I Spent a Week Trying To Make the Broadband Lobby Answer a Simple Question About Selling Your Data

House Republicans last night voted to overturn an FCC rule that bars your internet provider from telling advertisers which websites you visit and what you search for in exchange for money; the Senate voted along the same lines last week. The decisions were immediately praised by lobbying groups like the NCTA, which represents broadband companies like Verizon and Comcast — and which for some reason framed the gutting of federal privacy regulations as good for privacy, a choice that the organization seemingly cannot explain, no matter how many times you ask.

The NCTA’s statement after last week’s vote read as follows:

“We appreciate today’s Senate action to repeal unwarranted FCC rules that deny consumers consistent privacy protection online and violate competitive neutrality. … Our industry remains committed to offering services that protect the privacy and security of the personal information of our customers. We support this step towards reversing the FCC’s misguided approach and look forward to restoring a consistent approach to online privacy protection that consumers want and deserve.”

Emphasis added. It should be immediately puzzling to anyone reading that statement how the broadband industry “remains committed” to personal privacy while also encouraging (and celebrating) a regulatory change that would allow your ISP to make a buck by telling a third party which websites you visit so that they can try to sell you things. Privacy is generally understood as a state defined by offering less disclosure about oneself, not more. Seeking clarity, I asked the NCTA to explain how it squares this commitment with its apparent antithesis. What’s ensued has been a week-long semantic maze navigated by myself and Joy Sims, a (very patient) spokesperson for the NCTA, reproduced below:

From: Sam Biddle
To: Joy Sims
March 23rd, 2017

Hi Joy—I’m wondering if you could provide some clarity on today’s NCTA statement on the FCC privacy vote. The statement reads:

“Our industry remains committed to offering services that protect the privacy and security of the personal information of our customers.”

Can you explain just how this commitment squares with the ability to sell user data to advertisers, should the vote pass the House?

thank you,
Sam Biddle

From: Joy Sims
To: Sam Biddle
March 23rd, 2017

HI Sam,

For more explanation, I’ll direct you here: https://www.ncta.com/news-and-events/media-room/content/protecting-consumer-privacy-online

Also, in late January, ISPs reaffirmed their commitment to continue protecting consumer privacy based on longstanding practices that are based on the FTC’s highly respected framework and have governed the marketplace for 20 years. The (above) release shows these specific privacy principles regarding transparency, consumer choice, data security and data break notifications.

Thanks for asking,
Joy

The link in the above email did not answer or even address the question.

From: Sam Biddle
To: Joy Sims
March 23rd, 2017

Thanks Joy. That doesn’t answer my question, though. How does the NCTA think that permitting the sale of user data to advertisers reflects a commitment to customer privacy? It seems to reflect the opposite.

From: Joy Sims
To: Sam Biddle
March 23rd, 2017

This might give you more background on our position:

https://www.ncta.com/platform/public-policy/an-existing-internet-privacy-plan-that-works-for-everyone/
https://www.ncta.com/platform/public-policy/fcc-privacy-plan-will-confuse-consumers-and-provides-no-added-protection/

Thanks,
Joy

Again, neither of these links answered the question of how sharing your browser history with shoe companies and McDonalds is a pro-privacy change.

From: Sam Biddle
To: Joy Sims
March 23rd, 2017

Let me put it more bluntly:

Does the NCTA believe that permitting ISPs to sell user browsing data will have a positive effect on customer privacy? If so, how?

From: Joy Sims
To: Sam Biddle
March 23rd, 2017

I hear your question, but our statements and releases speak for themselves.

Thanks.

From: Sam Biddle
To: Joy Sims
March 23rd, 2017

But your statements and releases don’t address this question whatsoever.

In the July 6th release, the NCTA states “Consumers expect to learn about new products and services through marketing or advertising based on non-sensitive data.”

But user browsing history, which under the pending FCC rule changes will now be available for sale to advertisers, is classified by the FCC as “sensitive,” not “non-sensitive” information.

The question remains unaddressed by the NCTA: How does the sale of FCC-defined sensitive user data to advertisers by ISPs reflect the NCTA’s commitment to user privacy?

From: Joy Sims
To: Sam Biddle
March 23rd, 2017

Let me try again to see if this helps answer your question…

NCTA’s member companies will not be selling “sensitive” customer data to advertisers. The companies have never challenged the recognized categories of sensitive data (health, financial, children’s information, precise geo-location, etc). That information has not and will not be used. 

Just like Google, Facebook and others use non-sensitive web browsing information to provide ads to consumers based on their browsing history/interests/search, ISPs will be able to do so as well. But sensitive information is off-limits under the FTC’s framework. We just want consistency with the FTC framework for all Internet entities with access to online data. 

Thanks,

Joy

Here, Sims was making reference to the FTC’s privacy framework, which doesn’t define the websites you visit while at home as “sensitive” information requiring your consent to share or sell, whereas the FCC has defined it as sensitive. It’s not a surprise the broadband lobby strongly prefers the FTC’s framework for this reason: Simply because it is weaker.

From: Sam Biddle
To: Joy Sims
March 24th, 2017

Assuming the rule change goes through, will NCTA member companies be permitted to sell user web browser history to advertisers?

From: Joy Sims
To: Sam Biddle
March 24th, 2017

As we understand it, it will give NCTA member companies the ability to function the same as other online entities.

 – Joy

From: Sam Biddle
To: Joy Sims
March 27th, 2017

So the answer to the question “will NCTA member companies be permitted to sell user web browser history to advertisers” is yes?

From: Joy Sims
To: Sam Biddle
March 27th, 2017

Could be worth your time dialing into this media call tomorrow.

ADVISORY:  Internet and Technology Leaders Press Call Tuesday re Internet Privacy and House Vote on FCC Regulations

 Please join a press call Tuesday morning with senior leaders from the internet, technology, and ad industries to discuss Tuesday’s planned House vote on broadband privacy regulations. These leaders will call for a consistent privacy framework to protect consumer privacy.

Last week, the Senate passed S.J. Res. 34, a Congressional Review Act resolution disapproving the FCC’s recently enacted broadband privacy regulations and the House is expected to vote tomorrow.  This press call will 1) provide context for the CRA procedure, 2) explain the strong protections that already exist for consumer data apart from these flawed and counterproductive regulations, and 3) describe how these regulations give consumers a false sense of consumer privacy. 

Withdrawing the FCC’s flawed two-tiered privacy regulations is a vital step towards developing a truly comprehensive and effective privacy framework for the entire internet based on the successful FTC approach.  The FCC rules abandon the longstanding bipartisan consensus in favor of technology neutral and comprehensive privacy regulation on the internet, and upends consumer expectations by abandoning the FTC’s longstanding “sensitivity based” framework for privacy. 

Participants 

• Jon Leibowitz, former FTC Chairman, Co-Chair 21st Century Privacy Coalition (moderator)
• James Assey, Executive Vice President, NCTA – the Internet & Television Association
• B. Lynn Follansbee, Vice President, Law & Policy, USTelecom
• Jim Halpert, General Counsel, Internet Commerce Coalition
• Julie Kearney, CTA
• Emmett O’Keefe, Senior Vice President of Advocacy, DMA
• Howard Waltzman, General Counsel, 21^st Century Privacy Coalition

The conference was hosted by representatives from a variety of broadband lobbying groups, including the fascinatingly named 21st Century Privacy Coalition, which advocates for the weakening of privacy regulation. I posed my question — How does the sale of ISP browsing history to advertisers improve customer privacy? — to the entire group, and was answered only by Howard Waltzman, who replied, “I’d turn the question around a little bit: Today the norm for the entire rest of the internet ecosystem is that edge providers, advertisers are able to share non-sensitive information on an opt-out basis… The question is, why would you have different rules for ISPs in that regard?”

This response was akin to those provided by Sims and the NCTA, eager to point out that “edge providers” — content companies, in regulatory speak — like Facebook are already selling your information to advertisers, so why can’t your ISP, too? Which is a great point, actually, but not one that explains how you can reconcile a commitment to customer privacy with the commodification of that customer’s browsing habits.

I asked again, and this time Waltzman replied that “there hasn’t been a negative effect on consumer privacy” from working with advertisers in the case of content providers like Facebook or Hulu. With regards to the gutted FCC regulations, “what creates a positive effect on customer privacy is it will create uniformity” between how other companies are already selling your information to advertisers and your home internet provider.

That was as much of an answer as I got. The industry figures repeated again and again that the FCC change is a victory for “transparency” and “accountability,” and that in the words of Waltzman, consumer opposition to the rule change has been “ginned up” by “misinformation.” The only thing they didn’t say is how the change will improve your privacy. At this point, it’s probably best to assume it will not.

Top photo: People enter the Federal Communications Commission building in Washington, DC, on December 11, 2014 .