and it said that “may insufficiently deter future law violations” adding new rules could set “clear requirements or benchmarks by which to evaluate covered companies.”

The public can offer input on the FTC notice and the commission will hold a virtual public forum on Sept. 8.