The FCC and a handful of state attorneys general have created an unprecedented enforcement partnership to go after internet service providers that violate consumers’ data privacy and security.

Currently, the Federal Trade Commission has authority over broadband data privacy and security issues, but the Federal Communications Commission’s Democratic majority is in the process of bringing the internet under its regulatory authority by reclassifying broadband access as a Title II telecommunications service subject to its regulation.

FCC chair Jessica Rosenworcel said the agency is formalizing the cooperation with attorneys general in Illinois, Pennsylvania, Connecticut and New York, all Democrats, through a memorandum of understanding (MOU) with each.

Under the agreements, the Democratic-headed FCC and the Democratic AGs will coordinate investigations and prosecutions and share resources and expertise.

“I am thankful to these four partners for prioritizing interagency cooperation, and we welcome other state leaders to join us in this effort to ensure we work together to protect consumers and their data,” Rosenworcel said of the partnership.

“These strategic partnerships … will allow us to maximize our efforts to address risks arising from the misuse or mishandling of sensitive data we entrust with service providers and the continued threats posed by cybercriminals and foreign adversaries,” FCC Enforcement Bureau chief Loyaan Egal said.

The move means states that want to launch investigations into ISPs will get the FCC Enforcement Bureau staff's expertise, as well as help with things like subpoenas.

Rosenworcel pointed to the success of its new state AG partners in cracking down on robocalls, and looks to leverage that effort in policing ISP conduct when it comes to data protection, privacy and security.

The FCC’s participation will be coordinated through its Privacy and Data Protection Task Force.

Google has agreed to pay a coalition of 40 state attorneys general almost $400 million for what the AGs said was misleading millions of users about Google location-tracking data, which it uses for digital advertising. It is just the latest black mark on Big Tech’s data handling practices.

An investigation found that Google had not notified users that location tracking was automatic for web and app activity — on Google Maps, Search and Chrome — on the site.

Google did tell users they could turn off tracking in "Location History," but it failed to mention that the "Web & App Activity" setting also was collecting location data.

In addition to forking more than $391.5 million, Google has agreed as part of the settlement to be more transparent.

"Big tech companies should not collect consumers' data without their awareness or consent," New York State Attorney General Letitia James said. Her state got $20 million of the settlement.

The AG investigation was launched in 2018, prompted by an Associated Press story about Google tracking locations (via "Web & App Activity") even when users opted out of location tracking.

James’s office said the settlement requires Google to:

• "Show additional information to users whenever they turn a location-related account setting 'on' or 'off';  
• "Make key information about location tracking unavoidable for users (i.e., not hidden);" and
• "Give users detailed information about the types of location data Google collects and how it’s used at an enhanced ‘Location Technologies' webpage."

The agreement "limits Google's use and storage of certain types of location information and requires Google account controls to be more user-friendly," James added. ▪️

A bipartisan group of state attorneys general have launched an investigation into Meta's (formerly Facebook) Instagram social media platform for what they say was the company's promotion of that platform to children and youth despite knowing that could lead to physical and mental health harms.

The investigation is being co-led by Massachusetts Attorney General Maura Healey and includes AGs from California, Florida, Kentucky, Massachusetts, Nebraska, New Jersey, Tennessee, and Vermont.

“Facebook, now Meta, has failed to protect young people on its platforms and instead chose to ignore or, in some cases, double down on known manipulations that pose a real threat to physical and mental health – exploiting children in the interest of profit,” said Healey. “As Attorney General it is my job to protect young people from these online harms."

She said they would try to identify any unlawful practices and end the company's alleged abuses for good. "Meta can no longer ignore the threat that social media can pose to children for the benefit of their bottom line," she said.  

The investigation will target what techniques, if any, Meta used to boost the frequency and duration of engagement by younger users and the resulting harms.
Also: Blmenthal Presses TikTok, YouTube, SnapChat for Documents

Like the Hill hearings that preceded it, the investigation stems in part from Facebook internal research handed over to Congress by whistleblower Frances Haugen.

"Today’s announcement follows recent reports revealing that Meta’s own internal research shows that using Instagram is associated with increased risks of physical and mental health harms on young people, including depression, eating disorders, and even suicide," Healey's office said.

Healey also helped lead a coalition of 44 AGs last May that urged Facebook not to launch a kids' version of Instagram. The company ultimately agreed to pause the effort, though not to pull the plug entirely.

"These accusations are false and demonstrate a deep misunderstanding of the facts," said Meta in a statement. "While challenges in protecting young people online impact the entire industry, we’ve led the industry in combating bullying and supporting people struggling with suicidal thoughts, self-injury, and eating disorders. We continue to build new features to help people who might be dealing with negative social comparisons or body image issues, including our new 'Take a Break' feature and ways to nudge them towards other types of content if they're stuck on one topic. We continue to develop parental supervision controls and are exploring ways to provide even more age-appropriate experiences for teens by default."

“Combined with our Congressional scrutiny, this investigation will shine a bright light on Instagram’s profiting from harm to kids," said Sen. Richard Blumenthal (D-Conn.), chair of the Senate Consumer Protection Subcommittee, who led a hearing into Haugen's allegations and documents. "Facebook can no longer hide or conceal facts that parents need and deserve to know. Mark Zuckerberg must make a choice: either Facebook comes clean on its own, or this bipartisan group of state attorneys general will show the world even more ugly truths.”

“Facebook must release its full research, give access to independent researchers, and support meaningful legislation. I look forward to seeing the results of this important investigation and continuing to work with colleagues on both sides of the aisle on legislation to protect kids online.” ■

Attorneys general from 16 states have asked the FCC to withdraw its broadband privacy proposal.

In a letter to the commission, they said they were afraid the FCC's new proposed rules will preempt state laws protecting consumer privacy and foster a "byzantine regulatory environment" rather than clear, enforceable requirements that will improve data privacy.

They conceded that the FCC had recognized that states were active participants in "robust privacy and data security protections." But they also said that the FCC may "unwittingly" preempt important state efforts and that the proposal could make compliance more costly and complicated.

"It is of paramount importance that any federal regulations not impair states' ability to vigorously protect their citizens."

The AGs said that the FCC was forcing them to navigate a patchwork of regs and artificial distinctions in trying to figure out what rules apply in a particular circumstance.

They told the FCC that they think privacy interests are best service by existing legal authorities in each state rather than "new prescriptive regulatory approaches."

They said that given all that, the FCC should "withdraw the proposed rule" and engage with the Federal Trade commission and AGs on the best path forward.

Wheeler did not mention AG's, but told a Senate Commerce hearing panel Thursday (sept. 15) that the FCC had been working with the FTC on the plan, with meetings as recently as this week.

The FCC took over authority over ISP customer privacy issues from the FTC--authority it already has over traditional cable customer privacy--when it reclassified ISPs as common carriers. The FTC still has authority over edge provider--google, Facebook--data collection and use.

"We have received the letter and are reviewing it," said an FCC spokesperson.

The AGs signing on to the letter were from Arizona, Arkansas, Georgia, Kansas, Louisiana, Michigan, Nevada, North Dakota, Ohio, Oklahoma, South Carolina, South Dakota, West Virginia, Wisconsin, Texas, and Utah.

Washington State Attorney General Bob Ferguson has filed a lawsuit seeking potentially more than $100 million against Comcast, claiming the cable company "illegally deceived" customers to "pad the bottom line by tens of millions of dollars."

Ferguson is alleging almost 2 million individual violations of the state's Consumer Protection Act, including that the state's dominant cable provider misrepresented its Service Protection Plan and "Comcast Guarantee," charged customers for calls it indicated were free and that it used improper credit screening practices.

Ferguson said he gave Comcast a heads up a year ago about the allegations, but that the company only started making changes recently, on the "verge" of the suit.

While he said it was the first such suit in the nation, he indicated it might not be the last: "[T]he Service Protection Plan is a nationwide program and many of the improper practices are used in all of Comcast’s markets," he said. 

“This case is a classic example of a big corporation deceiving its customers for financial gain,” Ferguson said. “I won’t allow Comcast to continue to put profits above customers — and the law.”

Comcast countered in a statement that it had been working with Ferguson's office, but defended its products and services.

"The Service Protection Plan has given those Washington consumers who chose to purchase it great value by completely covering over 99% of their repair calls," said Comcast. "We worked with the Attorney General’s office to address every issue they raised, and we made several improvements based on their input. Given that we were committed to continue working collaboratively with the Attorney General’s office, we’re surprised and disappointed that they have instead chosen litigation. We stand behind our products and services and will vigorously defend ourselves.”

The state claims Comcast "deceived" customers into paying $73 million for a "near-worthless" protection plan -- $4.99 per month -- that had limitations that were not disclosed.

"Comcast routinely claimed that the 'comprehensive' plan covered the cost of all service calls, including those related to inside wiring, customer-owned equipment connected to Comcast services and on-site education about products," said the suit. "However, Comcast did not appropriately disclose that the plan does not cover repairs to any 'wall-fished' wiring — wiring inside a wall — which constitutes the vast majority of wiring inside homes."

The lawsuit also claims that while Comcast's Customer Guarantee promises it won't charge for service visits resulting from Comcast equipment or network problems, "Comcast charged thousands of Washington customers for service calls that resulted from a Comcast equipment or network problem, including issues with Comcast HDMI and component cables, Comcast cable cards, and the installation of drop amplifiers, which fix Comcast signal problems. "

It also claims that, until June of last year, "Comcast provided its technicians with a service call fix code that expressly allowed them 'to add service charges to a normally not charged fix code.' In other words, the company created a code for technicians to add charges to a service call that should be provided at no cost."

Ferguson said that while Comcast requires a deposit for equipment, which can be waived for customers with good credit ratings, "on more than 6,000 occasions, Washington state consumers paid a deposit to Comcast, despite credit checks performed by the company revealing the customers had high credit scores."

He said that meant either the deposit was paid to avoid the check appearing on their credit report, or that customers were forced to pay even with a high credit score.

In addition to more than $73 million in restitution, Ferguson is seeking $1 million for service calls with the improper fix codes; up to $2,000 per violation of the CPA (a Washington state spokesperson had not returned a call at press time about whether that would apply to all $1.8 million alleged violations); and "broad injunctive" relief including requiring Comcast to clearly disclose the limitations of its service plans in and via its representatives, correcting the fix codes, and avoiding improper credit checks. 

More than two dozen state attorneys general have written the Federal Communications Commission to make third-party, direct-to-consumer privacy pledges part of its set-top proposal.

They said that would be the best way to help states and the Federal Trade Commission to protect privacy by enforcing the laws against unfair or deceptive practices.

In a letter to the FCC last week, attorneys general from 15 states, including from the FCC's hometown (the District of Columbia) and nearby Maryland, assured the FCC that their state consumer protection laws apply to third device manufacturers.

The FCC is proposing to require MVPDs to make set-top box content and data available to those third parties so it can be wed with over-the-top offerings and as, the theory goes, better promote a market in competitive navigation devices given that 99% are still rented from the MVPD.

But the AGs said the FCC should not only require third parties to comply with MVPD privacy protections for their set-top info--like who is watching what VOD movies when--but certify that to consumers.

"[W]e urge the FCC to require manufacturers of third-party set-top boxes to publish consumer-facing statements of compliance with the privacy obligations that apply to multichannel video programming distributors," they said. The Federal Trade commission has made the same suggestion.

FCC chairman Tom Wheeler has said the FCC cannot apply the MVPD regs to edge providers but can make those providers pledge to follow them as a quid pro quo to getting access to that set-top info.

The AGs want that to be a direct pledge to consumers, not just to the FCC or MVPDs, so that violating it runs afoul of unfair and deceptive prohibition practices.

They also added that the FCC should not preempt states' continued jurisdiction over state privacy laws.