The nation’s top privacy regulator is facing pressure to crack down on the data collection and privacy practices of Comcast, AT&T, and others in the wake of a court ruling that could give the Federal Trade Commission the power to police internet providers again.
Consumer advocate groups are urging the FTC to reopen a complaint against AT&T, Comcast, and Cablevision for alleged deceptive practices related to their privacy polices. According to Public Knowledge, Consumer Federation of America, Center for Digital Democracy, and others, the cable providers are violating their subscribers’ privacy by inadequately notifying them how much of their data providers are gathering, compiling, and using for targeted advertising.
“Specifically, the complaint provides evidence that these cable operators failed to adequately disclose (1) the extent to which they were collecting consumer information via their non-common carrier subscription television services; (2) how they shared this information; and (3) how this information was combined with personal information collected through other means, such as information collected via the subscription video provider’s Title II internet offering to create comprehensive profiles on consumers, including data about consumers’ families, personal habits, and other characteristics,” the groups said in a letter to acting FTC Chairwoman Maureen Ohlhausen Monday.
Their complaint was filed just over a year ago, months before the FTC lost a lawsuit it brought against AT&T in federal court for deceiving subscribers of the wireless carrier’s unlimited data plans. AT&T was throttling those users after they reached a download threshold, and when the FTC tried to fine AT&T, it argued in court the FTC could no longer regulate AT&T because of its recent reclassification as a “common carrier.” That’s a public utility designation under the Federal Communications Commission bestowed on all internet service providers in 2015 in order to enforce net neutrality rules.
In an outdated effort to avoid over-regulation, Congress bars the FTC from regulating common carriers, a classification codified in Title II of the Communications Act the FCC used to break up telephone monopolies in the 1930s. A federal court sided with AT&T in the case, which had the unexpected consequence of barring the government’s top privacy watchdog from overseeing the privacy practices of any company acting as a common carrier, including Google, which offers internet access via Google Fiber, AOL, and soon Yahoo, which will be owned by Verizon. All collect troves of data on users, create sophisticated profiles, and monetize that data for targeted advertising.
In May, the court granted the FTC’s request for an en banc hearing, in which all of the judges on the Ninth Circuit Court of Appeals will hear the case, and vacated last year’s ruling by a three-judge panel. In light of the court’s decision, the groups in Monday’s letter want the FTC to take up the year-old complaint against AT&T, Comcast, and Cablevision.
“Since the complaint was filed, leading Internet Service Providers, cable and telephone companies have significantly expanded their ability to gather, analyze and make actionable data that is used to target subscribers, their families, and other consumers,” they wrote.
In their complaint the groups detail an intimate amount of personally identifiable information (PII) cable providers are collecting on subscribers through their set-top boxes.
“In terms of the data cable operators get, it’s not an estimate based on a sampling, the way Nielsen’s is, but rather a full accounting of every set top box owner’s behavior — what they watched, how long they watched, and whether they changed channels on the commercial break,” the complaint reads.
Cable providers included in the complaint like Comcast and AT&T, which owns DirecTV, also provide internet service and collect data from the same subscribers’ internet browsing habits, and combine both sources of PII into comprehensive subscriber profiles. Beyond their own targeted advertising, those same companies make a practice out of selling those data profiles to third parties, who yet again combine the information with other PII gleaned from retail loyalty cards, for example, and sell targeted advertising.
“Given the amount of third-party access to cable viewing data they provide, it is unclear exactly how cable companies are following cable privacy laws, which require cable providers to provide a written statement to subscribers that clearly and conspicuously informs the subscriber of the nature of the use of their PII,” groups said in their complaint.
The consumer groups described cable and internet providers’ disclosures as “wholly inadequate,” adding they “leave out the extent to which they are combining and sharing information, even when that information is known to the cable companies.”
“The [FTC] found that when a disclosure deprives consumers of sufficient information to make informed choices and thereby impedes competition in the marketplace, the disclosure is insufficient to cure violations of the Commission’s rules,” the complaint reads. “Here, cable operators are using consumer information in ways that are not clear, nor conspicuous, resulting in a violation of the privacy rules.”
Comcast alone is compiling “an unprecedented set of information” in the words of one of its own executives by “harness[ing] viewing data from the set-top boxes and streaming apps used by its millions of cable-TV subscribers to create products it can license to other companies,” according to a Wall Street Journal report.
“Once third parties are given access to confidential viewing data, they can combine it with still more data sources to create an even more comprehensive look into a person’s life,” consumer groups said. “Privacy policies do not inform consumers of the extent to which their information is being shared and combined with other data to target advertising on an individual level, or of any of the other practices described above.”
Ohlhausen has repeatedly expressed a desire to rectify the case and even repeal the agency’s common carrier exemption, but it’s unclear how the FTC chair will look on the complaint. When asked how she’d potentially run the agency in January before President Donald Trump appointed her the agency’s acting chief, Ohlhausen said she’d want to see “substantial harm” before taking enforcement action against companies. Hypothesizing on the potential for harm, she said, limits the marketplace.
