Who Is Watching When You Use the Internet?

WIll There Be New ISP Privacy Rules?

This year, over a dozen states have introduced legislation limiting what internet service providers can do with the data they collect while you surf the Web.

The proposed rules would give customers more control over how ISPs may use data they collect about customers’ unencrypted online activity; that includes things like devices you connect to the Internet, the websites you visit, when you go online and how long you remain, the software you use, and more. Your ISP has access to everything about your Internet traffic that isn’t encrypted, enabling it to build a highly detailed dossier on you and your household that is very valuable to marketers.

The rules, which vary by state, would require ISPs to get your permission before sharing or reselling your data to third parties. Affiliated business units of an ISP would have access to your data for marketing purposes unless you opt out of sharing it. Your ISP would not require your permission to use your data for the purpose of providing services you have ordered.

These rules are, essentially, the same as the ones that govern how telephone companies can use your data. That makes sense since the FCC has ruled that ISPs, like telcos, are common carriers under Part II of the Telecommunications Act of 1936.

ISPs would also be required to clearly and prominently disclose what data they collect on customers’ Internet activity and how it is used. Furthermore, ISPs would have to take “reasonable steps” to secure customer data against unauthorized disclosure or use.

The Empire Strikes Back

The FCC proposed rules in 2016 to limit data collection by ISPs, but they never went into effect. Telecommunications lobbying groups successfully made the case that limiting the data marketing practices of ISPs, but not the giant corporations that run the world’s most popular websites would not be fair.

In the years since, many states have introduced their own legislation to address the issue, but for the most part, they have failed or are still pending a vote. Only three states, Maine, Nevada, and Minnesota have passed laws that prohibit internet service providers from disclosing personally identifying information, unless they get permission from subscribers. The National Conference of State Legislatures website has an updated list of all the pending state legislative efforts to clamp down on Internet Service Providers.

The ISP industry will continue to lobby against these “burdensome and unnecessary” rules. Prices will go up, they say, and customers won’t get anything more for their money. Verizon claims they do not sell customers’ personal web browsing data, but they do admit to advertising programs that use “de-identified” customer browsing data, and sell “aggregate insights” to third parties. Some privacy advocates claim that even with this anonymized data, it’s still possible to personally identify consumers.

It’s true that even if these proposed rules were implemented, the websites you visit would still be able to collect your browsing data. But the scope of data available to individual websites is small when compared to ISPs that can see everything you do online. These baseline privacy rules would provide much-needed safeguards that won’t cost a lot to implement. They make sense and they should be enacted.

I encourage you to contact your state legislators and ask that they make consumer privacy a priority, and pass new laws to limit the ability of ISPs to sell your digital soul to the highest bidder.

What's your opinion? Should ISPs be forced to disclose what data they are collecting? Or are you one of those who say "Who cares? I have nothing to hide." Your thoughts on this topic are welcome. Post your comment or question below…