FCC to ISPs: Stop Spying

The Internet just got a lot more private for the average user thanks to a recent Federal Communications Commission ruling. Maybe. On October 27, the FCC’s commissioners voted 3–2 to enact new rules that require broadband providers to get permission from subscribers before tracking their browsing, app usage, location, and financial information for advertising purposes. Privacy advocates praised the decision.

“Today’s vote is a historic win for privacy and free expression and for the vitality of the Internet,” said Jay Stanley, senior policy analyst for the ACLU. “Just as telephone companies are not allowed to listen in to our calls or sell information about who we talk to, our internet providers shouldn’t be allowed to monitor our internet usage for profit.”

“There is a basic truth: It is the consumer’s information,” FCC Chairman Tom Wheeler told the New York Times after the decision. “It is not the information of the network the consumer hires to deliver that information.”

Whether the new rules hold up to legal challenges is anyone’s guess, and with a new presidential administration, there’s always a chance that they could be overturned. Even so, any such change would likely be several years off.

Currently, users have to opt out of tracking by contacting their providers, but even that is tricky. AT&T charges customers $29 per month for an Internet privacy package if they don’t want their information to be used for targeted advertising. Comcast has no such fee, but figuring out exactly how to opt out of its tracking isn’t easy. Buried deep on its site is a page to opt out of targeted cable advertising that can be based on your Internet traffic, but even that doesn’t completely preclude having your Internet activities monitored.

Companies like Comcast, AT&T, and Time Warner use this information to create targeted advertising and generate billions of dollars in revenue at the expense of privacy. Being able to create ever-more focused advertising even has a lot to do with AT&T’s current attempt to purchase Time Warner—a merger which has been in question following the FCC’s decision.

iStock / jetcityimage

Under the new rules, broadband providers can only track information related to maintaining quality of service. Forcing broadband providers to obtain consent for monitoring is a big win for users. But the FCC’s ruling also isn’t as far-reaching as you might hope. While the FCC can regulate broadband providers, it’s powerless to regulate individual websites. Web giants like Google, Facebook, and Microsoft can continue to track as much personal data as they like, then sell it off to the highest bidder.

A Final Rule. Or Not.
It’s one thing for a federal agency to pass a rule. It’s another thing to actually enforce that rule and see it stick. So far, the FCC hasn’t announced when it intends for the new rule to go into effect, though this isn’t terribly uncommon. Effective dates of new rules are usually announced several months after they’re voted on to give companies time to prepare. But enforcement of the new rule will be tricky. The FCC is not the cyber police. There aren’t dozens of FCC employees actively monitoring broadband providers to make sure they’re following the rules.

These companies could, theoretically, find ways around these rules or ignore them completely (something the ACLU has already warned about). If that happened, it would probably take some fairly astute Internet users to figure out what’s going on, and then they’d need the willpower to spend several years complaining up the FCC’s chain of command.

iStock / weerapatkiatdumrong

The FCC’s rules are also subject to legal challenges. The proposed rule changes unsurprisingly met stiff resistance from broadband providers and their lobbyists. Once the new rules go into effect, those providers are free to file lawsuits challenging them.

The rules will remain in effect while those challenges are pending (unless a court grants an injunction), but it’s also possible that those rules could be struck down, particularly if a challenge makes its way to the Supreme Court, which has proven itself to be especially pro-business under Chief Justice John Roberts. Given the billions of dollars at stake here, it’s almost certain that broadband providers will take the FCC’s new rules to court. But a ruling overturning the decision—if it happens at all—would be years away.

The Trump Card
As an administrative agency, the FCC is also free to change its rules at anytime through the rule-making process. This is a months-long process by which the public is informed of the proposed rule, comment is taken, a record is made, and finally a new decision is issued.

When the FCC’s ruling on broadband providers was made, it seemed unlikely that the agency would reverse course anytime soon, but just 12 days later, Donald Trump was elected president, making policy predictions unreliable. As president, Trump will have say over the makeup of the FCC, but it will still be several years before his appointments could completely change its course.

The FCC is governed by a five-member board of commissioners. Each member, appointed by the president and approved by the Senate, serves a five-year term, with one commissioner’s appointment expiring every June. No more than three commissioners can be from one political party.

If a successor isn’t approved in a timely manner, a commissioner can serve until the end of the following congressional term, or 1½ years after their term officially ends. Commissioner Jessica Rosenworcel’s term expired in June 2015, but she was still on the board in late 2016 thanks to this rule.

Trump could appoint four commissioners while in office, but there’s no guarantee that all four will actually make it through the confirmation process, and the requirement that at least two members of the board can’t be Republicans should ensure some balance.

So if Trump is inclined to seek a rule change (and there’s really nothing indicating that he particularly cares about the rule one way or another), he couldn’t force anything to happen until near the end of his first term.

The Path to Privacy
So what’s a privacy-conscious Internet user to do in the meantime? If you can figure out how to opt out of having your information tracked by your ISP (or you want to spring for the AT&T deal), you can always go that route. But you’re probably better off using a VPN and/or a browser like Tor that encrypts your browsing history. Your ISP will still know you’re using the VPN or Tor (and really, there’s no way to completely avoid all monitoring by your ISP), but they won’t be able to collect any data on which sites you visit.

It’s always nice to think that the government will work in your best interests, but when the feds fall through, sometimes you have to take matters into your own hands.