Broadband providers such as Comcast and AT&T will have to get customers’ permission before they can share personal data with other companies, the FCC ruled Thursday, marking a major expansion of privacy protections and perhaps shifting the balance of power in the online marketplace.
Those browsing on mobile devices could refuse to have their locations shared, while all users could instruct their internet service providers not to trade their web browsing history or information about what apps they are using under the rules, which the Federal Communications Commission adopted on a 3-2 vote.
“It’s the consumer’s information. How it is used should be the consumer’s choice, not the choice of some corporate algorithm,” said FCC Chairman Tom Wheeler, who led the push for the changes.
The rules will need to be published, and the industry will have a year to comply. In addition to internet use, the ISPs would have to allow customers to opt in to share their geographic locations, their financial or health information, and the contents of their communications.
Additionally, customers must be allowed to opt out of having information about their plans, such as the types of services they buy, shared.
Advertisers complained that buying and selling information about web browsing has fueled the Internet’s growth and warned that could slow down. ISPs said they are being singled out while companies that run popular websites and apps, such as Google and Facebook, won’t be affected.
That means the websites will continue to track users and sell the information they collect, giving them a financial advantage over the ISPs.
“The FCC’s order falls short of recognizing that consumers want their information protected based on the sensitivity of the information collected, not the entity collecting it,” Joan Marsh, a senior vice president for regulatory issues at AT&T, said in a statement. “The FCC’s divergent approach will ultimately serve only to confuse consumers, who will continue to see ads based on their web browsing history generated by edge providers even after they have been told by their service provider that their consent is required for use of such information.”
The internet is reshaping the privacy debate, giving both the government and corporations a chance to peek at behavior of Americans and technological tools to collect, store and analyze that information in bulk.
For companies, that means the ability to construct a profile of each online user based on browsing history, shopping and other online activities.
The difference for companies between opt-in and opt-out requirements could be huge.
One study showed that less than 20 percent of users agree when they are asked to opt in, but more than 80 percent remain when given the chance to opt out.
“This isn’t consumer choice; it’s recognition of consumer apathy,” said Michael O’Reilly, one of the FCC members who voted against the change.
Without revenue from selling customers’ information, he said, the ISPs may raise rates on consumers themselves.
The commissioners who voted to impose the rules said ISPs are different from websites or other online companies. Because they are the on-ramps to the internet, ISPs see all of the traffic.
Mr. Wheeler, at Thursday’s meeting, recounted seeing a refrigerator that tracked its own contents and shared it online. Even if that information went straight from the fridge to an iPhone, it still went via someone’s bandwidth, meaning “the ISP knows what goes in and out of a refrigerator,” he said.
Mr. O’Reilly, though, said given the explosion of encrypted data on webpages, it’s not true that ISPs see as much anymore.
Internet service providers wanted the FCC to keep out of the issue altogether. They said the Federal Trade Commission had already issued rules of the road requiring companies to abide by their stated privacy policies and insisted that was enough protection.
Privacy advocates, meanwhile, cheered the ruling but said they wished it had gone further.
Claire Gartland, a lawyer at the Electronic Privacy Information Center, said the rules let companies share data as long as they strip out identifiers that tie it to a specific person. She said that would appear to allow companies to sell the information tied to an advertiser ID number, which, while it lacks a name, can still track a person.
“Allowing this exception, which seems to be pretty broad, would kind of undermine the protection for web browsing data,” she said.
Advocates also hoped the FCC would rein in contracts that lock consumers into forced arbitration, rather than recourse to courts, when they have disputes with their ISPs. The commission didn’t take that step Thursday but said it would begin formal rule-making on the issue.
• Stephen Dinan can be reached at sdinan@washingtontimes.com.
Please read our comment policy before commenting.