Federal Communications Commissioners voted in favor of the strongest privacy rules a federal regulator has ever adopted Thursday, putting internet service providers at the mercy of their customers if they want to collect valuable data on internet browsing habits for things like targeted advertising.
Democratic Commissioners Mignon Clyburn, Jessica Rosenworcel and FCC Chairman Tom Wheeler passed the rules along a 3-2 party line vote, with Republicans Ajit Pai and Michael O’Rielly voting against.
The new rules detailed by the agency earlier this month mean internet service providers (ISPs) like AT&T and Comcast will have to get express, advance permission from subscribers before collecting any of their data beyond names and addresses, making data on browsing habits and app usage off-limits until customers opt-in.
Those fall under the rules’ definition of sensitive data, a tier worthy of higher scrutiny that also includes medical, financial, geolocation and student data, Social Security numbers and the content of communications.
“It is the consumer’s information; it is not the information of the network the consumer hires to deliver that information,” Wheeler said before calling for the vote. “What this item does is to say that the consumer has the right to make a decision about how her or his information is used.”
Wheeler cited a Pew Research study recalled by Clyburn “that 91 percent of Americans feel they have lost control over their personal information and how it is used by faceless companies,” and a comment by Rosenworcel lamenting the difficulty of controlling privacy now that “everything is connected.”
“As everything becomes connected, the companies that provide those connections know everything,” the chairman said, recalling a demonstration he saw last week of a smart refrigerator capable of tracking what’s inside in real time. “Even when that data only goes to a refrigerator owner’s mobile device, it is known by AT&T or Comcast or whoever.”
“So the ISP knows what goes in and out of a refrigerator,” he added. “Internet providers shouldn’t be able to sell something that’s yours without your permission.”
As critics of the rules have pointed out since the FCC first pitched the proposal, the rules will not apply to edge providers like Google and Facebook, which are subject to Federal Trade Commission rules allowing the collection of most data, including browsing habits and app usage, and only require users be given the ability to opt-out for all but the most sensitive information collection.
Opponents say the lack of parity will give a market advantage to edge providers, and prompted Rosenworcel to call for an inter-agency privacy council to strive for a single privacy standard across government, and Pai to suggest the only course forward was for the FTC to come up to the FCC’s level.
“So if the FCC truly believes that these new rules are necessary to protect consumer privacy, then the government now must move forward to ensure uniform regulation of all companies in the internet ecosystem at the new baseline the FCC has set,” Pai said.
“That means the ball is now squarely in the FTC’s court. The FTC could return us to a level playing field by changing its sensitivity-based approach to privacy to mirror the FCC’s. No congressional action would be needed in order for the FTC to establish regulatory consistency and prevent consumer confusion”
Privacy advocates including the pro-net neutrality group Public Knowledge and Massachusetts Democratic Sen. Ed Markey, who together lobbied heavily for the rules last week, applauded Thursday’s vote.
“While much remains to be done to protect consumers online writ large, the commission’s rules establish a baseline level of protection for all.” Public Knowledge policy fellow Dallas Harris said after the vote. “Yet, consumer protection rules are only as strong as their ability to be enforced, so it is imperative that the commission follow these strong rules with strict enforcement.”
Markey described the rules as “the next logical step since enshrining net neutrality,” the rulemaking from last year that made the rules necessary by reclassifying ISPs as common carrier public utilities, which the FTC is legally barred from regulating.
“These rules will ensure that as technology changes, our core values do not — that consumers, not corporations, have control over their personal information,” Markey said. “Consumers should be able to know at any given time what kind of information is being collected about them by their internet service provider and how that information is being used.”
Opponents including the Information Technology and Innovation Foundation, a tech policy think tank, and Sam Cullari, Comcast’s former deputy general counsel, said the negative effects will spread throughout the online ecosystem.
“The privacy framework established today sets a terrible precedent likely to reverberate throughout the Internet ecosystem for years to come,” said Doug Brake, a telecom policy analyst for ITIF. “Counting browsing and app history as sensitive data are a particularly disappointing departure from the flexible oversight regime that has helped make the U.S. data-fueled economy the envy of the world.”
Cullari said when edge providers like Google agree with huge corporations with competing interests like Comcast, it should be a “red flag that the FCC is charging in the wrong direction.”
“Most consumers connect to the Internet through multiple providers, and internet browsers like Google Chrome and social networks like Facebook are privy to a broader universe of customer information than any single ISP,” Cullari said. “Given that reality, it is impossible to square the commission’s professed devotion to consumer privacy with its uneven approach, as Chairman Wheeler’s proposal would impose strict opt-in consent restrictions on ISPs for the use of geo-location and web browsing data while giving edge providers a pass on utilizing the exact same data.”
Opponents believe limiting data monetization from subscriber data will eventually raise the cost of internet access.
