"We need comprehensive privacy legislation and real net neutrality legislation enacted at the federal level now, not later, and the CRA vote just delays that and gives members of Congress an easy out." -Mike Montgomery, CALinnovates

Nearly every day brings new stories of children being tracked, Russians being indicted, and online-fueled hate exploding into real-world violence – all while the big tech platforms that enable this chaos report record earnings and shrug off Congressional oversight without breaking a sweat.

The internet has never been more vital to our lives, our culture and our economy, but it has never been more out of balance.

The American people are demanding comprehensive action to rein in these giant platforms, protect our privacy and permanently keep cyberspace open and free – with 80% believing the big platforms haven’t done enough to secure their networks. Nearly 60% are concerned the government won’t do enough to solve the problem. Yet, amazingly, the only internet bill on the agenda in Congress is a backward-looking resolution that will actually reduce our privacy protections.

The resolution is called the “CRA” (for Congressional Review Act), and it’s being pitched as a way to protect net neutrality. But that’s a complete charade. We need comprehensive privacy legislation and real net neutrality legislation enacted at the federal level now, not later, and the CRA vote just delays that and gives members of Congress an easy out instead of pushing them to draft, debate and support real, bipartisan, pro-consumer legislation.

The CRA doesn’t enact any permanent net neutrality protections. It also does nothing to protect our privacy, secure the internet from Russian bots or election attacks, bring accountability to all tech platforms across the board, or boost innovation and ensure competition.

All the CRA would do if it passed (something that itself is extremely unlikely in a Republican Congress) is temporarily restore an old and out-of-date version of net neutrality that applies to broadband providers only and then send the entire issue back to the Federal Communications Commission, where anything could happen – including reversal of even those limited rules.

And worse, in the process, the CRA would strip away one of the key internet privacy protections Americans currently enjoy. Right now, the Federal Trade Commission is the lead privacy cop for the big cable and telecom companies. It protects Americans from unfair and deceptive practices online, including breaches of privacy policies and other abuses of our data. This is why the Obama Administration made “strong enforcement by the Federal Trade Commission” the centerpiece of its Consumer Privacy Bill of Rights in 2012.

But the CRA would eliminate the FTC’s jurisdiction over internet providers – creating a privacy gap when more data protection, not less, is necessary.

Congress has an enormous opportunity in front of it. There is wide, bipartisan agreement that we need new, stronger rules of the road for the entire internet – tech platforms, broadband providers, and any entity collecting and using consumer data.

The recent Facebook hearings had members of both parties demanding accountability and calling for solutions. One Representative from a district decimated by online opioid sales put it most directly, saying, “Facebook is actually enabling an illegal activity, and in so doing you are hurting people.”

It’s not often the stars align in this way – and it would be a dereliction for Congress to squander this chance for real progress in favor of an empty, feel-good CRA.

Instead, Congress should be driving toward comprehensive legislation to strengthen our privacy; make net neutrality permanent; apply it to all companies that pick and choose what we can see and do online; and require real cybersecurity and data protection that includes strong penalties for companies that breach our trust.

That’s the kind of vote a woke Congress would take.

Mike Montgomery is the executive director of CALinnovates, a technology advocacy organization.

Few industries collect more intricate data about a person’s media consumption than cable operators — and few are as highly regulated.

Cable operators, as the conduit by which most of us access entertainment and internet, are privy to reams of customer information ranging from what shows an individual watches, what room in their house they watch it in, the websites they surf and the credit cards they use.

But the industry and the government, perhaps anticipating the onslaught of privacy issues collecting that information could bring, have put in place safeguards to ensure that data is protected.

Related: Specter of D.C. Crackdown Looms Over Edge

The Cable Act of 1996 severely limits what a cable operator can do with the data it obtains. According to Section 661 of the act, a cable operator can use personally identifiable data only to deliver service to that person. It can share that information with a third party only with the prior written consent of the customer, or to comply with a court order.

While that would seem to hamstring operators, they have been able to use the data they glean from customer habits mainly to improve service — like being able to detect and rectify service problems in specific areas of their networks — and to offer additional services. As one operator put it, if they notice a customer isn’t taking phone service from the cable company, or may be downloading content that would warrant a faster internet speed, they can contact that customer directly.

Privacy Pledge

Cable operators have also gone the extra mile. Many, such as Comcast, Cox Communications and Charter Communications, have pledged to never sell personal customer information to third parties. But even with those restrictions, operators can still do a lot with the data.

Most operators are reluctant to talk about how they use the information.

In an email message, Cox spokesman Todd Smith said the cable company, like others, uses personalized data to improve the customer experience.

“We know that when customers interact with us they want it to be efficient and respectful of them and their time,” Smith said in the email message. “We leverage data from interactions to enhance our ongoing efforts to improve the experience. We are specifically doing a lot of work right now to map several what we’re calling Customer Journeys (everything from marketing and order process, to install and promotion rolloffs/renewals). The quality of information we gather during these processes helps us better serve existing and new customers in the future.”

Privacy on the Edge: Legislators' Questions

At Canoe Ventures, the advanced advertising consortium that includes Comcast, Cox and Charter, head of business development, sales and marketing Chris Pizzurro said that while the uses of customer data are many, so are the restrictions.

For example, Pizzurro said MSOs regularly extract household IDs and device IDs from settops and broadband routers, “so the cable operator knows what is going on in your home; making sure the system is running the way it should.”

The operator can also use that information to market its own products and services to customers. But for Canoe, the restraints are tight. Pizzurro said that Canoe can only use customer information like household IDs and device IDs for troubleshooting purposes.

“It’s all very specific and geared toward our service assurance product,” Pizzurro said. “We can’t go out willy-nilly and use it for targeting purposes or other advanced ads things.”

Canoe Ventures, which originally was formed as an interactive advertising vehicle for cable operators, abandoned that tack about five years ago and has mainly concentrated on dynamic ad insertion of video-on-demand streams. That business has picked up considerably in the last half-decade. Pizzurro said five years ago, reaching 1 million ads viewed in a month would be a Holy Grail moment for the company. Today, 1 billion monthly ad views are commonplace.

“We’ve grown 20% quarter over quarter over the last five years,” Pizzurro said. “With all the data that’s flying through the system, we’ve managed to be good stewards and shepherds without incident.”

Pivotal Research Group analyst Brian Wieser said if any new regulation comes out of the Facebook hearings, it will likely be focused on the social-media platform and would probably benefit Google the most. The cable industry would have little to worry about, he added.

“If the entire industry is forced to implement it, you will probably see a deceleration in growth for the overall industry,” Wieser said. “My guess is that Facebook and Google will probably take share. There are going to be some smaller players who won’t justify being in business.”

SIDEBAR | CPNI 101 | by John Eggerton

Cable operators, in the provision of their traditional video service, have long had fairly strict rules about what they can and can’t do with the personal information they collect from subscribers (Customer Propriety Network Information, or CPNI).

According to the Federal Trade Commission, they must provide reasonable access to personal records they retain and provide an opportunity to correct any errors. They also may not disclose any of that information to a third party without “written permission” from their customers.

There are different, but similarly strict, rules regarding voice-over-internet protocol phone service information.

In a world of converging technology, consumers should have confidence in the fact that our nation’s broadband privacy rules are uniform and consistently applied across the internet. Just as internet usage should be seamless, so should privacy rights.

Consumers have expectations regarding their privacy while online; they expect that the law of the digital land will be easy to understand and that it will apply no matter where they are on the net. After all, the higher the level of consumer confidence that online privacy is protected, the more people will use the internet for electronic commerce and other functions where financial information is employed in the transactions.

But to achieve that clarity and uniformity, a clear rule is necessary, and that’s where Congress needs to step in.

Today’s privacy rules are anything but clear. Internet content providers like Google, Facebook and Amazon are regulated for privacy by the Federal Trade Commission, the historic internet-privacy protection body. Internet-service providers that link consumers to the network, such as Verizon Communications, AT&T and Comcast, were also regulated for privacy by the FTC until 2015, when the Federal Communications Commission classified internet access as a telecommunications service, stripping the FTC of that authority.

In 2016, the FCC imposed privacy rules on ISPs, different and far more onerous than the rules the FTC oversaw for internet content providers. Earlier this year, Congress abrogated the FCC’s privacy rules, but ISPs remain subject to FCC jurisdiction for privacy. No new ISP privacy rules have been forthcoming, leaving the current privacy regime for ISPs in a gray area of uncertainty.

Against that background, it’s little wonder consumers are confused. Different regulatory agencies have authority depending on where the consumer resides on the internet continuum. Those agencies do not impose the same privacy protection requirements.

Some continue to advocate for imposing privacy rules on ISPs different from those for internet content providers, yet logic suggests the need for a level playing field.

A uniform privacy framework applied across the internet ecosystem is the best solution, with the FTC maintaining its historic role in overseeing internet privacy. The FTC employs a long-used consumer “opt out” approach for most online activity, with an exception for highly sensitive personal information, such as Social Security numbers, drivers’ license numbers or financial and medical information. That sensitive information remains protected unless the consumer affirmatively consents (“opts in”) to the information being used.

Privacy is too important to be left to the whims of regulatory agencies. Instead, Congress should consider taking an approach akin to the Browser Act (HR 2520), sponsored by Rep. Marsha Blackburn (R-Tenn.), that would unify privacy rules across the internet under the FTC, from operating systems to browsers to ISPs to edge content providers.

Why should Congress act? In addition to placing all internet privacy jurisdiction under a single regulator, a statute could empower the FTC with direct rulemaking authority over privacy, which it currently lacks. Today, the FTC regulates internet privacy under Section 5 of the Federal Trade Act, which limits the agency’s enforcement authority to actions aimed against unfair trade practices. Under that authority, the FTC can only act if a company holds itself out as offering a certain set of privacy protections and then fails to meet its promise.

If the FTC had direct statutory authority to craft privacy regulations, it could specify with far greater precision the kinds of privacy protections to which companies must adhere. At the same time, a new law could provide that the agency use the historic “opt out” approach, except for narrow and defined categories of personally sensitive information, for which affirmative consumer consent (“opt in”) would be required.

This balance between opt out and opt in would enable the internet advertising model — that has kept internet content free or minimally priced — to continue while giving consumers a calibrated level of control over information collection and use.

The next critical step is for Congress to decide to move on privacy. Action is needed to assure that consumers continue to have confidence in their web use, regardless of where they are in the digital universe.

Rick Boucher was a Democratic member of the U.S. House of Representatives from Virginia for 28 years and chaired the House Energy and Commerce Committee's Subcommittee on Communications and the Internet. He is honorary chairman of the Internet Innovation Alliance (IIA) and head of the government strategies practice at law firm Sidley Austin.

Dipayan Ghosh would like to be an “algorithmic ethicist.”

If that sounds daunting and a bit indecipherable, no worries. He’s got a PhD from Cornell in electrical and computer engineering and is working with Harvard and New America on web civil rights issues.

Then there were the years spent working on tech policy at the White House under President Obama, trying to put legislative legs under the Broadband Bill of Rights—which, like many other efforts over the past few years, never became law. He also worked on the White House’s eventual, and successful, support for Title II.

That was followed by a stint as privacy and policy advisor at Facebook. Now, at 27, he's with New America as part of a new public interest technology team of fellows.

Ghosh talked with Multichannel News Washington Bureau chief John Eggerton about network neutrality, the search for algorithmic diversity and how game theory could drive a marketplace model for privacy.

[For a shorter version of this interview, click here.]

MCN: Tell us about yourself.
Dipayan Ghosh: I’m a computer scientist by training and did my PhD in electrical engineering and computer science. In graduate school, I grew more interested in information theory, which is the study of how you send information from point A to point B as securely and efficiently as possible.

I grew very interested in the subfield of security and privacy. After the [Edward] Snowden disclosures, the Obama Administration was under a lot of pressure to respond to the public outcry and at the time there was a lot of scrutiny about what surveillance practices the government, more broadly, might employ and what kind of protections there were and should be in the future on individual privacy.

MCN: So you decided to join that effort?
DG: Yes, it was a really interesting time to be there. John Podesta came in to lead the approach to these really difficult issues. The President commissioned a report back to him, and led by Podesta, that would be a comprehensive review of Big Data and privacy and the implications for individual rights across society.

During that time Podesta held meetings with every industry under the sun. We engaged with banks and Internet companies and a civil rights round table, which led to the report.

MCN: And remind us what the key recommendations were.
DG: Some of the big ones were around Internet privacy standards for the internet privacy Bill of Rights. There were suggestions around how we can approach the international conversation around privacy and the safe harbor arrangements with Europe. It dealt with student privacy in the context of educational technology that was powered through the collection and analysis of student data and how you can create ethical standards around that.

Another was around “algorithmic discrimination,” and whether there were ways that Big Data in use by many sectors of private industry is potentially creating discriminatory impacts across society and how we can protect against that.

The civil rights round table brought that issue to the front, and really resonated with us as an issue that was important to get right.

MCN: And what has happened to the report since then?
DG: Out of that report came the Consumer Bill of Rights Act, a legislative proposal that came out of the White House in February 2015, as well as the Student Digital Privacy Act. That garnered bicameral, bipartisan support on the Hill, even though it hasn’t moved forward.

The conversation with Europe has progressed to where we renegotiated safe harbor and made a lot of progress, though there are new questions they are asking given the new political situation in the U.S.

So, yes, I think there were a lot of follow ups.

MCN: What else did you work on?
DG: We worked on net neutrality, which ultimately resulted in a recommendation by the President to reclassify common carriers under Title II. That recommendation came out on YouTube, of all places.

My appointment was across the National Economic Council and also the Office of Science and Technology. Many different groups across the White House were involved in net neutrality. And I think that led to some really progressive policies.

MCN: What made you move to Facebook?
DG: The safe harbor negotiations with Europe. I was particularly interested in moving to a company at the forefront of privacy. I worked in the privacy team within the policy organization at Facebook and worked partly on how we develop products in a way that is sensitive to users’s needs.

MCN: What are those needs and does this generation even want privacy?
DG: Obviously the conceptualization of privacy has evolved over time from decades ago being behind a wall and having your own physical space where you can have a reasonable expectation that nobody is spying on you, to today, where there are a lot of different platforms and a lot of different universes where we need to be aware of how we are perceived by others, if we care about that perception.

And Facebook has shown great leadership in that space. The kinds of privacy settings are top of the line. When I was studying this issue through an academic lens, I found it helps to think about it from a game theory perspective: Pit the end user against the corporation, say, a utility for example.

They both want to maximize their bottom lines and they don’t want to compromise that bottom line. For the consumer it’s their utility, for the corporation it’s their profits over time.

You have to consider many different things. It’s not just the up-front revenue you might have as a company or it’s not just the upfront savings you might have as a consumer. As a consumer, you might value the privacy and security of your information. As a company, you might value that information as well so that you can route power more effectively or be able to monetize it in different ways, let’s say the advertising ecosystem.

At the end of the day, both want to maximize their value.

And I think if you look at it from that perspective and say that by default I want my Nash Equilibrium (game theory speak for a solution in which neither player has an incentive to change no matter what the other player does) to be a solution where both the consumer and the company choose privacy rather than no privacy.

When you look at it from that perspective, you can reach the set of conditions that you need and achieve that equilibrium, to achieve that market-stable situation of both entities opting for privacy-aware design or privacy-preserving technology, or privacy and security applied to data security protections on a network, or encryption.

I think that when you look at it from an economic perspective, reasonable and sensible regulation is a good thing, and user education is a good thing. People need to be aware of where their data is going and what the privacy framework in the industry is.

MCN: Could privacy become a value-added differentiator in the marketplace for ISPs?
DG: I think a company needs to ask all those questions and figure out what is the right approach for them. Now, I think that some might insinuate that ISPs will take the action that is not good for privacy, especially in the absence of regulation.

But that is where advocates and other people in the public can come forward and really make known the concerns they have around these issues. I think that history has shown that can have a great impact on the courses of action that corporations take.

MCN: What are you working on now?
DG: I started this fellowship at New America and I want to look at the intersection of privacy and civil rights, how privacy and anti-discrimination policy can be incorporated into algorithms.

MCN: Which means?
DG: There was an issue in the White House report on Big Data discrimination, or algorithmic discrimination, or algorithmic fairness, or bias. There are different ways that people reference it, but essentially it is the idea that algorithms [sets of computer commands to accomplish a task] can be designed in such a way that leaves civil rights in the lurch.
In other words, they could have a discriminatory impact on society if the algorithms were not designed responsibly.

MCN: Sort of like algorithmic red lining?
DG: Yes. One example that has been referenced in the White House report is with an application called Street Bump, which basically crowdsources pothole information.

Boston partnered with them to learn where potholes were in real time, then go out and repair them. It turned out that the potholes that were getting repaired were in richer, younger neighborhood. Obviously you don’t fault the people who designed the algorithm from the get-go. It’s very hard to perceive that this issue might surface until you observe it.

But then they went in and compensated for it, which is the most incredible thing. But if they hadn’t, that would have potentially created a mechanism for discriminatory impacts.

MCN: So, it requires factoring in human nature with algorithmic theory?
DG: Absolutely. I think that in general, as an engineer myself, we design technology that will create the most value as efficiently as possible for the people we are designing it for.

Sometimes we might not be trained on the legal basis for certain civil rights laws or other legal or regulatory systems.

So, I think it is important to educate engineers and people thinking of how to design algorithms, on how they can think about these issues. You can call it algorithmic ethics. Then have them monitor the inputs and outputs from their algorithms and the effects and outcomes so if there is some evidence of distorted or disparate impact, it can be corrected.

MCN: So, you are trying to be an algorithmic ethicist?
DG: That’s a really nice title. I think it is a really difficult area to get your head around because there are so many different companies that are designing algorithms and it is really hard to think about how to design ethical standards that apply across the board.

Perhaps the best way to think about it is, sector by sector, industry by industry, looking at what types of standards could be established for the use and implementation of algorithms so that you can factor out, as best you can, these discriminatory impacts as they manifest themselves.

MCN: Facebook has been in the conversations about the proliferation of ‘fake news. Any thoughts?
DG: I think that company is moving in the right direction and starting to really have a positive conversation with a wide range of players who want to provide guidance as to what direction the platform should go. The start of that conversation has been really positive.

It’s a good step forward.

Dipayan Ghosh would like to be an “algorithmic ethicist.” If that sounds daunting and a bit indecipherable, no worries. He’s got a Ph.D. from Cornell in electrical and computer engineering and is working with Harvard and think tank New America on web civil-rights issues. Then there were the years spent working on tech policy at the White House under President Barack Obama, trying to put legislative legs under the Broadband Bill of Rights — which, like many other efforts over the past few years, never became law. That was followed by a stint as privacy and policy adviser at Facebook. He’s now with New America as part of a new public-interest technology team of fellows. Ghosh talked with Multichannel News Washington bureau chief John Eggerton about network neutrality, the search for algorithmic diversity and how game theory could drive a marketplace model for privacy.

[For the full-length, uncut version of this interview, click here.]

MCN:Tell us about yourself.
Dipayan Ghosh: I’m a computer scientist by training and did my Ph.D. in electrical engineering and computer science. In graduate school, I grew more interested in information theory, which is the study of how you send information from point A to point B as securely and efficiently as possible.

I grew very interested in the subfield of security and privacy. After the [Edward] Snowden disclosures, the Obama administration was under a lot of pressure to respond to the public outcry and, at the time, there was a lot of scrutiny about what surveillance practices the government, more broadly, might employ and what kind of protections there were and should be in the future on individual privacy.

MCN:So you decided to join that effort?
DG: Yes, it was a really interesting time to be there. John Podesta came in to lead the approach to these really difficult issues. The president commissioned a report back to him, and led by Podesta, that would be a comprehensive review of Big Data and privacy and the implications for individual rights across society.

MCN:And what has happened to the report since then?
DG: Out of that report came the Consumer Bill of Rights Act, a legislative proposal that came out of the White House in February 2015, as well as the Student Digital Privacy Act. That garnered bicameral, bipartisan support on the Hill, even though it hasn’t moved forward. The conversation with Europe has progressed to where we renegotiated safe harbor and made a lot of progress, though there are new questions they are asking given the new political situation in the U.S.

We worked on net neutrality, which ultimately resulted in a recommendation by the president to reclassify common carriers under Title II. That recommendation came out on YouTube, of all places. My appointment was across the National Economic Council and also the Office of Science and Technology.

MCN:What made you move to Facebook?
DG: The safe harbor negotiations with Europe. I was particularly interested in moving to a company at the forefront of privacy. I worked in the privacy team within the policy organization at Facebook and worked partly on how we develop products in a way that is sensitive to users’ needs.

MCN:What are those needs, and does this generation even want privacy?
DG: Obviously, the conceptualization of privacy has evolved over time from decades ago being behind a wall and having your own physical space where you can have a reasonable expectation that nobody is spying on you, to today, where there are a lot of different platforms and a lot of different universes where we need to be aware of how we are perceived by others.

When I was studying this issue through an academic lens, I found it helps to think about it from a game theory perspective: Pit the end user against the corporation, say, a utility for example. They both want to maximize their bottom lines and they don’t want to compromise that bottom line. For the consumer, it’s their utility; for the corporation, it’s their profits over time. As a consumer, you might value the privacy and security of your information. As a company, you might value that information as well so that you can route power more effectively or be able to monetize it in different ways, let’s say the advertising ecosystem. At the end of the day, both want to maximize their value.

MCN:What are you working on now?
DG: I started this fellowship at New America and I want to look at the intersection of privacy and civil rights, how privacy and anti-discrimination policy can be incorporated into algorithms. There was an issue in the White House report on Big Data discrimination, or algorithmic discrimination, or algorithmic bias. There are different ways that people reference it, but essentially it is the idea that algorithms [sets of computer commands to accomplish a task] can be designed in such a way that they could have a discriminatory impact on society if not designed responsibly.

MCN:Sort of like algorithmic red-lining?
DG: Yes. One example that has been referenced in the White House report is with an application called Street Bump, which basically crowd-sources pothole information.

Boston partnered with them to learn where potholes were in real time, then go out and repair them. It turned out that the potholes that were getting repaired were in richer, younger neighborhood. Obviously, you don’t fault the people who designed the algorithm from the get-go. It’s very hard to perceive that this issue might surface until you observe it. But then they went in and compensated for it, which is the most incredible thing. If they hadn’t, that would have potentially created a mechanism for discriminatory impacts.

Read More: Click here for the full-length, uncut version of this interview.

WASHINGTON — Internet service providers that have been sparring with congressional Democrats over an opt-in broadband privacy regime now have a Republican to contend with. But the consequences of a new bill backed by House Communications Subcommittee chair Marsha Blackburn (R-Tenn.) would have a bigger impact on edge providers and advertisers.

In trying to prevent the FCC from applying that opt-in to ISPs, one of the bigger arguments providers have made is that those opt-in rules didn’t apply both to them and to edge providers such as Facebook or Google, which have a dominant share of the targeted advertising that relies on such data.

In the Balancing the Rights of Web Surfers Equally and Responsibly [BROWSER] Act, Blackburn has proposed to change that, retaining the FCC’s extension of “sensitive” information that requires opt-in consent for sharing beyond financial and health and children’s data to include web browsing, while moving enforcement of all broadband privacy under the Federal Trade Commission.

Related: Rep. Blackburn Defends Broadband Privacy Bill

ISPs have been quiet on the bill — NCTA-The Internet & Television Association said it was still vetting the measure at press time and would have no comment — but groups representing advertisers and edge providers certainly have not been.

The Association of National Advertisers is no fan of Blackburn’s BROWSER Act, sponsored by the Republican House Communications Subcommittee.

Among other things, the ANA says Blackburn’s bill repeats the “fatal mistake” of overbroad classification of sensitive information (it does not say “of web browsing,” which they feel is key), and what the industry trade group calls a “vague and confusing” opt-in regime that would “bombard consumers with annoying consent notices.”

If FCC chair Ajit Pai succeeds in rolling back classification of ISPs as common carriers under Title II of the Communications Act, the Federal Trade Commission will again have enforcement authority over both edge providers and ISPs. Blackburn’s bill could beat the rollback to the punch, designating the FTC as the sole enforcer of online privacy.

Edge providers don’t want either the FCC or the FTC to start requiring them to get opt-in permission to share and monetize browser histories.

The Internet Association, whose largest members are Google, Amazon and Facebook, said the bill “has the potential to upend the consumer experience online and stifle innovation.”

Blackburn has fired back at her critics. “I thought the Internet Association would be more supportive of protecting consumers,” she told The Hill. Edge providers have, however, made clear their opposition to extending regulations to their neck of the ’net, arguing that ISPs have a unique gatekeeper position.

“I think if you ask the American people if they’re OK with having less control over their online privacy so companies can sell their data, they’d say no,” she said.

An association representing edge provider powerhouses met with FCC chair Ajit Pai Tuesday (April 11) to argue for preserving the FCC's Title II-based Open Internet order. That comes as Pai is pondering how to roll back Title II, including by potentially having ISPs sign on to voluntary Open Internet principles that would then be enforceable by the Federal Trade Commission.

The Internet Association, whose members include everyone from Amazon to Zenefits (that would be Google, Facebook, ebay, Netflix, Microsoft, Yahoo and a laundry list of others) met with Pai and top staffers to argue for retaining the rules, according to the association.

"IA continues its vigorous support of the FCC’s Open Internet Order, which is a vital component of the free and open Internet," the tech companies told Pai, according to an ex parte document filed with the FCC and confirmed by a spokesperson for the group. "The Internet industry is uniform in its belief that net neutrality preserves the consumer experience, competition and innovation online. In other words, existing net-neutrality rules should be enforced and kept intact."

That is unlikely given that the current FCC Republican majority opposes Title II reclassification and Pai has made it clear he thinks net neutrality can be preserved without classifying ISPs as common carriers under Title II.

The IA argues that the Title II did not have the adverse impact on broadband investment ISPs have argued was the case. Former FCC chair Tom Wheeler, who motormanned the Title II order with an assist from President Obama, has also said the ISP argument about depressing investment was a red herring.

While it had Pai’s ear, the IA also argued that there was a qualitative difference between edge providers and ISPs that justified different treatment of broadband privacy.

It said that includes the fact that Internet access service have “higher financial, legal, and technical market entry barriers as well as high customer switching costs when compared to edge provider markets” and that “edge providers have more limited visibility into online practices and consumer Information,” a conclusion that it said the FTC has also drawn in concluding that ISPs are “in a position to develop highly detailed and comprehensive profiles of their customers – and to do so in a manner that may be completely invisible.”

Congress two weeks ago nullified the FCC’s broadband privacy rules, which required opt-in consent from ISP subscribers for sharing their personal information with third-party marketers that edge providers can share without that opt-in consent.

There’s been a lot of attention and questions about consumer privacy in recent days. At Comcast, we respect and protect our customers’ personal information. Always have, always will. We do not sell our broadband customers’ individual Web browsing history. We did not do it before the FCC’s rules were adopted, and we have no plans to do so.

Comcast has committed to privacy principles that are consistent with the FTC’s privacy regime, which has applied to all entities in the Internet ecosystem for over 20 years and which continues to apply to Internet edge companies like Google, Facebook, and Amazon. We believe this commitment is legally enforceable in multiple ways, including by state attorneys general.

There has been a lot of misleading talk about how the congressional action this week to overturn the regulatory overreach of the prior FCC will now permit us to sell sensitive customer data without customers’ knowledge or consent. This is just not true. In fact, we have committed not to share our customers’ sensitive information (such as banking, children’s and health information), unless we first obtain their affirmative, opt-in consent.

Our privacy commitments to our customers go even beyond this protection of sensitive information that has dominated the dialogue this week. If a customer does not want us to use other, non-sensitive data to send them targeted ads, we offer them the ability to opt out of receiving such targeted ads.

We also continue to comply with various federal laws protecting privacy, such as the Communications Act, the Children’s Online Privacy Protection Act, and the Electronic Communications Privacy Act, as well as dozens of state privacy and data-security laws.

In view of all the misinformation and inaccurate statements that have been made in the last week, we want to make sure that our customers understand how strong our privacy protections really are. So we will revise our privacy policy to make more clear and prominent that, contrary to the many inaccurate statements and reports, we do not sell our customers’ individual Web browsing information to third parties and that we do not share sensitive information unless our customers have affirmatively opted in to allow that to occur.

Gerard Lewis is the senior vice president, deputy general counsel and chief privacy officer for Comcast.

WASHINGTON — President Donald Trump last week signed into law the successful GOP congressional effort to nullify the Federal Communications Commission’s attempt, under former chairman Tom Wheeler, to regulate broadband privacy.

Advertisers celebrated the GOP win, saying the rules had categorized “innocuous” information as sensitive and in need of opt-in permission to collect and share, while Internet service providers promised they have protected, are protecting and will protect their subscribers’ personal data.

Here are some answers to questions raised last week by congressional Democrats and others about the official passage of the Congressional Review Act resolution and the official end of the FCC’s attempt to write new rules.

Q:So, what is the current status of broadband privacy?
A: The FCC’s Oct. 27, 2016, vote to impose new broadband privacy regulations are repealed, and “substantially similar” rules cannot be reimposed by the FCC unless Congress authorizes it in another bill. Just what would qualify as substantially similar is open for debate.

Broadband providers have pledged to abide by voluntary privacy principles in any event, and Comcast has said it will change its privacy policy to make the opt-out option more prominent and reassure its customers that it does not sell customers’ individual Web browsing information to third parties. Click here to check out exactly what industry trade groups representing ISPs have pledged to do to protect broadband privacy. here.

Q:What can ISPs legally do now that the rules have been nullified?
A: They can share a range subscribers’ personal information with third parties without users’ affirmative permission, including Web browsing and app use history, as well as geolocation data, and can require data sharing as a condition of service.

Q:What obligations are now nullified for ISPs?
A: They no longer must institute government-mandated data security procedures or provide data breach notifications according to a government-imposed schedule.

Q:How long had the rules been in effect?
A: Virtually none of the rules had been in effect in the two years since the FCC assumed broadband privacy authority under the Open Internet order.

The FCC last month stayed implementation of the data-security provisions. The opt-in requirements were not scheduled to take effect until the end of the year. One part of the rules — preventing ISPs from making data sharing a quid pro quo for service — had already gone into effect, according to an FCC spokesperson.

Q:Who has authority over broadband privacy?
A: The FCC still has authority over ISP privacy under Title II regulations. The Federal Trade Commission has authority over edge provider privacy, although a court decision has raised questions about whether the FTC can regulate an edge-provider subsidiary of a common carrier — for example, privacy authority over Yahoo as a subsidiary of Verizon would fall into a gray area.

Q:What’s next?
A: The FCC is free to draft new privacy rules as long as ISPs are still under Title II and the new rules aren’t “substantially like” the old ones. In fact, FCC chairman Ajit Pai and FTC chairwoman Maureen Ohalhausen said last week that they will work together on a new, rational and effective system for protecting consumer privacy.

Congressional Republicans want the FCC to roll back Title II reclassification of ISPs and return broadband privacy to the FTC’s purview. Pai and Ohlhausen also ultimately want authority to revert to the FTC. If that happens, congressional Democrats want to give the FTC rulemaking authority so that, if it chose — likely under a future Democratic administration — it could impose its own privacy regulatory framework. The FTC’s power is generally confined to enforcing laws already on the books via filing suit against false and deceptive practices, rather than writing new rules.

Democrats also want to free the FCC to reimpose similar privacy regulations. Sen. Ed Markey (D.-Mass.) and 10 other Democratic senators introduced such a bill last week, but it will almost certainly be a nonstarter in Republican-controlled D.C. Read more about that effort here.

Sen. Ed Markey (D-Mass.) has teamed up with ten other Democratic senators to introduce a bill that would restore the FCC broadband privacy rules House and Senate Republicans just took away with a Congressional Review Act (CRA) resolution of disapproval.

Markey was a leading supporter of the FCC rules, and pledged to fight their rollback by Republicans.

“Thanks to Congressional Republicans, corporations, not consumers, are in control of sensitive information about Americans’ health, finances, and children," said Markey. "The Republican roll-back of strong broadband privacy rules means ISP no longer stands for Internet Service Provider, it stands for ‘Information Sold for Profit’,” said Senator Markey.  “This legislation will put the rules back on the books to protect consumers from abusive invasions of their privacy. Americans should not have to forgo their fundamental right to privacy just because their homes and phones are connected to the internet.”

The CRA resolution prevents the FCC from restoring the rules in substantially the same form, so that even if FCC Chairman Ajit Pai wanted to restore them, which he definitely does not, it would take the literal act of Congress to do so.

Co-sponsoring the bill are Sens. Richard Blumenthal (D-Conn.), Elizabeth Warren (D-Mass.), Bernie Sanders (I-Vt.), Jeff Merkley (D-Ore.), Martin Heinrich (D-N.M.), Tom Udall (D-N.M.), Patrick Leahy (D-Vt.), Tammy Baldwin (D-Wis.), Chris Van Hollen (D-Md.), and Al Franken (D-Minn.).

Markey is hedging his bets. He has also reached out to ISPs to get them on the record on how they will protect privacy in the absence of the rules. They have pledged to abide by voluntary standards, and have pointed out that the FCC's rules, in large part, had not been in place when they were rolled back.

Senate Democrats have pressed major ISPs on they are protecting consumer privacy in the wake of congressional

Republican's nullification of the FCC's broadband privacy rules, suggesting they should adhere voluntarily with all the FCC rules that those ISPs fought, while saying they remained committed to protecting sub privacy.

Sen. Ed Markey (D-Mass.), a longtime advocate for privacy rights who pushed back hard against the Republican effort, led a group of eight senators in letters to AT&T, Comcast, Charter, Verizon, Sprint, T-Mobile, and CenturyLink.

The letter seeks answers to a host of questions (see below), including whether they require opt-in consent for sharing web browsing, app use, and other information, whether they have "take-it-or-leave-it" offerings refusing service to those who do not agree to share their info, whether they have "pay for privacy" options, and more, essentially restating the rules and asking if their voluntary policies match them, plus some additional questions.

"We strongly disagree with the CRA resolution, and believe that broadband providers should follow strong privacy and security rules that give consumers control over how their information is used and shared, as well as confidence their information will be protected,” they wrote, urging them on their own to "provide your subscribers with the same level of privacy and security protections as stipulated in the FCC’s broadband privacy order.”

ISPs have pledged to adhere to voluntary privacy principles whatever happened to the fCC rules.

Democratic members of the House Energy & Commerce Committee at a hearing Wednesday (April 5) slammed Republicans for the CRA, suggesting promises that privacy would be protected were hollow.

Following is one of the letters, this one to AT&T CEO Randall Stephenson:

April 5, 2017

Dear Mr. Stephenson:

Congress recently passed a Congressional Review Act (CRA) resolution rescinding the Federal Communications Commission’s (FCC) broadband privacy and security rules.  We strongly disagree with the CRA resolution, and believe that broadband providers should follow strong privacy and security rules that give consumers control over how their information is used and shared, as well as confidence their information will be protected.  In light of this Congressional action, we write to ask how your company plans to protect the privacy of the millions of Americans who rely on your services to connect to the internet. 

In 2017, broadband access is no longer a luxury; it is essential.  Internet Service Providers (ISPs) are gatekeepers that control the infrastructure that Americans depend on to access vital applications and services.  ISPs can use this privileged position to collect and use sensitive information about subscribers, including precise geo-location,

financial information, and web and app usage history.  Yet, many consumers have limited choice for broadband service and cannot necessarily change ISPs if their privacy and security protections are not transparent or strong.  Given this limited choice, we urge your company to provide your subscribers with the same level of privacy and security protections as stipulated in the FCC’s broadband privacy order. 

We respectfully request that you provide a written response to the following questions:

     1.Do you obtain affirmative opt-in consent to use, share, or sell any of the following information: web browsing history, app usage history, the content of communications, children’s information, health information, financial information, geo-location, and Social Security numbers? If yes, please detail your policy. If no, why not? If no, please disclose what information you are sharing and selling and with whom you are sharing or selling that information.

     2.Do you provide consumers opt-out control over their information? If yes, for what types of information and please detail your policy. If no, why not?

     3.Do you maintain information or data related to former subscribers? If yes, what information do you keep, how is it maintained, and is it minimized? What are your data security and privacy policies for the data and personal information of former subscribers? 

     4.Do you make “take-it-or-leave-it” offerings, where consumers are refused internet service if they do not permit their information to be used, shared, or sold? If yes, why? When updating privacy policies, must current subscribers agree to the new terms in order to continue service?  Would a consumer be forced to pay a termination fee if service is denied for refusing to agree to new privacy or data collection terms?  Please detail your policy.

    5.Do you make “pay for privacy” offerings, where consumers could be required to pay an additional amount to protect their privacy or receive compensation for declining to protect their privacy? Please detail your policy for what purposes you use and share this information, and with whom that information is shared or sold?  If yes, please detail your policy.  If no, why not?

    6. Do you notify customers at the point-of-sale, before purchase, of the types of information collected, how and for what purposes you use and share this information, and with whom that information is shared or sold?  If yes, please detail your policy.  If no, why not?

    7.Do you develop and adhere to reasonable data security practices sufficient to protect the information you collect about your subscribers? If yes, please detail your policy. If no, why not?

    8.Do you notify customers within 30 days if their information has been breached or accessed by unauthorized parties? Do you also alert customers to any mitigating action they should take? Do you provide free services to mitigate the impacts of a breach, such as free credit monitoring service?  If yes, please detail your policy.  If no,why not?

    9. Do you practice strong de-identification or anonymization, such that de-identified personal information cannot be reasonably linkable to a person or device? If yes, please explain your process for de-identifying data. If no, why not?

   10.Do you prohibit third parties with whom you share or sell consumers’ sensitive information from re-identifying de-identified information? If yes, please detail your policy. If no, why not?

   11.Do you refuse to serve a customer who does not agree to mandatory arbitration clauses? If yes, why? Please detail your policy.

   12.Do you notify customers when you make material changes to your privacy policies? If yes, please detail your policy. If no, why not?

   13.Do you have a clear, user-friendly, easily accessible, and responsive complaint process for consumers who have evidence or reason to believe their privacy has been violated? If yes, please detail your policy. If no, why not? 

   14.Many ISPs retain so called “netflow” records, related to their customers’ internet usage. Do you retain netflow records for your customers’ web browsing activity? If so, for how long do you retain them? Will you disclose netflow records pursuant to a National Security Letter, or only court orders?

   15.Under Section 222 of the Communications Act, carriers may not disclose subscriber location information without the “express prior authorization of the customer”. Over each of the last three years, how many times did your company disclose to third parties individually identifiable customer location data or other Customer Proprietary Network

Information with a customer’s express prior authorization?  Does your company obtain the consent from the subscriber directly?  If not, and the third party obtains the consent (or claims they do), do you request or retain a copy of documentation showing that the customer provided such consent?

   16.Please detail any changes you have made to your privacy policy or practices since the President signed the broadband privacy CRA into law.

Thank you for your attention to this important matter.  We respectfully request that you provide a written response by May 1, 2017.

The House Communications Subcommittee held a hearing on wireless spectrum and the economy, but it had to wait for Democrats and Republicans to air out their grievances over the passage last week of the Congressional Review Act (CRA) resolution rolling back FCC broadband privacy regs.

The back-and-forth was particularly heated and even personal, illustrating the widening political divide on Capitol Hill.

Ranking member Mike Doyle (D-Pa.) and Frank Pallone (D-N.J.), ranking member of the parent Energy & Commerce Committee, used their opening statements to weigh into Republicans for "ramming" the CRA down the public's throat," as Doyle put it.

Doyle also called out CTIA (though not by name) -- a CTIA witness, the only association witness, was at the table -- for supporting the CRA, saying the industry association had acted in a "selfish and irresponsible way." He said he expected more from the organization and its members, and the American people did as well. Saying the CTIA's support for the CRA meant that there were no privacy protections, Doyle said, "Believe me, my constituents and your customers are not happy about this.

Doyle called the CRA a draconian instrument the Republicans had used to smash the FCC rules.

House Energy & Commerce Committee chair Greg Walden (R-Ore.) shot back that the issue had been "horribly spun" and that the FCC created the problem when it reclassified ISPs under Title II and took over regulation of broadband privacy from the Federal Trade Commission. Walden noted that the rules did not apply to data collection and sharing by Google (which has 85% market share of search, he said) or Facebook.

"How do you think they make their money?" he asked.

He also pointed out that the FCC rules had never been in effect. He said those companies had never been under the FCC rules "period," then repeated "period" even louder to put an exclamation point on the period. "That's where the searches are," he said, suggesting Doyle needed a little educating -- a comment that drew some groans.

Rep. John Shimkus (R-Ill.) also defended the CRA rollback, saying that the reality was Congress made a great decision in rolling back the regs.

Pallone put the move in the context of other Republican/Trump Administration efforts on healthcare, energy and the environment. He said no one believes the Republican "mumbo jumbo" about still protecting privacy or clean air or affordable health care.

"Everyone understands when you go home that the Republicans are trying to do harm to every health, safety, privacy and environmental protection that exists in the federal government," Pallone said. "And that is what they are all about."

He said that through executive action and CRAs like the one on privacy, the Republicans are trying to unilaterally "tear down everything the American people care about."

Subcommittee chair Marsha Blackburn (R-Tenn.) emphasized as she moved to witness testimony that it was going to be a hearing about "spectrum."

Rep. Anna Eshoo (D-Calif.), former ranking member of the subcommittee, brought the issue back to privacy during her questioning. She asked CTIA witness Scott Bergman whether the FTC could come up with new privacy rules given that they lack rulemaking authority.

Bergman said his companies are commited to their subs' privacy but that they also follow and support the FCC's and FTC's enforcement authority over privacy.

Eshoo said that there is a hue and cry from constituents and that his companies had damaged their brand with support of the CRA.

Bergman said his companies depend on the trust of their customers. Eshoo said if that is the case they had "more than chipped away at that. I think this is going to haunt the companies."

Rep. Jerry McNerney (D-Calif.) also talked privacy, saying he was worred that promises are all consumers have left to protect their privacy.

He asked Berman whether companies could now change those policies if they wanted to.

Bergman would only say that their policies were the same today as they were before. He said the FCC still has authority under sec. 222 of Title II to enforce broadband privacy and that his members were working with the relevant agencies on a path to make sure that the FTC has a consIstent and clear framework across the entire ecosystem.

FCC chair Ajit Pai and FTC chair Maureen Ohlhausen took to the electronic pages of The Washington Post late Tuesday to defend the rollback of the FCC's broadband privacy regulations, a move Congress enabled last week through a Congressional Review Act resolution and President Donald Trump made official with the stroke of a pen earlier this week.

In a co-bylined op ed, Pai and Ohlhausen said "professional lobbyists" had lit a wildfire of misinformation, which the two agency chairs wanted to quell  by stating "what's really going on."

They said the "Chicken Little" warnings made no sense, but that restoring broadband privacy oversight to the FTC did. That could happen either by removing the FTC exemption from regulating common carriers or by reclassifying ISPs so they are not considered common carriers under Title II or by doing both.

Pai has long argued that Title II reclassification of ISPs under the Open Internet order, which is how the FCC deeded itself broadband privacy oversight, was a mistake in need of correcting.

They said that despite "hyperventillating headlines," ISPS have never planned to sell browsing histories to third parties -- something ISPs were saying this week and have pledged not to do in voluntary privacy principles.

Pai and Ohlhausen also pledged to come up with a new system for protecting consumer privacy.

They took aim at the FCC approach, which required ISPs to get permission to share Web, app and geolocation data with third parties while edge providers -- under the FTC's privacy-by-design regulatory approach -- did not have to get that permission, as well as the argument that disparate treatment was justified due to ISPs' unique gatekeeper status or the lack of competition for service.

"If two online companies have access to the same data about your Internet usage, why should the federal government give one company greater leeway to use it than the other?" they wrote, citing privacy policy expert Peter Swire.

"As Peter Swire, President Bill Clinton’s chief counselor for privacy and President Barack Obama’s special assistant for economic policy, explained in a paper he co-wrote for Georgia Tech’s Institute for Information Security and Privacy, 'ISPs have neither comprehensive nor unique access to information about users’ online activity. Rather, the most commercially valuable information about online users ... is coming from other contexts,' such as social-media interactions and search terms," they said.

That would be the Googles and Facebooks of the world, the edge providers that don't need opt-in permission.

As for lack of competition, they argued that doesn't hold up, either.

"As a result, it shouldn’t come as a surprise that Congress decided to disapprove the FCC’s unbalanced rules," they said.

"The American people deserve a comprehensive framework that will protect their privacy throughout the Internet," they added. "And that’s why we’ll be working together to restore the FTC’s authority to police ISPs’ privacy practices."

Input continued to pour in following President Donald Trump's signing Monday (April 4) of a resolution nullifying the FCC's broadband privacy rules after Hill Republicans approved it on close, politically divided, votes in both Houses of Congress.

Privacy groups promised to fight on while advertisers said the fight was over "innocuous" info that didn't warrant "barrage" of opt-in notices.

"By vetoing the repeal of the broadband privacy rules President Trump could have sent a powerful message that he heard Americans' demands to have a real say over how their personal information is used and shared for commercial proses, and was willing to stand up for them," said the Consumer Federation of America.

But given that the President added his imprimatur, what now? "This fight is not over," vowed CFA. "The Consumer Federation of America and the other organizations with which we work will continue to push for real privacy protections for Americans."

The National Hispanic Media Coalition was similarly displeased and similarly ready to continue the fight.

"With the stroke of his pen, President Trump quietly sealed the fate of FCC regulations aimed to protect the private information and web browsing histories of Americans across the country," said Carmen Scurato, director of policy and legal affairs. "Latinos value their private information and will not soon forget a President who failed them, especially in light of all the public concerns he has for his own privacy. The act was a clear gift to Internet Service Providers at the expense of the American people. But the American people were not quiet during this process and left one resounding message: we will continue to stand together to preserve and protect the open internet."

Michael Copps, former FCC chairman and now a special adviser to Common Cause, saw it as a handover of consumer rights to big business by the President.

"Privacy goes the way of populism as Trump rolls over again for big business," he said. "Despite a campaign filled with rhetoric about the plight of forgotten Americans, Trump has once again come down on the side of corporate profiteering at the expense of Americans who don't sit on corporate boards and can't afford a $200,000 membership at his Mar-a-Lago club in Palm Beach. Trump has flip-flipped on his own campaign promises and handed over Americans' right to privacy to those with the deepest pockets."

Looking at it from an entirely different angle was the Association of National Advertisers, which had pushed the FCC to reconsider the rules and Congress to repeal them.

“This rule would have required vast amounts of innocuous information to be treated suddenly as highly sensitive and needing opt-in consent from consumers," ANA said in a statement. "This is an important major step to help assure a level playing field for privacy regulation for all businesses, and to see to it that consumers will not be bombarded with incessant opt-in notices. ANA also is pleased that the leadership of the FCC and FTC have committed to working cooperatively to return primary regulatory authority over privacy issues to the Federal Trade Commission, which is where we think it should rightfully belong due to the FTC’s long history of oversight and expertise in the privacy arena.”

Sen. Al Franken (D-Minn.), a longtime advocate for privacy online, particularly of children, and a frequent critic of media companies, said the rule rollback "will give giant internet service providers like Comcast, Verizon, and AT&T an open invitation to more easily collect, share, and sell your personal information without your consent."

“All Americans have a fundamental right to privacy, and I believe that right extends to the internet,” said Franken, ranking member of the Senate Privacy Subcommittee. “Your digital footprint—the sites you browse, the apps you use, and the sensitive data you provide to websites—deserves to be protected. President Trump has made a grave mistake by signing this disastrous legislation, which will deepen the pockets of big internet conglomerates like Comcast, Verizon, and AT&T by allowing them to more easily broker your private information. This law is as anti-consumer as it gets—it gives broadband providers free rein to collect, share, and auction off your data to the highest bidder without your consent. Your privacy is under threat, and I plan to fight back. We cannot allow corporate profits to outweigh consumer privacy rights.”

WASHINGTON — Last week's rollback of the FCC's privacy rules spurred legislative action in the Minnesota State Senate, while in the U.S. Senate, the Intelligence Committee launched hearings on Russia's interference with the 2016 presidential election. Meanwhile, the Commerce Department tapped AT&T to build and maintain the nation's first-responder network. Following are highlights from last week in D.C.

Minnesota Adopts Own Privacy Rules
The Minnesota State Senate had its own exclamation point for Congress’s move to roll back broadband privacy rules. In light of Congress’s approval of the Congressional Review Act, and the president’s expected signoff, the state Senate voted to adopt its own version of the regulations, according to the Twin Cities Pioneer Press.

Republicans had argued that state privacy laws would remain in effect even after the Federal Communications Commission’s rules were scrapped. Minnesota’s Senate took that cue and added its own.

An amendment to an economic development bill passed the Minnesota Senate with the help of one Republican vote. A similar amendment was added to the House bill, which must now be reconciled with the Senate bill.

The Minnesota amendment would prevent any ISP with a franchise agreement in the state from collecting personal information from customers “without express written approval from the customer” or from denying service if that approval was not given.

Those were two key elements of the FCC regulations that were rolled back. (Pictured: The Minnesota State Capitol)

9/11 Overhaul
More than 15 years after 9/11, the Commerce Department last week announced that AT&T had been awarded the 25-year, $46.5 billion contract to build out and maintain FirstNet, the interoperable broadband first responder network. AT&T will invest $40 billion, and in exchange will get access to the network during nonemergencies.

The network is being built using 20 MHz of spectrum set aside from the FCC’s 700-MHz auction and the government’s $6.5 billion contribution to the cause came from the FCC’s AWS-3 wireless spectrum auction.

Smaller and rural broadband providers were looking to get in on some of that action. “NTCA-The Rural Broadband Association and its members, network operators in rural areas of the country with substantial assets and infrastructure, are eager to partner with AT&T to leverage this infrastructure and to promote success in the quest to build, operate and maintain a ubiquitous public safety network throughout the country,” said association CEO Shirley Bloomfield after the announcement. Read more here.

Fake News, for Real
Broadband was much on the minds of the Senate Intelligence Committee as it launched a series of hearings on Russia’s efforts to interfere with the 2016 presidential election. That included both cybersecurity issues and the proliferation of fake news that has been amplified by mainstream, and nonmainstream, media chasing the latest story.

Committee ranking member Mark Warner (D-Va.) cited the media “echo” chamber as partly to blame.

“The Russians employed thousands of Internet trolls and botnets to push out disinformation and fake news at high volume, focusing this material onto your Twitter and Facebook feeds and flooding our social media with misinformation,” Warner said. “[T]his fake news and disinformation was then hyped by the American media echo chamber and our own social media networks to reach — and potentially influence — millions of Americans.” Read more here.

White House Press Secretary Sean Spicer made clear Thursday (March 30) that the president would be signing the Congressional Review Act resolution invalidating the FCC's broadband privacy regs when it reached his desk, calling them unfair and a case of regulatory arbitrage.

"The White House supports Congress using its authority under the Congressional Review Act to roll back last year’s FCC rules on broadband regulation," Spicer said in comments before the daily press briefing.

"The previous administration, in an attempt to treat Internet service providers differently than edge providers, such as Google and Facebook, reclassified them as common carriers -- much like a hotel or another retail outlet -- and opened the door to an unfair regulatory framework," he said. "This will allow all service providers to be treated fairly, and consumer protection and privacy concerns to be reviewed on an equal playing field.

"The president pledged to reverse this type of federal overreach in which bureaucrats in Washington take the interests of one group of companies over the interests of others, picking winners and losers," Spicer continued. "The President has signed more legislation under the Congressional Review Act, ending job-killing rules and regulations than all previous presidents combined already, and he will continue to fight Washington red tape that stifles American innovation, job creation and economic growth."

The Senate passed the resolution March 23; the House passed it March 28.

It is the longest of long shots, but Democratic Reps. Mike Doyle (D-Pa.) and Mike Capuano (D-Mass.) have launched a petition on Whitehouse.gov calling on the president to veto S.J. Res. 34, the Congressional Review Act resolution that that repealed the FCC's broadband privacy rules.

The president is widely expected to sign the resolution and repeal the regulations.

The resolution narrowly passed both the Senate (last week) and the House (Tuesday) and is headed to the President's desk, although the Dems are hoping to stay the President's pen hand.

At press time, the petition had 120 signatures toward the 100,000 it needs to get a response from the White House, though it is unclear whether the new president is hewing to such a schedule. The resolution will likely be signed by then regardless.

The crux of the petition is "Don't let Internet providers spy and sell our online data. Please keep the FCC's Privacy Rules."

“This bill has been rushed through both the House and Senate at breakneck speed with one clear goal – to get it signed into law before the American People know about it,” Doyle said after launching the petition. Doyle managed the floor debate on the Democratic side March 28 before the Republicans voted 215-205 to roll back the rules, with 15 Republicans breaking ranks to vote against it.

“Americans do not want their Internet browsing history and sensitive personal information used by their ISP without their knowledge for advertising or any other purposes,” Capuano said. “I cannot imagine why anyone would support this.”

Capuano was arguably the loudest critic, bellowing his dissent and suggesting he didn't want ISPs sharing his underwear size if bought a pair online.

The CRA overturns rules approved by a divided FCC Oct. 27 that required ISPs to get subscribers' permission to share Web browser and app use info and impose data security and breach notification requirements.

Groups representing ISPs, tech companies and online advertisers said Tuesday that congressional repudiation of the FCC's broadband privacy framework was a "vital step" toward creating a "truly comprehensive and effective privacy framework for the entire Internet based on the successful FTC approach."

They also suggested talk of the collapse of privacy protections in the absence of the yet-to-be applied rules had a Chicken Little flavor to them.

That came in a conference call with reporters moderated by Jon Leibowitz, former chairman of the FTC under President Obama and now co-chair of the ISP-backed 21st Century Privacy Coalition.

Also on the call were James Assey, EVP at NCTA; B. Lynn Follansbee, VP, law and policy, USTelecom; Jim Halpert, general counsel, Internet Commerce Coalition; Julie Kearney, CTA; Emmett O’Keefe, SVP of advocacy, DMA; and Howard Waltzman, general counsel, 21st Century Privacy Coalition; and Maria Kirby of CTIA.

The press conference came less than two hours before the House is scheduled to vote on a Congressional Review Act resolution to repeal the rules that squeaked through the Senate last week 50 to 48. Backers of the rules were trying to rally supporters this week, saying they thought there was a good chance the House would not follow suit and pass the resolution, though that might have been wishful thinking.

The call participants signaled they thought the resolution would indeed pass, but were taking no chances, making their case in an hour-plus call with reporters from a host of outlets.

The thrust of the call was that rolling back the regs would allow for a "reset" -- a term at least three different speakers used -- to "harmnize" broadband privacy enforcement could be "harmonized" across ISPs and edge providers so that consumers would have consistent treatment of their online data, preferably a "privacy by design" approach based on the sensitivity of data, and preferably not what they saw as the FCC's overly broad classification of that sensitive data to include app use and Web browsing history.

Assey said that once the FCC rules are rolled back, there are "multiple pathways to get back to consistent treatment," but that however the FCC, FTC and Congress decide to do that, "we as ISPs have an interest in protecting the privacy of consumers and have an interest in getting policy back to one that applies consistently online. We think that is in the best interests of fair competition and, ultimately, of consumers."

Leibowtiz pointed out that in 2012, when he was chair of the Obama Administration FTC, the agency came out with a privacy report that called for the FTC to be the sole privacy enforcement agency across the entire broadband ecosystem. He said his coalition is a strong supporter of consumer privacy and "firmly believes that companies operating online must maintain transparency, disclose what consumer data is being collected and how it is being used and held accountable for honoring commitments to consumers."

As to the strong pushback from some privacy groups, Leibowitz chalked the "hyperbole" and "overheated rhetoric" surrounding the FCC rules to "hyperpartisan Washington."

Halpert said it's common for advocates on one side of the issue to claim the world would collapse, and a little bit of that was going on regarding IPS and privacy.

He said several layers of privacy protection will remain after the rules. That includes ISPs privacy principle commitments, which the federal and state governments can enforce if they are violated. He said there were "ample rules" at the state level. None of that would change if the House passed, as they expected it would, the CRA.

The FCC's privacy framework was adopted Oct. 27, 2016, under Democratic chairman Tom Wheeler and against the dissents of the two FCC Republicans now in the majority. Congressional Republicans pushed for the rollback, backed by ISPs, advertisers and consumer electronics companies.

The following is a transcript of a floor speech made by Sen. John Thune (R-S.D.), chairman of the Senate Commerce Committee, ahead of the chamber’s March 23 vote to invalidate the Federal Communications Commission’s broadband privacy regulations.

As chairman of the Commerce Committee, which has jurisdiction over the Internet, I have worked hard to promote policies that encourage the private sector to invest in and grow the Internet ecosystem as a whole.

All of that is jeopardized, however, if government bureaucrats have the ability to overregulate the digital world.

And when it comes to overregulating the Internet, one need look no further than the Democrat-controlled Federal Communications Commission under President Obama.

In a world that was turning away from legacy telecommunications services and instead toward dynamic Internet applications, the FCC found its role gradually diminishing.

This is an inevitable and good byproduct of a more competitive environment brought about by technological innovation and successful, light-touch polices.

Yet the Obama FCC fought hard against this technological progress and instead pursued an aggressively activist and partisan agenda that put government edicts ahead of real consumer desires.

GRABBING FOR POWER
Over the last two years, the FCC made a stunning bureaucratic power grab.

First, the FCC stripped away the Federal Trade Commission’s authority to police Internet providers and seized that for itself by re-characterizing such services as monopoly-era telecommunications.

And then, in 2016, the FCC, which has little experience regulating Internet privacy, decided to turn our country’s privacy laws on their head by abandoning the time-tested enforcement approach of the FTC.

These actions by the FCC ignored both common sense and real-world data and instead focused on hypothetical harms of the future.

Ignoring years of Internet ecosystem precedent, where everyone was treated the same, the FCC’s 2016 broadband privacy regulations would apply only to certain parts of the Internet.

This is a source of significant concern, because at any particular time, consumers will not have reasonable certainty of what the rules are, and how their privacy decisions will be applied.

Are you at home on WiFi? At home on a smartphone? Using your smartphone on a friend’s WiFi? Using the Internet at a library?

Each of these could have very different privacy implications for a consumer because of the FCC’s piecemeal approach to privacy — leading to more confusion and uncertainty, not increased privacy protections as promised.

In enacting these lopsided rules, the FCC seems to have gone out of its way to disregard established FTC practice, by creating new regulations that differ significantly from the FTC’s tried-and-true framework.

The FTC’s privacy regime is clear, easy to understand and applies evenly throughout the marketplace. By contrast, the FCC’s rules are complex, confusing and often lead to the same data being treated inconsistently online.

The FCC’s action would harm consumers in other ways as well. Even though no consumer wants to be in the dark about newer and cheaper services, the FCC rules actually make it more difficult for customers to hear about new, innovative offerings from their broadband providers.

And because the FCC imposed heavy-handed data requirements on these Internet companies, [ISPs] will have less ability to offer services that are tailored to their customers’ needs and interests.

Furthermore, the FCC unfairly distorted the marketplace when it imposed unnecessarily onerous privacy restrictions on broadband providers while leaving the rest of the Internet under the strong, successful regime at the FTC.

MARKETPLACE RULES
When speaking about the economic opportunities the Internet now affords us, President Obama’s last FCC chairman declared that — and I quote — “government is where we will work this out.”

I couldn’t disagree more.

I believe the marketplace should be the center of the debate over how our digital networks will function, not the FCC. And I believe consumers and job creators should be the ones deciding about new technologies, not the government. The resolution before us today is the first step toward restoring regulatory balance to the Internet ecosystem.

Warning that Senate Republicans are pushing for a vote on rolling back FCC broadband privacy regs as early as Thursday (March 23), Public knowledge is trying to get supporters of the regulations to ask their Congresional members to push back.

A privacy advocate confirmed his understanding was a vote in the Senate was likely this week.

Currently, the Senate calendar of pending business scheduled for floor consideration contains the following entry at number 16 on the list: "S.J. Res. 34 Mr. Flake and others Joint resolution providing for congressional disapproval under chapter 8 of title  5, United   
States Code, of the rule submitted by the Federal Communications Commission relating to 'Protecting the Privacy of Customers of Broadband and Other Telecommunications Services."

Public Knowledge, which is a big advocate of the regs, emailed its supporters, requesting they contact both senators and House members to advocate for the rules -- there are efforts in both the Senate and House to use the Congressional Review Act to invalidate the rules -- and to tweet the following: "Contact key Senators and your reps in Congress *today* to tell them to #SaveBroadbandPrivacy: publicknowledge.org/ProtectPrivacy."

ISPs including those represented by NCTA: The Internet & Television Association, support the CRA effort, as well as having the FCC reverse the broadband privacy regs if Congress does not do it first.

They argue that the FCC has too broad a category of information that requires opt-in consent to share with third parties for marketing and other purposes and that such an approach threatens the economic model of free Web content, and creates an unlevel playing field given that edge providers do not have an opt-in requirement for their collection and sharing of Web browser or app use info.

A bill reintroduced by Sens. Ed Markey (D-Mass.) and Richard Blumenthal (D-Conn.) would require manufacturers of connected cars to get an owner's opt-in permission to use any information collected by the car for advertising or marketing purposes -- such as triggering a gas pump ad for a local restaurant as the car rolls into the station for a fill-up.

The Security and Privacy in Your Car Act of 2017 (SPY Car Act) would direct the National Highway Traffic Safety Administration and the Federal Trade Commission (which oversees device privacy) to set cybersecurity standards for cars.

In addition to user opt-in for sharing of data, the bill would require "clear and conspicuous notice" to vehicle owners or lessees of the collection, transmission, retention and use of data collected from their cars.

The opt-in would extend to data used for car safety systems. Owner or lessees who decided not to opt in would still get access to navigation tools and other features "to the extent technically possible."

Opting in to data sharing for marketing or ad purposes can't be a condition for the use of any non-marketing related features or functions.

Those car-related provisions track with the FCC broadband privacy rules -- opt in, no marketing quid pro quo -- that Republicans in Congress are trying to overturn, and both Markey and Blumenthal strongly support.

The senators are also reintroducing an aircraft cybersecurity bill.

“Whether in their cars on the road or in aircraft in the sky, Americans should be protected from cyberattack and violations of their privacy,” Markey said of the two bills. “If hackers access the critical systems of a car or plane, disaster could ensue and our public safety could be compromised. We must ensure that as technologies change, our safety and privacy is maintained. I thank Sen. Blumenthal for his partnership on this critical issue.”

The Competitive Carriers Association says the FCC has plenty of reason for undoing the October 2016 broadband privacy order, which ISPs, advertisers, congressional Republicans and others are pushing for.

In reply comments this week on petitions for reconsideration and those opposing them, CCA said those opposing the rule rollback rely on arguments that "deny the reality of the broadband marketplace" and either "ignore or minimize" the authority the FCC will still have over privacy after the order is dispensed with.

One of those realities, CCA says, is that the order is uniquely burdensome on smaller providers, who get "very limited relief" from the rules, and only those with 100,000 subs or fewer, which they argue is too narrow a definition.

The FCC under Ajit Pai in a separate proceeding expanded the carve-out from Open Internet enhanced transparency rules from systems with 100,000 subs or fewer to 250,000 or fewer to accommodate smaller carriers.

CCA applauded the Pai FCC's vote to stay the data-security provisions of the broadband privacy order, saying it prevented them "from investing substantial and potentially unnecessary resources towards compliance."

Unnecessary because the rules may go away entirely if the Congress approves resolutions to invalidate them using the Congressional Review Act, or if Pai and the FCC reverse them on further review, or if the Open Internet order is invalidated by Congress or Title II reversed by the FCC, since it was that Title II reclassification with which the FCC deeded itself broadband authority that had been the purview of the Federal Trade Commission.

"As previously stated and as it appears is the plan, the Commission should align its privacy regime with the Federal Trade Commission’s ('FTC') effective and well-regarded privacy rules," said CCA. "Reconsidering the 2016 Privacy Order will ensure consumers can expect uniform privacy practices, and will prevent edge providers from securing an undue competitive advantage over broadband providers in the Internet ecosystem."

while CCA wants the FCC to vacate the privacy rules, or at least align them with FTC oversight of edge provider privacy, but if that does not happen, "the Commission should, at a minimum, reconsider and expand the relief provided to small providers."

Republicans are going after the FCC's broadband privacy rules with both barrels.

Marsha Blackburn (R-Tenn.), chair of the House Communications Subcommittee, has introduced her version of a Congressional Review Act resolution invalidating the FCC's Oct. 27 order. That follows a similar CRA resolution introduced this week by Sen, Jeff Flake of Arizona.

The CRA allows a simple majority of Congress members to invalidate recent regulations, in this case rules approved by the FCC back in October.

Like the Flake resolution, H.J.Res. 86 "provides congressional disapproval under chapter 8 of title 5, United States Code, of the rule submitted by the Federal Communications Commission relating to "Protecting the Privacy of Customers of Broadband and Other Telecommunications Services."

“The FCC’s decision last October to unilaterally swipe jurisdiction from the FTC by creating its own privacy rules for ISPs was troubling," Blackburn said Thursday (March 9). "The FTC has been our government’s sole online privacy regulator for over twenty years.  A dual regulatory approach will only serve to create confusion within the Internet eco-system and harm consumers.  This is a bi-partisan issue, as Democrats have also voiced concerns about the potential for consumer harm resulting from the FCC’s overreach.  We look forward to rolling back these anti-consumer rules and returning jurisdiction to the FTC.”   

The news did not sit well with Sen. Ed Markey (D-Mass.), who supports the rules and came out strongly against both the Flake CRA move and the Republican majority FCC's decision to roll back implementation of the data security portion last week and review all the rules, with an eye toward repealing and either replacing or turning the authority over broadband privacy back to the Federal Trade Commission by reversing the reclassification of ISPs as Title II common carriers in the Open Internet order.

“The Republican’s assault on the Open Internet Order continues, and the FCC’s broadband privacy rules are their next target,” said Markey. “Regrettably, Republicans fail to accept what we all know to be true and what the courts have already affirmed: broadband internet is an essential telecommunications service, just like telephone service. And just as phone companies cannot sell information about Americans’ phone calls, an internet service provider should not be allowed to sell sensitive consumer information without affirmative consent. I strongly oppose these resolutions, and will fight to protect the FCC’s essential broadband privacy rules.”

But one difference between phone calls and Web browsing is that the information gleaned and shared from that activity is that helps keep Web content free, and an opt-in regime could threaten that business model something ISPs have been arguing as they push the FCC and Congress to roll back the rules.

The State Privacy and Security Coalition has asked the FCC to grant the petitions of ISPs, ad agencies and others to reconsider its broadband privacy rules.

It is preaching to the choir when it comes to the Republican FCC majority, which voted last week to stay part of the rules implementation and signaled they wanted to revamp the rules, or deed broadband privacy authority back to the Federal Trade Commission--whichever comes first.

In a filing with the FCC, the coalition, which identifies itself as representing 25 leading communications, technology, retail, and media companies and six trade associations (business leagues, chambers of commerce, real estate boards, according to ProPublica), took particular aim at the breach notification dealines in the order, which it says are are "confusingly out of kilter" with state and Federal Trade Commission deadlines--the FTC deadlines are for edge provider data collection, rather than ISPs, which the FCC privacy rules apply to.

The coalition says none of 47 state breach notification laws require the seven-day notice to law enforcement and 30-day consumer notification deadlines. It says most states have no consumer notice deadline and those that do have at least 45 days.

"[C]omplex breaches take time to investigate," they argue. "It does not help anyone if businesses notify consumers prematurely with incorrect information."

They also take aim at the FCC definition of sensitive information, saying that the degree to which it differs from the FTC's approach and state privacy and security statutes would "create consumer confusion and hinder innovation."

It said the FCC rules "would be more effective if it were aligned with state laws pertaining to the security of sensitive data definitions."

Sen. Jeff Flake (R-Ariz.) has introduced today (March 8) a Congressional Review Act (CRA) resolution to invalidate the FCC's broadband privacy rules, according to a source.

According to copy of the resolution, it is short and to the point, saying: "Resolved by the Senate and House of Representatives of the United States of America in Congress assembled, that Congress disapproves the rule submitted by the Federal Communications Commission relating to 'Protecting the Privacy of Customers of Broadband and Other Telecommunications Services,' and such rule shall have no force or effect."

The resolution has 21 co-sponsors, all Republicans, including Commerce Committee Chairman John Thune (R-S.D.) and Communications Subcommittee chair Roger Wicker (R-Miss.). House Communications Subcommittee chair (Marsha Blackburn (R-Tenn.) also supports a resolution to roll back the regs.

Flake got a shout-out from consumer technology companies for the resolution.

"Late last year, and over many objections, the FCC adopted privacy rules for broadband and telecommunications services related to its broader Open Internet Order. While these rules apply only to internet service providers, they could establish a dangerous precedent for the entire internet, the innovation it enables and the myriad of American jobs it creates," said CTA President Gary Shapiro.

"Sen. Flake's resolution will reverse the FCC's broad regulatory overreach and restore certainty and consistency with privacy guidelines established by the Federal Trade Commission. We thank the senator for recognizing that the FCC rules threaten to undermine innovation and competition within the vibrant internet ecosystem, and fighting to help ensure the current and future viability of a vibrant internet - one that immensely benefits consumers and the U.S. economy."

That shout-out came on the eve of a Senate Commerce Committee FCC oversight hearing featuring FCC chairman Ajit Pai and the other commissioners.

FCC Chairman Ajit Pai, with the help of fellow Republican Michael O'Rielly, has already stayed implementation of the data security portion of the rules, which was to have gone into effect March 2, and has signaled he wants to rewrite them. Flake wants to give him a clean slate to start from.

21st Century Privacy Coalition Co-Chairs former FTC Chairman Jon Leibowitz and former US Rep. Mary Bono released the following statement commending Senator Jeff Flake for today initiating a resolution under the Congressional Review Act seeking disapproval of the FCC’s flawed broadband privacy rules:

“We commend Senator Flake for introducing the resolution of disapproval rejecting the FCC's privacy rules," said 21st Century Privacy Coalition co-chairs Jon Leibowitz [former Obama FTC chairman] and Mary Bono [former House member]. "The rules deviate substantially from the FTC's successful privacy model and are fatally flawed. The resolution will give the Administration the opportunity to hit the reset button and develop a holistic approach to privacy for the entire internet ecosystem that benefits consumers."

Pai and acting FTC chair Maureen Ohlhausen have said that would be harmonizing the FCC authority over broadband privacy with the FTC's over edge providers in the near term, with the eventual goal of returning oversight of broadband privacy to the FTC, which will happen when and if the FCC reverses its classification of ISPs as common carriers under Title II--the FTC is excluded from regulating common carriers.

But there were foes as well as fans.

“I am dismayed that Republicans are using a scorched earth strategy to undermine Americans’ privacy online," said Energy and Commerce Committee Ranking Member Frank Pallone, Jr. (D-N.J.). "This procedural gimmick wouldn’t just roll back the FCC’s current broadband privacy rules, it would hamstring the agency.  I urge my colleagues on both sides of the aisle to oppose this plan devised by big corporate interests and instead protect the American people.”

“Today, the Senate introduced its first major telecommunications bill under the new administration, and it’s targeting online consumer privacy," said Dallas Harris, policy fellow at Public Knowledge. "Senator Flake has proposed using the Congressional Review Act to completely eliminate the rules that the FCC put in place to protect the information internet providers collect about subscribers, but removing these rules leaves consumer data vulnerable....Senator Flake and some of his colleagues seek to wipe out consumers’ rights to control personal data. Passing this bill will leave a huge gap in consumer privacy protections with no end in sight, and no future relief from the FCC. This is a part of a broader assault on consumer privacy from congressional members when combined with legislative proposals to weaken the FTC’s ability to protect consumers."

“Big broadband barons and their Republican allies want to turn the telecommunications marketplace into a Wild West where consumers are held captive with no defense against abusive invasions of their privacy by internet service providers,” said Sen. Ed Markey (D-Mass.). “Consumers will have no ability to stop internet service providers from invading their privacy and selling sensitive information about their health, finances, and children to advertisers, insurers, data brokers or others who can profit off of this personal information, all without their affirmative consent. I strongly oppose this resolution, and will fight to ensure that consumers, not broadband companies, have control over their personal, sensitive information.”

"Americans face the loss of their only real privacy protection online if the Senate passes the Congressional Review Act resolution that would disapprove the recently enacted FCC consumer privacy safeguards.  The Republican leadership—working on behalf of the nation’s largest cable and phone companies—wants to strip Americans of important protections on how their most sensitive information can be used," said Jeff Chester, executive director of the Center for Digital Democracy. "If the Senate passes the CRA and kills privacy protection for Americans, it sends a signal—to consumers, our allies and trading partners abroad—that our country is abandoning a critical 21st Century civil and human right."

The new Congress is reportedly considering repealing the privacy rules that Tom Wheeler’s Federal Communications Commission put in place right before the presidential election. Proponents of the new rules are engaged in a furious public-relations campaign, claiming that consumers’ privacy will be violated left and right if the new rules are repealed. Frightening if true.

When it comes to using your data from Web browsing and app usage, the Federal Trade Commission has been the regulatory cop on the beat. Determined to be relevant in the digital economy, the FCC created its own, radically different set of privacy regulations targeting just Internet service providers. By requiring an ISP’s customers to give permission for their data to be used, the FCC’s new privacy rules subject ISPs to a different and more restrictive set of regulations than their online advertising rivals.

The difference in the rules — “opt-in” rules for ISPs versus “opt-out” rules for edge providers — has significant competitive implications in the online advertising market, which is dominated by Google and Facebook. The reason is that consumers typically elect the default choice out of laziness and respect for the status quo. By making it relatively easier for edge providers to access consumers’ data, the FCC has perversely impaired the ability of ISPs to compete for online advertisers.

Not what you’d expect from an FCC chairman who liked to chant “competition, competition, competition” as his raison d’etre.

Google and its minions are understandably upset Congress might upend this regulatory arbitrage, and they have come out swinging. A Feb. 20 blog post by the Electronic Frontier Foundation in defense of the FCC’s rules begins with a breathtaking subtitle: “Cable and telephone companies are pushing Congress to make it illegal for the federal government to protect online consumer privacy.”

Please. Even if the FCC’s new privacy rules are repealed, there are myriad layers of federal and state protection for consumers. None are mentioned in EFF’s blog.

Where to begin? At the federal level, the FCC has authority under section 222 of the Communications Act to prevent privacy abuses by telephone providers. Section 222 was originally designed to prevent traditional telephone companies from giving their wireless subsidiaries an unfair advantage over unaffiliated wireless companies by sharing customer information with them.

Not content with section 222? Repeal of the FCC’s new privacy rules will not prevent the FCC from establishing a different privacy regime going forward. For example, in the name of regulatory symmetry, the new FCC could replicate the same opt-out standard used by the Federal Trade Commission.

Perhaps anticipating this rejoinder, EFF claims without citation to any case law or precedent that the mechanism being considered by Congress to repeal the FCC’s privacy rules “could possibly bar the FCC from enacting future consumer privacy rules even if they are more industry friendly.” Adding “possibly” after “could” seems redundant, unless there is simply no basis for making such a claim. (I’m anxious to be corrected.)

Moreover, repeal of the FCC’s privacy rules will not prevent Congress from establishing a different privacy regime going forward. To the extent that Congress repeals both the FCC’s 2015 Open Internet Order and its privacy rules, the FTC would be placed firmly back in control of privacy enforcement for ISPs. Before the FCC’s reclassification of ISPs as common carriers in March 2015 took away the FTC’s authority, the FTC was the primary privacy cop on the beat for ISPs. For example, in 2014, the FTC sanctioned AT&T Mobility for its alleged failure to adequately inform its customers of its data-throttling program.

EFF has argued that a recent 9th U.S. Circuit Court of Appeals decision stripped the FTC of its “authority to penalize cable and telephone companies if they deceive their customers, meaning the FCC is the only broadband consumer protection agency.” But Congress could eliminate the FTC’s common-carrier exception, assuming the GOP majority could convince eight Democratic senators to overcome the filibuster rule. This would also return privacy enforcement to the FTC.

Moving beyond federal protections, several states add yet another layer of protection against potential privacy abuses by ISPs. For example, Nevada and Minnesota require ISPs to keep private certain information concerning their customers, unless the customer gives permission to disclose it. And under California law, non-financial businesses, including ISPs, are required to disclose to customers, in writing or by email, the types of personal information sold to a third party for direct marketing purposes.

If and when the FCC’s new privacy rules are overruled, the statute that empowers the agency to police privacy abuses by ISPs will still apply. And nothing prevents the FCC from designing a different (and more symmetric) regulatory standard.

Repeal of the FCC’s new rules will simply restore the regulatory environment that existed for more than 18 months between its reclassification decision and its privacy rules. Given the myriad layers of protections and regulatory options, the notion that repeal would leave the ISPs without any privacy regulator is patently false.

Hal J. Singer is a principal at Economists Incorporated and a senior fellow at the Progressive Policy Institute, and has served as an adjunct professor at Georgetown’s McDonough School of Business.

WASHINGTON — Sen. Ed Markey (D-Mass.) laid down another marker on the issue of broadband privacy Monday (Feb. 28), headlining a press conference with privacy groups vowing to fight Republican efforts in Congress and at the FCC to roll back the regulator’s broadband privacy rules.

Markey said Democrats would wage a historic battle to preserve the rules, as well as the Open Internet order to which they is linked. He called ISPs gatekeepers, and said Federal Communications Commission chairman Ajit Pai was doing their bidding by trying to roll back the rules, starting with data-security protections. Markey said that would allow ISPs to ignore best practices and make sensitive information more vulnerable.

Republicans in Congress are trying to roll back the framework using the Congressional Review Act (CRA).

Neema Singh Guliani, legislative counsel for the American Civil Liberties Univion, said at the press conference that consumers would be harmed most by the rollback, with poor and vulnerable communities particularly affected.

She pointed out that the rules require clear notice of the data they collect and do not allow ISPs to make consumers providing information a quid pro quo for receiving service. She said that "take it or leave it" approach requires consumers to choose between giving up their privacy and using the Internet.

She also said consumers need protection from discriminatory ad practices based on the information collected and shared about them.

Gaurav Laroia, a policy counsel at Free Press, said consumers need the FCC rules to be protected from abuse.

All of the speakers argued that ISPs are essentially monopolies, so consumers have little choice between giving up personal information or acceding to their practices.

The public is not going to give up the protections without a fight, Markey said.

Pai last week pledged to stay the FCC’s implementation of the initial set of new privacy rules — data security requirements — set to take effect March 2. He has signaled that the FCC will rethink the entire regime to the degree that it diverges from the Federal Trade Commission’s lighter-touch approach to edge providers.

The FCC in October voted along party lines to require ISPs to obtain subscribers’ permission to share their Web-surfing data, app use histories and other "sensitive" data with third parties for marketing and other purposes. It was billed as based on transparency, consumer choice and data security. The FTC has no such opt-in requirements for the data collection and sharing of edge providers like Google and Facebook.

The vote on the FCC framework was 3-2, with one concurrence from Democratic commissioner Mignon Clyburn, over the absence of a prohibition on mandatory arbitration clauses, and two strong dissents from Republican commissioners Pai and Michael O’Rielly. Since then, the FCC has lost both Democratic chair Tom Wheeler and commissioner Jessica Rosenworcel, with the two dissenters now in the majority.

ISPs have said the FCC opt-in regime could take a big bite out of the free-content model that powers the Internet, since it relies on targeted marketing to remain free. They asked the FCC to stay the rules, arguing they need to be harmonized with the FTC’s approach.

Separately on Monday, Rep. Frank Pallone (D-N.J.), ranking member of the House Energy & Commerce Committee, asked the GAO to study the broadband regulatory landscape given the fluctuating authority issues and ongoing threats to consumer data and security.

The ISP-backed 21st Century Privacy Coalition is all for re-setting the FCC framework, including via the CRA.

CPC co-chair Jon Leibowitz, former Democratic chairman of the Federal Trade Commission, said that a CRA would leave no enforcement gap because "Section 222 of the Communications Act will still apply, even in the absence of specific rules. Section 222 has applied to ISPs since the FCC adopted the Open Internet Order and, in an enforcement advisory in May 2015, the FCC made clear that it would use the statute to ensure ISPs protect their customers’ privacy. A CRA resolution of disapproval therefore would not leave ISP customers’ privacy rights unprotected," he said.

"To the contrary, it would restore the status quo in effect for the 18 months prior to the passage of the October 2016 privacy rules. Moreover, the FCC is not hamstrung moving forward,” Leibowitz said. “The FCC could adopt new rules not ‘substantially the same’ as the rules adopted in October which could, for example, include an approach similar to the FTC’s proven privacy framework."

Republican Commissioner Michael O'Rielly signaled Monday he is on board with FCC Chairman Ajit Pai's proposal to delay the March 2 implementation of the first FCC broadband privacy rules--the data security requirements--while the FCC considers requests by ISPs and others to stay the rules in their entirety.

That came in a statement after the chairman circulated the delay order last week. Pai has himself signaled that  if the commission does not vote on the item by March 2, it will be stayed on delegated authority at the bureau level, something Pai has criticized about the FCC process under the previous chairman, but which will be the only way to keep the data security rule from going into effect March 2 absent either a vote or a bureau-level stay.

"I support the Chairman's [interim stay] proposal to allow the Commission and Congress time to take another look at these ill-considered rules before they have a chance to throw broadband providers' data security practices into unsettled territory," said O'Rielly, adding: " I certainly will commit to record my vote on this item by March 2."

That is no surprise, since he strongly dissented from the original framework.

The data security rules, which require ISPs to make best efforts to secure data and requires them to report breaches, are the first of the FCC's broadband privacy framework--voted last October in a 3-2 party line vote with Democrats prevailing--to go into effect if the FCC does not stay implementation.

But even if O'Rielly does cast that vote in favor, and Pai has a a two-vote majority for a commission-level interim stay, the item cannot be adopted unless Democratic commissioner Mignon Clyburn votes on it, for or against. If there are only three commissioners--rather than the full complement of five--and one fails to vote an item on circulation, it must be voted at a public meeting, which is not scheduled until March 23.

Clyburn's office was not available for comment on whether she will vote the item by March 2 or force the chairman to adopt it on delegated authority.

The Government Accountability Office has been asked by a high-profile Democratic legislator to study the status of broadband privacy regulatory authority over both ISPs and the edge.

The request comes from Rep. Frank Pallone (D-N.J.), ranking member of the House Energy & Commerce Committee, in a letter to the agency, according to a copy obtained by Multichannel News/B&C. Pallone points to the bifurcated oversight by the FCC (ISPs) and edge providers (Federal Trade Commission), and the "fluctuating state of the law and underlying threats to individuals' privacy and security online."

Those include that a court case has brought into question the FTC's ability to regulate edge provider privacy if that edge provider is owned by a common carrier--Verizon buying Yahoo!, for instance--and the fact that the FCC's broadband privacy framework is under review, and likely rollback, by the current chairman of the FCC, Ajit Pai, and is tied to the Title II reclassification of ISPs that that Pai is looking to reverse, as are congressional Republicans.

In a letter to Comptroller General Gene L. Dodaro, Pallone asks for GAO to study and report back to the committee, pointing out that "[w]ith the near universal use of the internet, and the rapid expansion of connected devices, corporations now have more information about American consumers than ever before," adding:

"It is, therefore, more important than ever that Americans’ privacy and security be protected online. Studies show that when people are concerned about their privacy and security, they limit their online economic and civic activities."

He is looking for answers to the following questions directed at both edge providers and ISPs:

1. 
   How are companies collecting, sharing, and using data on consumers? What types of data are being collected, shared, and used?
   
   2. How, if at all, are companies disclosing their privacy policies to consumers and notifying consumers of data breaches, and is this notification effective?
   
   3. Do consumers have meaningful control of the collection, use, sharing, retention, and security of their information? Or are consumers forced to accept the collection, use, sharing, retention, and security practices of a company “as is” to use the product or service?
   
   4. What challenges do consumers face in protecting their information, and to what extent has the federal government or the private sector taken steps to address these challenges? How successful are any efforts to anonymize or de-identify consumer information, and how easy is it to re-identify that information?
   
   5. How do FCC, FTC, and other federal agencies regulate and oversee the private sector’s collection, use, sharing, and securing of consumer information?
   
   6. How, if at all, do the approaches of the FCC, FTC, and other federals agencies differ, and which approaches provide the greatest protections for consumers’ privacy and security online?"
   
   The letter comes as congressional Republicans are looking to invalidate the FCC's broadband privacy framework using the Congressional Review Act, while Democrats are vowing to fight that effort, as they did in a press conference Monday (Feb. 27) headlined by Sen. Ed Markey (D-Mass.)

Consumer Technology Association president Gary Shapiro went to the Hill Wednesday to pitch reconsideration of the FCC's broadband privacy framework.

CTA joined with cable operators and others last week in petitioning the commission, now under the control of Republicans opposed to that framework, to stay the implementation of the rules.

Shapiro told a Senate Commerce Committee hearing on "Reducing Unnecessary Regulatory Burdens" that the framework "threatens the current and future viability of and the innovations that have come from a vibrant Internet," including by classifying Web browsing and app use information collected by ISPs as sensitive and requiring opt-in consent. No such requirement is made of edge providers like Google or Facebook by the Federal Trade Commission, which oversees their data privacy.

"The result is broad regulatory overreach over the internet by the FCC that creates legal uncertainty,” he said.

Shapiro called on legislators to step in, using the Congressional Review Act to invalidate the FCC broadband privacy rules.

Shapiro put in a plug for using an "actual harm" test for regulation, "rather than the ex ante [before the fact] approach the FCC has more recently favored."

Former FCC chairman Tom Wheeler often talked of the need to anticipate how ISPs, which he said had the incentive and ability, could engage in anticompetitive conduct, and regulate accordingly.

Shapiro also put in a plug for regulatory humility, citing acting FTC chair Maureen Ohlhausen, and for a revise of the 1996 Telecommunications Act, calling regulation "a blunt and static" instrument.

Commerce Committee Chairman John Thune (R-S.D.) asked Shapiro why he was speaking out against the rules, which apply to ISPs rather than consumer tech companies. He pointed out that some of those ISPs are also members of his association, but that beyond that, the FCC.s to bootstrapping of authority from the Open Internet order to regulate content was confusing to the marketplace in general.

A terse Sen. Ed Markey (D-Mass.) countered that the FCC's privacy rules are important protections for tens of millions and that he would fight any effort of the Congress by the CRA or otherwise to roll them back, likening them to protections against Russian hacking.

Sen. Roger Wicker (R-Miss.) asked Shapiro's take on the FCC's Open Internet order, which Wicker called unecessary to advance Internet openness.

Shapiro said that the key to an open Internet was more broadband Internet access competition. He said "the whole issue would go away" if there were multiple broadband providers and that the key was faster broadband, lower prices and more competition.

Several groups including ISP-backed NetCompetition, Americans for Tax Reform and a host of small-government advocates are calling on Congress to dismantle the FCC's broadband privacy framework, which it adopted in the waning days of former chairman Tom Wheeler's tenure.

The order requires ISPs to get their subscribers' permission before sharing Web browsing and app use histories with third parties for marketing and other purposes. It also includes data security and data breach notification rules as well as a prohibition on making information sharing a quid pro quo for service and a case-by-case look at offering incentives to share info. The FCC will also pre-empt state privacy, data security and data breach laws that conflict with its new rules.

In letters to the bipartisan leadership of the House and Senate, the groups asked that congress exercise its authority under the Congressional Review Act to rescind the FCC's Broadband Privacy order. The act allows Congress to review and reverse government regulations.

"Congress is fully justified in rescinding these rules both because the Order lacks proper legal grounding and because of the need to ensure real consumer privacy across contexts of user experience," the groups said. That is a reference to the fact that the framework applies to ISPs, but not edge providers like Yahoo! and Facebook and Google.

"The FCC’s approach is inconsistent with that of the Federal Trade Commission for nearly two decades, and will likely render harm unto consumers," they said.

That argument was made throughout the FCC's consideration of the framework, which passed on a party line vote 3-2.

"The FCC's questionable ability to regulate privacy standards, and its narrow view on what constitutes privacy protection, make its rules counterproductive to actual consumer privacy protections," the groups wrote. "In contrast, the FTC's approach to privacy does a better job of balancing protection of consumers’ privacy online with economic incentives to innovate in consumer products and services."

The FCC's authority to impose the broadband privacy rules stem from the FCC's Open Internet order, which the groups say is of questionable legality.

A federal appeals court has upheld the rules, but new FCC chairman Ajit Pai opposes the Title II-based Open Internet order and is expected to try to reverse that reclassification.

His name was not on the letter, but it did not take long for one House Democratic leader to provide his answer: No way.

“It’s clear that privacy critics feel emboldened to push for the elimination of privacy protections for American consumers, no matter the platform," Energy and Commerce Committee Ranking Member Frank Pallone, Jr. (D-N.J.). "This demand to gut the Federal Communications Commission is only the latest move and comes after ongoing attempts to hamstring the Federal Trade Commission. Consumers should not have to worry about their financial, medical and other personal information begin shared without their permission. I will continue to vigorously fight against these combined efforts to harm consumers and take away their privacy and data security.”

The FCC should scrap its broadband privacy and data security order for at least four reasons, NCTA: The Internet and Television Association told the FCC Tuesday, Jan. 3, the deadline for petitioning the commissioner to reconsider the Oct. 27 decision.

NCTA was one of many groups to take aim at the order, which passed on a partisan vote with the Republicans about to be in the majority voting strongly against it.

The order requires ISPs to get their subs' permission (notice and choice) before sharing web browsing and app use histories with third parties for marketing and other purposes. It also includes data security and data breach notification rules as well as a prohibition on making info sharing a quid pro quo for service and a case-by-case look at offering incentives to share info. The FCC will also preempt state privacy, data security and data breach laws that conflict with its new rules.

The four reasons, according to a copy of the petition for reconsideration, are that the framework  1) exceeds the FCC's authority; 2) "arbitrarily and capriciously" departs from the Federal Trade Commission's approach (the FTC was responsible for broadband privacy before the FCC reclassified ISPs as common carriers); 3) violates the First Amendment because it makes "speaker-based" distinctions between similarly situated competitors [ISPs and edge providers] in how they may use and share the same set of information; and 4) creates "unworkable data breach and security requirements.

NCTA says the order "wrongly concludes that ISPs occupy a unique gatekeeper role that justifies singularly restrictive limits on their ability to use customer data." It also says the order "compounds" the FCC's error in reclassifying ISPs as common carriers and that the FCC's likely reconsideration of that decision bolsters the reconsideration request.

Whether and how the Federal Trade Commission moves ahead with its current examination of smart television sets -- especially their role in the ongoing privacy brouhaha -- depends on a number of factors, including industry and public response to the current call for comments, which runs through Friday, Jan. 6.

Related Video > The FTC's Fall Technology Series: Smart TVs, Part 1

The new administration's impetus to develop privacy regulations is questionable, and the controversy over the FCC's recent broadband privacy rules augment the uncertainty about federal examination of TV sets' ability to monitor viewers.

"Smart TVs are testing the privacy expectations that consumers developed in the era of traditional television," Jessica Rich, director of the FTC's Bureau of Consumer Protection, said in her opening remarks at an FTC Smart TV policy workshop on Dec. 7. She cited -- as did many subsequent speakers -- "the fundamentally different relationship" that viewers have with TV sets and computers, insisting that "it matters whether consumers think of their smart TVs as a computer or a television ... and whether they recognize that today it may be both."

"We've been watching this industry since its infancy," Rich continued, noting that privacy policies -- such as those developed during the FTC's review of TiVo's viewer data collection activities 15 years ago -should be update. She observed that the 1984 Cable Privacy Act and the 1988 Video Privacy Protection Act addressed the "video providers of the day" but that streaming technology and other delivery approaches -- including features of Comcast's Xfinity system -- are encouraging the FTC to examine the "benefits and risks of smart TV" and determine a need for legislative action.

Rich acknowledged the value to advertisers of smart TVs' ability to monitor viewing patterns. She said that the FTC recognized "the fine-grained audience measurement which can help niche video programmers get ad dollars that may not have registered with more blunt video tools."

The FTC's December workshop attracted several hundred attendees, including electronics makers, privacy advocates and digital marketing executives; it was the third session of the agency's "Fall Technology Series," which also looked at ransomware and drones.

Cable industry executives were not involved. The NCTA is "not participating in the proceeding; just observing it," an NCTA spokesman told Multichannel News.

The workshop's panel on "Consumer Understanding and the Regulatory Framework" generated a string of concerns about the relationship between viewers and their TV sets, including persistent findings  audiences don't know they are being tracked.

"Consumers don't understand the complex interplay and relations that come into play with smart TVs," said Claire Gartland, consumer protection counsel and director of the Electronic Privacy Information Center. She voiced concern that data "disclose personal lifestyle factors" that could be used, for example, by insurers to determine medical eligibility.

Dallas Harris, a policy fellow at Public Knowledge, the advocacy group, characterized the process as "learned helplessness," where consumers "feel concerned about losing control of their own information." Harris said the "FTC and FCC will have to work together" since neither has complete jurisdiction over the Cable Privacy Act.

She cited the connections between Comcast and third parties over TV and online data collection.

"There's got to be a better way to explain we're not using your PII [Personally Identifiable Information] but we still know who you are," Harris said.

Emmett O'Keefe, senior VP of advocacy at the Data and Marketing Association (formerly the Direct Marketing Association) warned attendees "not to jump to conclusions about the need for smart TV privacy regulations," adding, "These are services we've used for years and are just migrating to new devices as technology evolves."

O'Keefe, a former Cablevision Systems and Amazon lobbyist, called smart TVs a "natural extension of online services."

Uncertain Outlook

Kevin Moriarty, an attorney in the FTC's Division of Privacy and Identity Protection and an organizer of the Smart TV Workshop, told Multichannel News that the event -- with about a dozen speakers -- generated "a lot of interesting things, but that's not a test for whether we'll write a report."

He said the FTC will "continue to look at data-related issues." The agency reports only about half the time after such public events, he explained.

Despite the invitation for public and industry comments about the FTC Smart TV examination, as of Dec. 27 the docket contained only two submissions -- both from individuals and both submitted before the December workshop.

During one panel, Maria Rerecich, director of the Electronics Testing Team at Consumer Reports, said her group is working on new research standards for use with smart TVs and other forms of electronic monitoring. She expects the standards will be introduced in early 2017.

The FTC will pick up some of the smart TV privacy issues at its second annual "PrivacyCon" workshop on Jan. 12 in Washington. Several Smart TV Workshop  participants cited the growing relationship between TV/privacy factors and the broader examination of digital privacy and big data usage across multiple platforms. The FTC's initial PrivacyCon, this year, drew about 300 attendees and 1,500 webcast "virtual attendees."

In an interview after the December FTC workshop, Tim Hanlon, a long-time digital ad executive, cited the importance of Automatic Content Recognition (ACR) in the development of smart TV policies. Hanlon, who is now CEO of the Vertere Group, a Chicago boutique investment advisory and strategic consulting firm that works with electronics and media companies, attended the workshop on behalf of clients.

He later told Multichannel News that ACR's ability to recognize "content that hits the glass" is at the core of these examinations. The technology can keep track of what's on the screen "no matter the source" (cable, over-the-top, streaming or broadcast).

"Some people think that's the ultimate," Hanlon summarized. "ACR data is hugely helpful  to media, notwithstanding privacy. ...  It's a way to understand consumer behavior,  a realistic way to understand the myriad of media consumption habits today. At the very least it supplements what Nielsen tells us today."

As evidence of the importance, Hanlon cited recent deals, such as Nielsen's acquisition of Gracenote, a  provider of media and entertainment metadata, including ACR capabilities.

Since Donald Trump won the U.S. presidential election, pundits have been predicting what his win will mean for everything from tax reform to immigration policies. While uncertainty is still the name of the game, recent announcements about the president-elect’s transition team and members of his cabinet have provided some hints as to how his policy agenda may unfold.

One area where we have heard very little from Trump — minus one or two tweets over the past few years — is the telecommunications industry and the agenda pursued by the Obama administration and Federal Communications Commission chairman Tom Wheeler. Many of the Wheeler FCC’s key rules were passed on party-line, 3-2 votes with strong GOP opposition. The assumption is that with a Republican president and a GOP-led FCC, many of those rules and policies will be reversed. The announcement that Jeffrey Eisenach, Roslyn Layton and Mark Jamison — all vocal critics of current FCC policies — would lead the Trump FCC transition team has done little to dispel this assumption.

While a change in policies at the FCC appears to be in the cards, how that gets carried out is a little more complicated. Two of Wheeler’s landmark rules at the FCC — the network-neutrality rule and the recently passed broadband privacy rule — would be a target of a GOP-led FCC, but would require a formal rulemaking process to “reverse.” This means going through the Administrative Procedures Act process of a notice of proposed rulemaking, a public comment period and an FCC vote to approve any changes.  

A GOP-led FCC would have the votes to change the rules, but the rulemaking process would be played out in the public with strong opposition from those that originally supported them. This politically charged rulemaking environment may draw attention away from the Trump administration’s higher-priority issues.  

Another less drastic — and less political — mechanism a GOP-led FCC could use to lighten the impact of the rules is to take a more laissez-faire approach to enforcement. The net-neutrality rule has been in effect for nearly two years and was recently upheld by the U.S. Court of Appeals for the D.C. Circuit. While the FCC has sent letters of inquiry to several companies about whether their practices might violate Net Neutrality, no significant enforcement actions have been brought. A GOP-led FCC could take an even more hands-off approach to enforcement of the rule.

The broadband privacy rule has a staggered effective date over the next 18 months, with initial elements going into effect in six months. It has been criticized as creating an unlevel playing field between entities subject to the FCC rule and those subject to the Federal Trade Commission’s more-lenient rule.  Once again, a GOP-led FCC could take a lax enforcement approach to the rule, but the rule is in the books and the FCC would have to enforce any clear violations. Amending the rule to address the discrepancy between the FCC and FTC approaches can only be accomplished through the rulemaking process noted above.

A legislative solution is another much-discussed option to roll back the impact of the net neutrality and privacy rules. Over the past several years, there have been several proposals from the GOP to put some type of net-neutrality requirement into law, but at the same time remove the FCC’s ability to regulate broadband under Title II of the Communications Act. All of those proposals were pulled under the threat of an Obama veto.  

With a Republican in the White House, the GOP may decide to press ahead again with a legislative solution which would address both net neutrality and privacy. Both rules are based on the FCC’s decision to reclassify broadband providers as common carriers, subject to regulation under Title II.  Without the Title II reclassification, both rules would be without statutory authority. New legislation undoing reclassification would potentially remove the legal underpinning of both rules and the FCC’s Title II oversight of broadband. This would also put the FTC back in the role of the primary privacy supervisor for broadband providers, once again leveling the privacy playing field.

Could such legislation pass? This does not appear to be a high priority for the GOP or the Trump administration, which are are focused on tax reform, trade policy, immigration and health care as priority areas early in the president’s first term. The GOP also does not have the 60 votes needed in the Senate to break a filibuster, so it might be difficult to pass legislation unless there is some Democratic support, which may arrive if there is a view that a compromise is the only way to maintain Net Neutrality. The other strategy for the GOP may be to wait until after 2018, when 10 Senate Democrats are up for re-election. The GOP could potentially have a filibuster-breaking majority after 2018, when they could push through the legislation they want.  

It seems clear that change is coming for how the telecommunications industry will be regulated. As with every change of party in the White House, the Trump administration will want to put its imprint on the industry. It is just not clear at this point on what that mark will be or how long it will take.  

David Sapin is technology, media and telecommunications risk and regulatory leader at PwC.

On Oct. 27, the Federal Communications Commission adopted a Report and Order purporting to “protect the privacy of customers of broadband and other telecommunications services." The rules require consumers to affirmatively opt-in before Internet-service providers (ISPs) can collect "customer proprietary information," which applies to information that the ISP "acquires in connection with its provision of telecommunications service."

For example, if a consumer who subscribes to Comcast chooses not to opt in, it appears Comcast cannot collect information regarding that consumer's Amazon purchases because the data would be acquired through the Comcast-provided Internet connection. However, Comcast will be able to purchase that consumer's Amazon information either directly from Amazon or perhaps from the consumer's operating system and/or Web browser. In other words, ISPs are allowed to purchase consumer information from edge providers, which are not subject to the FCC regulations, even though the edge providers have greater access to consumer information than ISPs.

FCC commissioner Michael O'Rielly discussed this important issue during his dissent: “[A]ll that the FCC has really done is raise the transaction costs. The FCC, in its typical nanny state fashion, seems to assume that consumers prefer an opt-in regime. But when consumers find out the end result is that they may have to pay more for heightened privacy rules that they never asked for, I doubt they will be grateful that the FCC intervened on their behalf. Indeed, this is a grandiose attempt to enact legacy talking points into rules so that commission leadership can pat itself on the back while consumers receive no actual, practical protections.

“Because the FCC's regulations with the opt-in default are not imposed on edge providers, such as Google, these platforms will continue to collect massive amounts of consumer information," O'Rielly continued. "As FSF scholars stated in their comments, due to encryption technologies, edge providers have a greater access to consumer information than ISPs. In order to provide targeted benefits, such as zero-rated services, to consumers who choose not to opt in, ISPs will have to purchase information from edge providers or other Internet companies.”

As commissioner O'Rielly discussed, because ISPs need consumer information in order to offer targeted benefits, these regulations simply raise the costs for ISPs to engage in online advertising, zero-rated programming or other targeted consumer offerings. Consumers who choose not to opt in will be confused because edge providers will continue to collect their information and sell it to ISPs. And it's likely ISPs will increase the price of broadband service to cover the costs of purchasing consumer data from edge providers.

The FCC order also envisions case-by-case investigations of "pay-for-privacy" practices. ISPs will be less likely to charge different prices to consumers with different privacy preferences. For example, consumers who choose not to opt in but who still want to receive targeted offerings should end up paying more than those who choose to opt in because ISPs need to purchase consumer information on their behalf. However, the FCC's investigation likely will chill any efforts by ISPs to offer differentiated pricing based on consumer privacy preferences. Therefore, if ISPs want to offset the increase in regulatory costs, the FCC's investigation is more likely than not to force providers to raise broadband prices for all consumers, not a subset.

With its new regulations, the FCC claims to "protect consumer choice" and "toughen pay-for-privacy safeguards." But by expanding the definition of "customer proprietary information" to include non-sensitive information, the effect of the FCC order will be to impose higher prices for all broadband consumers without actually creating more choices. Instead of a fraction of consumers paying for privacy, all consumers are harmed by the likely result that the FCC's new regulations will lead to higher broadband prices.

Michael J. Horney is a research associate at the Free State Foundation.

The FCC's privacy vote continued to draw a crowd Thursday (Oct. 27) as more groups weighed in on the FCC's decision to require broadband subs to give affirmative permission for the sharing of their Web browsing and app use histories, and take action to boost disclosure of data sharing and data security and breach notification.

Related:Stakeholders Go Public on Privacy Order

The Open Technology Institute was pleased with the move.

“OTI commends the FCC for taking this important step to protect the privacy of broadband consumers," said Laura Moy, acting director of Georgetown Law’s Institute for Public Representation, which represents OTI. "The rules approved today will finally give consumers the protection that they deserve and the Communications Act requires. We want consumers to have confidence in the internet as a safe platform for the exploration and expression of viewpoints without having to worry their ISP will be looking over their shoulder. By preventing ISPs from snooping into and monetizing private information without first getting their customers’ permission, this Order delivers that confidence.”

Demand Progress was equally upbeat, but also took the opportunity to take aim at the AT&T-Time Warner merger.

“Today, chairman Wheeler and commissioners Clyburn and Rosenworcel should be commended for asserting the FCC's jurisdiction over how internet providers protect their users' privacy," said Demand Progress executive director David Segal. "Time and again, we have seen the country’s largest ISP’s, including AT&T, Comcast and Verizon, violate the public’s privacy — severely eroding trust and chilling free expression online in service of corporate profits. Today’s vote is a step forward, but much more must be done. AT&T in particular is a notorious violator of privacy rights, and these consumer abuses are but one of many reasons why we look forward to fighting the company's attempted takeover of Time Warner.”

The FCC's privacy order makes kids' information sensitive data that requires opt-in consent for sharing.

"Common Sense applauds chairman Wheeler and the Commission for approving strong new protections for the privacy of children and families in their online lives and the right for broadband consumers to make informed choices about the use and sharing of their and their kids’ online information, including web and app activity, IP addresses, and geolocation," said Common Sense Kids Action founder James Steyer. "The new FCC rule will also protect families as they move from computers and mobile devices to a growing Internet of Things. This is an excellent step in increasing privacy protections for Americans overall, and we look forward to supporting the rule’s implementation as well as to supporting similarly robust rules for other online actors." Currently edge providers like Google and Facebook are not subject to similarly strong opt-in requirements, but some in Congress are looking to give the FTC more authority.

But there were plenty of pans, or at least partial pans, for the order, which ISPs have said could disrupt the ad-supported free content on the Web and give an unfair advantage to edge providers who are not under an opt-in regime for sharing Web and app info with third-party marketers.

“The FCC’s new privacy rules board up the windows while leaving the doors unlocked," said Rick Boucher, former Democratic chair of the House Communications Subcommittee and currently honorary chair of the Internet Innovation Alliance. "Rather than expanding the definition of sensitive data to include all Web browsing and app usage history, the FCC should adopt the FTC’s more sensible framework as the privacy requirements for ISPs so the entire internet ecosystem is governed by the same rules.

"The bifurcated system that the Commission has created will surely harm consumers by creating confusion," Boucher added. "There is a better way.”

Advertisers and ad associations were not happy.

"The FCC’s new sweeping privacy rules decision is unprecedented, misguided, counterproductive, and potentially extremely harmful," said the Association of National Advertisers. "Subjecting virtually all web browsing and application use data to opt-in consent is completely inconsistent with its long-standing treatment by the FTC, the states, and the Digital Advertising Alliance (DAA) self-regulatory program. ANA believed it was a positive step when the FCC stated it would distinguish between sensitive and non-sensitive data, but this proved to be merely misleading lip-service. The new definition of sensitive data adopted by the Commission today would encompass and swallow a vast amount of routine consumer data on the Internet and mobile media."

Dave Grimaldi, EVP of the Interactive Advertising Bureau, said: “Today the FCC took an unfortunate step toward destabilizing the ad-supported internet economy. By voting to approve an overly-broad definition of “sensitive information” that includes web browsing history, the Commission’s action could impair the ability for online ads to support the wealth of consumer benefits we all have come to expect.”

Software developers said that while they recognized that the FCC needed to address the regulatory gap -- the FTC can't regulate common carrier privacy, so the FCC deeded itself oversight when it reclassified ISPs as common carriers in the Open Internet order -- the commission had gone too far. 

“We are concerned that this new privacy regulation strays from the current FTC framework which focuses on information that is actually sensitive," said Software & Information Industry Association VP Mark MacCarthy. "The Commission is casting too wide of a net by classifying web browsing information, app history and other such data as ‘sensitive.’ This broad opt-in requirement is likely to create substantial confusion for consumers.”

USTelecom's reaction was mixed.

“When this proceeding began, USTelecom and many others urged the commission to harmonize its proposal with the framework developed by the Federal Trade Commission (FTC) given its years of experience with protecting consumer privacy," said USTelecom president Walter McCormick. "The FTC’s approach, endorsed by the White House, has supported innovation across the internet to deliver services that consumers want. The FCC’s partial revision of its proposal to more closely align with the FTC approach is a welcome change for consumers."

But there was a "but."

"Unfortunately, the FCC has chosen to depart from the FTC framework in some areas, for example, by summarily classifying all Web browsing as sensitive information," McCormick added. "This is a disservice to the goal of providing consumers with consistency in privacy expectations when they use the internet and poses a threat to continuing web innovation. The FCC’s argument that broadband providers have unique access to consumer information compared to other internet firms is simply wrong, as the record in the proceeding amply demonstrates."

Verizon, which is a member of USTelecom, was even more cautiously upbeat.

"Verizon is encouraged by the preliminary information we heard this morning about the privacy order approved by the FCC," said Kathy Grillo, SVP and deputy general counsel. "Our company cares deeply about our customers’ privacy, and we strongly believe maintaining consumer trust is critical in each facet of our operations."

"From the outset of this proceeding, we stressed the importance of creating a consistent approach to privacy that gives consumers the same information and choices about the use of their data, regardless of the type of company they interact with online. While we will need to closely review the text of the FCC order after it is released, the final order appears to adopt rules that are much more closely aligned with the Federal Trade Commission’s privacy framework that has long applied to our ISP business and that continues to apply to the rest of the internet ecosystem.”

Both sides were quick to weigh in Thursday (Oct. 27) after a politically divided FCC adopted new broadband privacy rules that give users more control over how their Web information is used and how it is protected by ISPs.

Some critics were already saying "See you in court."

“Although well-intentioned, the FCC’s decision to impose expansive new consumer privacy rules on ISPs far exceeds its statutory authority," said Genny Morelli, president of ITTA, which represents mid-sized telecoms. "The authority to apply the complex and burdensome privacy regime adopted today is nowhere to be found in the Communications Act or its legislative history.  ITTA looks forward to participating in the legal challenge to today’s decision and is confident the decision will be found unlawful."

Related:Broadband Privacy Rules Continue to Draw Reaction

NCTA: The Internet & Television Association also opposed the decision, saying: “The Commission’s decision to break with the FTC’s proven privacy framework in favor of a cobbled-together approach that abandons principles of fair competition is profoundly disappointing. Instead of creating a consistent and uniform approach to privacy that consumers can easily understand, today’s result speaks more to regulatory opportunism than reasoned policy. We strongly agree with the bipartisan commissioners’ comments that the federal government should develop a common approach to online privacy, as there is no lawful, factual or sound policy basis to justify a discriminatory approach that treats ISPs differently from some of the largest companies in the Internet ecosystem that engage in similar practices but operate under different regulatory standards.”

Commissioner Republicans, who dissented from the item, warned it would be taken to court and agreed it would not stand up.

Reed Smith counsel Sam Cullari, formerly Comcast deputy general counsel focusing on privacy, said it was impossible to square the FCC's professed consumer focus with the decision. 

"Huge corporations with competing interests like Comcast and Google aligning in opposition to an FCC proposal should be an obvious red flag that the FCC is charging in the wrong direction," he said. "Most consumers connect to the Internet through multiple providers, and Internet browsers like Google Chrome and social networks like Facebook are privy to a broader universe of customer information than any single ISP. Chairman Wheeler's proposal would impose strict opt-in consent restrictions on ISPs for the use of geo-location and Web browsing data while giving edge providers a pass on utilizing the exact same data."

Read more about broadband privacy.

But the decision had plenty of fans as well.

"“These broadband privacy rules are the next logical step since enshrining net neutrality in our telecommunications playbook," said Sen. Ed Markey (D-Mass.). "These rules will ensure that as technology changes, our core values do not -- that consumers, not corporations, have control over their personal information. Consumers should be able to know at any given time what kind of information is being collected about them by their Internet service provider and how that information is being used. I applaud chairman Wheeler and the FCC for putting rules on the books that honor Americans’ right to privacy.”

“Consumers demand strong privacy protections online so I commend the FCC for today’s vote to enact new privacy rules," said Energy & Commerce ranking member Frank Pallone, Jr. (D-N,J.).  "I believe that no consumer—regardless of their income—should be forced to choose between their privacy and staying connected.  I will therefore be reading the new pay-for-privacy rules closely to make sure consumers come out ahead.”

Public Knowledge Policy fellow Dallas Harris said: “This marks a significant step forward in protecting consumer privacy. For the first time, Internet Service Providers will be required to get consumer consent prior to using the sensitive information they collect. While much remains to be done to protect consumers online writ large, the Commission’s rules establish a baseline level of protection for all. Thanks to the rules passed by the Commission today, consumers now have more control over how their information is used online than ever before. Yet, consumer protection rules are only as strong as their ability to be enforced, so it is imperative that the Commission follow these strong rules with strict enforcement.”

Joan Marsh, AT&T SVP of federal regulatory, said: “AT&T has long been committed to a clear and transparent approach to ensuring that the privacy rights of our customers are protected. For this reason, AT&T is pleased that the FCC listened to the parties to this proceeding, including the FTC, and adopted a privacy framework that mirrors in many ways the approach taken by the FTC, which regulates the privacy practices of virtually all other companies operating in the internet ecosystem. We also support the decision by the Commission to expand the permissible scope of reasonable first-party marketing and to harmonize the voice and data rules to ensure consistent implementation and enforcement.

“The framework adopted today, however, departs from the FTC regime in significant and illogical ways, most importantly in the treatment of web browsing and app history data," she added. "In this regard, the FCC’s order falls short of recognizing that consumers want their information protected based on the sensitivity of the information collected, not the entity collecting it. The FCC’s divergent approach will ultimately serve only to confuse consumers, who will continue to see ads based on their web browsing history generated by edge providers even after they have been told by their service provider that their consent is required for use of such information.”

Jeff Chester of the Center for Digital Democracy, said: "CDD would have preferred an earlier version of the commission’s privacy proposal that didn’t make distinctions between what is sensitive and non-sensitive data. This is a concept that is increasingly irrelevant today, because of technological advances in “Big Data” analytics and the massive growth of consumer data across all devices where innocuous data can be used to generate highly personal and sensitive details.  But today’s FCC decision is a critical advance to protect our information."

The U.S. Chamber of Commerce says the FCC's "compromise" approach to broadband privacy regs is nothing of the sort.

In a blog post in advance of the FCC's planned vote on the proposal Oct. 27, Chamber assistant policy counsel Jordan Crenshaw said the proposal was the same heavy regs under a new guise.

The proposal was initially to take a "use" approach to protecting users' data that would have made most third-party uses of that data opt in.

But that was changed to a "sensitivity" approach that only made opt in a requirement for that sensitive data. But it would classify web browsing and app use histories as sensitive, amounting, says the chamber, ISPs and others, to essentially the same thing.

Related: Ad Groups Make Personal Pitch to FCC on Privacy

"Chairman Wheeler’s revised proposal claims to be a compromise that draws upon the Federal Trade Commission’s suggestion of opt-in consent for only sensitive data, but in reality the commission’s new proposal eliminates the need to distinguish between sensitive and non-sensitive data because opt-in consent will still be mandated for most of the consumer informationuseful for broadband providers," says Crenshaw. "The FCC’s revised rule in essence tells ISPs that they can now be smothered by a ton of regulatory feathers instead of a ton of stone."

How did the FCC get it wrong. Let Crenshaw count the ways:

1. For ISPs, he says, the new barriers to competition with Web sites, who are not subject to similar opt-in regime mandates for data collection, would be a "costly and burdensome" impediment "at a time when the major internet service providers are already expending less in overall broadband capital expenditures."

2. For consumers, he says, "the rigid proposal of requiring upfront consent for all customer data could actually hamper beneficial uses of data for consumers" and force consumers to "navigate two different sets of privacy approaches with websites remaining under the jurisdiction of the FTC and their broadband providers more heavily regulated by the FCC."

3. For edge providers. While they would be under the less restrictive FTC regime, he says the FCC's precedent could lead to similar regs "imposed" on them, as some in Congress are calling for.

Sen. Ed Markey (D-Mass.) put in a last-minute push for the FCC's broadband privacy proposal, which is on the agenda for an Oct. 27 vote.

Markey joined various groups also pushing for the new regulations--Public Knowledge, Center for Digital Democracy, Color of Change, Consumer Federation of America, on a conference call with reporters to urge the FCC to proceed with that vote.

Markey is also a big backer of set-top reforms that the FCC was also scheduled to vote on before the chairman pulled the item from last month's meeting.

Markey several times said the FCC needs to stay on course for the Oct. 27 vote, calling it a "critical moment" for privacy.

The senator said that just as the country has to make sure Russia doesn't compromise our privacy, no one else should.

Markey did not stay around long enough to answer a question about whether he was suggesting Russia got the info from insecure ISPs, but others on the call said they didn't think that was what he was saying.

The groups are mostly supportive of the FCC's decision to make web browsing and app use history information that ISPs must get affirmative (opt-in) consent to share with third parties for marketing or other purposes.

That is different from the ISP's information sensitivity approach to edge providers, which does not require similar opt in for Google or Facebook sharing of user data. That distinction is one that does not sit well with ISPs, who point to that disparate treatment and want the FCC to align better with the FTC.

The groups on the call suggested that was a red herring and ISPs don't really care about those edge practices.

Thanks to its reclassification of ISPS as common carriers, the FCC assumed broadband privacy regulation, which the FTC had overseen along with edge providers--the FTC is precluded from regulating common carrier privacy.

The groups said they would have preferred the FCC's original approach of making almost all third-party sharing of user info opt in, though ISPs say the FCC's proclaimed pivot to the more FTC-like sensitivity approach is about the same thing since it sweeps web browsing and app use into the category.

The groups said they were not opposed to stronger FTC regs on other parts of the Internet ecosystem, but say they are focused on the "special relationship" between ISPs and customers and the FCC authority over those ISPs.

The proposal also includes enhanced disclosure of what data is being shared and how, sets deadlines for breach notifications, and prohibits take it or leave it offers--share your data or don't sign up for our ISP service, though it does allow for pay-for-privacy models, but which can be reviewed on a case by case basis.

The groups would prefer no pay for privacy, and for all communications information, including IP addresses and device identifiers--to be sensitive data.

Responding to the call, the ISP-backed 21st Century Privacy Coalition co-chair Jon Leibowitz took issue with the groups', and the senator's, stance.

"“Notwithstanding clear evidence in the record to the contrary, a few people continue to argue that ISPs have unique and comprehensive insight into consumers’ web-browsing and app-usage information. They are using this mistaken claim to urge the FCC to implement a sensitivity-based approach that looks quite different from the one backed by both the Obama administration and the FTC.

“The FCC should not base its final broadband privacy rules on such a fundamentally flawed premise.  Instead, it should more clearly adopt the approach of the FTC and Obama Administration, which more fully protects the privacy of consumers while allowing the internet to flourish.”

Leibowitz should know about that FTC regime, he is the former Obama FTC chair who oversaw that self-regulatory based, privacy by design approach.

Former House Communications Subcommittee Chairman Rick Boucher, currently honorary chair of the Internet Innovation Alliance, also saw the FCC approach as overly broad and creating a bifurcated regulatory approach.

“Consumer data is inconsistently protected when it’s not allowed to be used in certain ways by some companies but is permitted to be used in the same way by others," he said. "In line with the FTC’s model, which applies to Internet edge providers, the FCC should develop an approach to privacy for ISPs with the level of protection based on the sensitivity of the data and how it’s being used. By conforming the privacy protections across the Internet ecosystem, consumer confusion will be avoided.”

Sen. Ed Markey (D-Mass.) will join various groups pushing new broadband privacy regs Thursday (Oct. 20) to urge the FCC to vote on them at the Oct. 27 meeting as planned.

FCC Chairman Tom Wheeler has put that vote on the agenda, but the set-top item was on the agenda for last month's meeting before being pulled at the last minute, so clearly the groups don't want a repeat of that. Thursday is the day the FCC releases the agenda for the meeting and the sunshine period prohibition on contacting the FCC decisionmakers about the privacy item begins.

The groups include Public Knowledge, the Open Technology Institute, and the Consumer Federation of America, and say the FCC "must act" to protect what they call the "growing" threat online of ISP data collection.

Related: Pallone Pushes for Broadband Privacy Vote

Wheeler's privacy proposal would make web site visits, app use histories and geolocation all sensitive data that requires ISP subs to opt in to their collection and use by third parties. ISPs point out that edge providers like Google and Facebook have no such restrictions, but Wheeler has said that IPSs have a unique window on everywhere their subs are going online.

In announcing a Thursday press conference, the groups echoed the chairman's argument, and argued that ISPs are collecting and monetizing more data on mobile use and Web histories and tracking them on the move (geolocation).

Looking to light a fire under the FCC, a group of 76 organizations have written Chairman Tom Wheeler and the other commissioners to urge them to take action on three items/issues currently before the commission.

Those are the set-top box proposal, broadband privacy and the zero rating plan investigation.

The commissioners are currently vetting an updated set-top proposal, zero rating is an ongoing inquiry, Wheeler has said recently; and broadband privacy is up for a vote at the Oct. 27 public meeting, so it appears to be the closest to action, though Wheeler could add set-tops to the October meeting if he can get three votes for it and though the privacy proposal has been tweaked, it continues to get pushback from industry and some in Congress.

In the letter, they called the three items "big opportunities" to protect consumers. Wheeler has said he wanted to act on set-tops and broadband privacy by year's end, but has not provided a timetable for the zero rating investigation/inquiry.

The FCC is looking into zero-rating plans both on its own dime and in response to a complaint under the Open Internet general conduct standard, which the FCC can use to decide, on a case-by-case basis, that a practice not specifically prohibited under the rules impedes an Open Internet.

Related: O'Rielly Says Zero Rating Plan Has Chilled Offerings

The groups asked the commission to "liberate" those consumers from the set-top "monopoly; "promulgate rules that foster

trust in the integrity of broadband privacy"; and "prohibit abusive data caps and zero rating plans that violate net neutrality."

The set-top proposal would require MVPDs to make their content available to third parties via a device or app as a way to promote competition in navigation devices, and give online video competitors a stronger platform for competing with that MVPD content, both of which are FCC goals under Wheeler.

While the broadband privacy item is scheduled for a public vote, it is unclear when the set-top box order will be voted. It was pulled off last month's meeting agenda and placed on circulation, which means it could be voted any time, though if the chairman does line up three votes, he could add it to the Oct. 27 agenda, which would make sense politically given that both Democrats and Republicans in Congress have called for transparency in how that item is dealt with.

Among the many signatories to the letter, which was dated Oct. 17, are Public Knowledge, Free Press, Demand Progress and the Center for Digital Democracy.

ISPs were beginning to weigh in on the FCC’s new broadband proposal taking a more nuanced approach by gauging its protection on the sensitivity of the data, though agency chairman Tom Wheeler’s proposal to categorize Web browsing histories and app histories as sensitive information was not sitting well with NCTA-The Internet & Television Association.

"The Chairman’s Fact Sheet describes a regime that departs from the FTC’s proven sensitivity-based approach to consumer privacy in several key respects," said NCTA. "Specifically, in its treatment of web browsing data and first party marketing of ISP services, the FCC departs from past FTC practice in ways that violate principles of fair competition and deny consumers the benefit of a consistent approach to online privacy protection. If the Chairman insists on advancing this approach, we would hope that his fellow commissioners would ‘opt-out’ and seek a result more faithful to the FTC’s proven framework of protecting consumers."

NCTA pushed for a more FTC-like model, but clearly this was not quite it.  NCTA had a similar reaction to FCC Chairman Tom Wheeler's pivot on set-tops toward an app-based approach NCTA had proposed, which is while it looked like a pivot, it was not all it seemed.

The Information Technology & Innovation Foundation (ITIF) called it a faux compromise.

"The privacy framework announced today, like the Title II common carrier designation before it, sets a terrible precedent likely to reverberate throughout the Internet ecosystem for years to come," the group said.

"This proposed order represents one more slide down the slippery slope, away from the innovation-friendly world of flexible guidelines and effective oversight and towards a paternalist mother-may-I regime that will necessarily raise consumer costs and limit investment. Let’s be clear: This proposal is a vehement rejection of the type of U.S. regulatory oversight that has allowed U.S. businesses to thrive online and a sharp reversal from past claims that the U.S. government is committed to using multistakeholder processes for creating Internet-related policies. Instead, it would create a rigid regulatory regime and introduce a new collective action problem that would limit the use of virtually all data that can be put to economically beneficial uses.

"The FCC claims to hew more closely to the tried-and-true FTC privacy framework. It does only in that the FCC plans to base its data sharing consent requirements loosely around the sensitivity of the data involved, rather than placing heightened restrictions based solely on the company holding the data.

"But key departures from the FTC model negate most, if not all, of the advantages of this approach. First, the FTC offers guidelines, not regulatory mandates. The FCC’s class of 'sensitive' data requiring opt-in consent is absurdly large, effectively requiring ISPs to obtain opt-in consent for any uses of consumer data—a scenario that will chill investment and diminish competition by establishing disparate privacy rules for separate segments of industry.

"In addition, the FCC would force companies to ask for permission from the government before offering their broadband customers discounts for sharing of data. This paternalistic approach assumes that consumers are neither smart enough nor savvy enough to make their own choices about how to reduce their costs."

Telcos were a little more sanguine, though still with reservations.

“Consumers are best served when privacy rules are clear and consistent across the entire internet. We are pleased that the FCC has recognized the importance of providing consumers with a common expectation of privacy without regard to service or platform, and that the sensitive nature of the information being shared should be the determining factor in what is afforded increased protection," said USTelecom president Walter McCormick. "We are concerned, however, that the commission, which has no expertise with regard to determining the content of speech, is now attempting to redefine what consumers may regard as sensitive. In this regard, consumers would be better served if the FCC were to defer to the expertise of the FTC in this area, and the two agencies were to pursue a uniform approach.”

Verizon chief privacy officer Karen Zacharia said: "At Verizon, we are encouraged that the FCC appears to have taken seriously the input provided by a wide range of stakeholders and seems to be moving towards an approach that provides for more consistent standards across the internet ecosystem. We care deeply about our customers’ privacy, and understand that we have much at risk if we lose their trust. A consistent approach to privacy that gives consumers the same information and choices about the use of their data, regardless of the type of company they interact with online, is essential.  Maintaining a consistent set of standards also will foster the competition and innovation that consumers love about the Internet.

"Where the FCC draws the line between sensitive and non-sensitive data will be important, but in general we agree that a sensitivity-based approach is more closely aligned with the Federal Trade Commissions’ choice framework and better for consumers," Zacharia added. "We think that this approach better reflects our customers’ expectations. In fact, at Verizon, we have long tailored choices for our customers based on data sensitivity.

"Verizon is much more than an ISP," she continued. "For a company like Verizon, which offers a diverse set of products and services across the Internet ecosystem, this movement towards a harmonized approach is particularly important."

The Association of National Advertisers sounded hopeful but concerned.

“We are just beginning to review Chairman Wheeler’s Broadband CPNI Fact Sheet, and are pleased that it now distinguishes between sensitive and non-sensitive information," ANA said in a statement. "This distinction is critically important and consistent with existing law and self-regulatory standards, like those of the Digital Advertising Alliance. While the Fact Sheet cites some examples of the information that will fall into each category, it will be crucially important that the definition of sensitive information is not overly broad or this approach will prove onerous both to business and consumers and counterproductive. We are also extremely concerned about some provisions, including the overly-burdensome data breach notification obligations that are inconsistent with state approaches to this issue in the U.S. This aspect of the proposal is highly likely to force companies often to have to prematurely notify a breach before all facts are at hand.  We look forward to working with the FCC on these issues as this matter advances.”

Industry players, and government officials, were beginning to weigh in on FCC Chairman Tom Wheeler's modified broadband privacy proposal, which was billed as more in line with the Federal Trade Commission's approach to ISP customer privacy ISPs had sought.

But the reaction of privacy groups seeking strong regs on ISPs suggests the pivot was not sufficient to get the industry onboard given that it included Web browsing and app histories among the info sharing that must get user sign-off up front. That was confirmed by one industry source who saw the FCC's expansive view of sensitive info requiring customer opt-in as maintaining the gulf between how ISPs and edge providers like Google, are treated.

“We know that consumers care deeply about their privacy, and I am pleased to see the FCC moving forward to protect the privacy of millions of broadband users across the country," said Chair Edith Ramirez. "The FTC, which has protected consumers’ privacy for decades in both the online and brick-and-mortar worlds, provided formal comment to the FCC on the proposed rulemaking, and I believe that our input has helped strengthen this important initiative.”

Wheeler had said he was in contact with the FTC about the proposal, which had buoyed ISPs pushing more for the FTC model, which tailors the protection of info to its sensitivity.

The Open Technology Institute was applauding what it saw as strong new rules.

"Consumers have no choice but to share lots of details regarding their online activities with their ISPs—but that’s only for traffic routing purposes, and not because they want their ISPs to be able to use and share that information for any other reason they please," said Laura Moy, an attorney representing OTI. "The Chairman’s proposal keeps control of information widely considered to be private, such as browsing history and application usage, firmly in the hands of consumers, where it belongs.

"Although we cautioned against a framework that offers less protection for 'non-sensitive' information," said Moy, "we are optimistic that this framework can still protect consumers as long as the FCC defines 'sensitive' broadly and thoughtfully. We look forward to continuing to work with the FCC to ensure that by the end of this month, strong broadband privacy protections are put in place."

Among the categories of sensitive information the FCC will require opt-in consent for sharing is children's info as well

as browser and app histories more generally.

That was welcome news to James Steyer, founder of Common Sense Kids Action, the advocacy arm of Common Sense.

"We applaud Chairman Wheeler for proposing strong new protections for the privacy of children and families in their online lives, including the right for broadband customers to make informed choices about the use and sharing of their and their kids’ online information, such as web browsing and app activity," said Steyer. "Common Sense has long advocated for increased online privacy protections at home and in school, and this proposal is a critical step in the right direction.  We look forward to supporting the FCC as it refines and finalizes the rule this month as well as to supporting similarly robust rules for other online actors."

“Internet Service Providers (ISPs) like Comcast, Time Warner Cable, Verizon and Frontier Communications have a unique window into our online lives because they connect us to the Internet. ISPs must not be able to use the vast amount of information that they can get about our online lives simply because they provide the connection for any other purpose without our explicit permission,” said John M. Simpson, Consumer Watchdog’s Privacy Project Director.

“Ultimately we also need privacy regulations covering so-called ‘edge providers’ like Google, Facebook, Amazon and Twitter,” said Simpson. “Nonetheless the FCC’s proposed broadband privacy regulations are critical step in the right direction.”

“Internet Service Providers (ISPs) like Comcast, Time Warner Cable, Verizon and Frontier Communications have a unique window into our online lives because they connect us to the Internet. ISPs must not be able to use the vast amount of information that they can get about our online lives simply because they provide the connection for any other purpose without our explicit permission,” said John Simpson, Consumer Watchdog’s Privacy Project director.

But he calls the FCC proposal, which is scheduled for a vote Oct. 27, a step in the right direction. But he says the next step needs to be tougher regs on edge providers. FCC Chairman Tom wheeler says the commission is not authorized to regulate the edge.

“Ultimately we also need privacy regulations covering so-called ‘edge providers’ like Google, Facebook, Amazon and Twitter,” said Simpson.

Tech coalition CALinnovates agreed.

“This version, like the first, falls woefully short in its noble goal to safeguard consumer data and increase transparency for the public," said Tim Sparapani, senior policy counsel with CALinnovates. "Subjecting the exact same data to different and arbitrary rules depending upon a company’s primary offering in today’s era of vertical integration does not increase consumer privacy. It is also blind to the realities of the marketplace. We need 21st Century privacy rules to govern a 21st Century data market.” said

"Chairman Wheeler has indicated that some favored companies will be allowed to practice permissionless innovation outside the FCC’s jurisdiction while other disfavored entities must operate under the microscope despite the fact that the data is one in the same. Businesses of all types today are data companies first and foremost, whether they make software or deliver internet access – or both. And innovation can and should spring from all types of companies, ISPs included," he said. "Today, Verizon owns Yahoo, AOL and Huffington Post, and the line between ISPs and edge providers has been increasingly blurred. Consumers will be no better off under this scheme than the previous one, but they may be worse off than they are today."

Former officials in the Obama Administration and a former high ranking Democratic congressman got together to root FCC chairman Tom Wheeler on in what they suggested was his move toward a more FTC-based approach to protecting consumers' personal information online.

On a conference call with reporters Wednesday were Jon Leibowitz, former chairman of the FTC who now represents communications companies (NCTA helped organize the call); Henry Waxman, former chair of the House Energy and Commerce Committee, who also reps communications companies, among others; and Nancy Libin, former DOJ chief privacy officer, joined by Emmett O’Keefe, SVP of advocacy for the Digital Marketing Association.

Related:Waxman: FCC Broadband Privacy Proposal Would Harm Consumers

The call came the day before the FCC is expected to put a broadband privacy proposal on the agenda for a vote at the October public meeting. It also came as there were reports, based on ex parte filings and Wheeler's comments at a Hill oversight hearing, that the proposal might be moving toward a more "privacy by design" approach applied by the Federal Trade Commission to broadband privacy before the FCC inherited that authority by reclassifying ISPS as common carriers.

All the participants encouraged the FCC to move in that direction, saying the original approach of requiring subs to affirmatively agree to most third-party uses of their information was consumer unfriendly, created a un-harmonious regulatory regime given that the FTC still applied its approach to edge providers, and argued it would be tied up in court.

Both Leibowitz and Waxman said they supported network neutrality, but not the opt-in approach Wheeler has said was needed to protect customer information.

Leibowitz said it was crucial to get privacy rules right, but that unless the FCC harmonized its approach with that of the FCC, it would "choke off" consumer benefits. O'Keefe seconded that, pointing out that targeted marketing supported the free info that Web users have come to expect and that funded an online model representing millions of jobs and billions of dollars.

Rather than make most third-party uses of data an opt-in choice, they want the FCC to tailor protections to the sensitivity of the data. Stronger protections for health and financial data, or for kids, but essentially inferred consent for marketing data that better targets a consumer's interest -- and supports all that free Web info.

They said the good news is that the FCC seems to be listening, and they were hopeful the item that eventually got voted was better harmonized with the FTC, though Leibowitz said even then the devil would be in the details; for instance, just what the FCC would treat as sensitive information. He pointed out that the FTC did not treat Web browsing info as sensitive.

Waxman said the issue was not about whether to protect privacy, but how to do it. He said that he hoped the FCC would recognize they should not be so out of alignment with what the FTC was doing.  He did not say they had to be in lockstep, but that consumers had some expectation that they would not be treated differently by different parties across the Internet.

Both Waxman and Leibowitz pointed out that Harvard law professor Lawrence Tribe had suggested that differing FTC and FCC regulatory approaches could run afoul of the First Amendment.

The Senate Commerce Committee has scheduled a Federal Trade Commission oversight hearing.

The office of the committee's chairman, John Thune (R-S.D.), announced that the hearing will be Sept. 27 at 10 a.m.

Look for broadband privacy to be a hot topic of conversation. Committee Republicans have been pushing the FCC to take a page from the FTC's privacy oversight and focus on tailoring broadband privacy to the sensitivity of information, and to adopt an opt-out, rather than opt-in, regime for information sharing, which has been the FTC's approach.

Just last week, the major ISPs called on the committee to drill down on the FCC proposal.

The FCC inherited oversight of broadband privacy from the FTC when it reclassified ISPs as common carriers, which the FTC is excluded from regulating under the false and deceptive authority the FTC uses.

Related:Court Decision Raises Edge Provider Regulation Issues

There could also be questions about the recent court decision that called into question whether buying a common carrier could insulate edge providers from FTC privacy regulatory authority.

What is the price of privacy for Americans?

That’s the single question Federal Communications Commission chairman Tom Wheeler is mulling as his agency tries to craft new broadband privacy rules that would put more restrictions on cable operators and other Internet-service providers than so-called edge providers — such as search engines and social-media platforms — all of which use personal consumer information to boost their business models.

To advocates in both camps, it is yet another flashpoint in the issue of online privacy and the different treatment given to companies in different industries.

The FCC deeded itself authority over broadband privacy when it reclassified ISPs as common carriers, which exempts them from the Federal Trade Commission oversight that used to be their regulatory governor. Wheeler, joined by the FCC’s other Democrats, proposed new rules requiring customers to opt into sharing their information with third parties.

The issue has been a hotbed of debate not just for consumers, but for the affected companies chafing against regulation. At press time, “Protecting the Privacy of Customers of Broadband and Other Telecommunications Services” had generated more than 276,600 comments on the FCC’s docket; at one point, it racked up 17,753 comments in a single 30-day period. That was more than 10 times as many comments as the second-place docket.

The FCC’s current proposal to come up with bright-line rules on broadband customer privacy is only part of the larger issue of keeping consumer data safe from prying eyes while not kneecapping the targeted ad business model that allows for free online content. Protecting information from foreign and domestic hackers is a separate issue, though one that continues to dominate privacy vs. security discussions in Washington — in that case, national security.

Perhaps the biggest unknown involves the Internet of Things, which includes an endless variety of side doors into a user’s online information. (Quite literally, since it could include WiFi-controlled door locks.) As many as 200 million IoT devices could be deployed by 2020, according to Intel.

At stake for ISPs such as Comcast and Verizon Communications is their ability to profit from targeted marketing to their broadband subscribers versus edge providers ability to do so. Edge providers — firms such as Google, Facebook, Yahoo and others that provide Internet content — are not subject to the same restrictions on monetizing user information.

Wheeler’s proposed rules on broadband privacy — which include new restrictions on which types of information ISPs can share, new reporting requirements and deadlines — could come to a vote by the end of the year.

Complicating the enforcement of privacy rules is the jurisdictional issue of which agency regulates which activities. A simple question has a maddeningly complicated answer.

ISPs, for example, know where their customers are going online — and that information is highly prized by online marketers seeking to target ads. It’s for the FCC to decide how that data is used and what control consumers have over its use.

But the individual websites can also track their visitors, and that information, too, is valuable to third parties and online marketers. That data is under the FTC’s purview, although a recent federal appeals court decision has cast that into doubt.

As the FCC-branded gatekeepers of online information, cable operators and other ISPs are at the nexus of the issue.

Meanwhile, the Wheeler-led FCC says it must keep its hands off of edge providers. “[A]ny rules that apply to [only] broadband providers do not prevent” all other Internet companies from storing and manipulating that private information, said Scott Cleland, who runs NetCompetition, an e-forum backed by broadband companies.

“They only prevent one, the ISP,” Cleland said. “It is the functional equivalent of blocking one little square of a metal screen and imagining that one has plugged the whole screen.”

Public Knowledge has argued that Congress intended that broadband customers have control of how their information is used, period. They say that anonymization of that data, which ISPs say should be treated more lightly than identifiable personal information, would still “convey a windfall to the carrier at the expense of consumer control of the information in a way that Congress did not intend.”

ISPs point out that consumers also benefit through third-party use of their anonymized data since that data is the lynchpin of an ad-supported model of free online content that users have come to expect and, arguably, now view as something of an entitlement.

ISPs have pointed out that in other facets of privacy — such as app privacy and facial-recognition software — the Obama administration has sought to have stakeholders come up with voluntary guidelines rather than have government impose prescriptive regulations.

“The FCC’s proposed rules are seriously out of step with the technology-neutral approach — applied to both ISPs and non-ISPs — that that has guided the administration’s many efforts on privacy and cybersecurity policy, with great success,” Michael Powell, president of the National Cable & Telecommunications Association, told the leaders of the Senate Commerce Committee.

PAY FOR PRIVACY

The FCC’s proposed new broadband privacy rules do not ban what some dub “pay for privacy” — ISPs providing an incentive in the form of lower bills for users in return for customers allowing their information to be used for third-party targeted marketing. Indeed, Wheeler himself suggested to National Public Radio that was a way for consumers to control and monetize the value of that information.

But the chairman has left some wiggle room. The notice of proposed rulemaking asks whether “pay for privacy” is allowable under the Communications Act. It cites the example of AT&T’s GigaPower fiber-to-the-premises service that offers users a $30 price break off a $100 monthly fee for allowing their browsing information to be used to tailor ads.

ISPs have an ally in their fight against prescriptive rules in Jon Leibowitz, the former chairman of the FTC under President Obama from 2009 to 2013. He has been working hard to convince the FCC to take the FTC’s approach to privacy, which means enforcing existing privacy policies rather than creating new rules requiring customers to opt in to third-party use of their info for marketing purposes.

In a letter to the FCC, Leibowitz, co-chair of the 21st Century Privacy Coalition and a partner at Davis Polk & Wardell advocating for telecom and broadband providers, said that applying an opt-in privacy regime for ISPs that does not apply to edge providers — still subject to the FTC’s enforcement policies — would undercut consumer benefits.

Instead, he has said, the FCC should adopt the more flexible privacy-by-design approach adopted by the FTC during his tenure, tailoring protections and consumer choice to the sensitivity of the information and how it is being used, and encouraging increased transparency.

That’s a way to apply privacy regulations in a tech-neutral manner to edge providers and ISPs, Leibowitz has said. It is also at the heart of an alternative to the FCC proposal that has been championed by the NCTA and others.

SIDEBAR: Terror Watch

WASHINGTON — Terrorism has reached into various aspects of American life, online privacy among them.

Last fall, in the wake of the terrorist attacks in Paris and ongoing urban violence, some in Congress asked Federal Communications Commission chairman Tom Wheeler what the agency could do to disrupt social media or other Internet communications used by terrorists to recruit or spread their messages of hate.

Wheeler has said the FCC has a limited role — he has long insisted the agency can regulate Internet-service providers, but not edge providers such as Google, Yahoo or Facebook.

“We do not have jurisdiction over Facebook and other edge providers, and we do not intend to assert jurisdiction over them, and I don’t believe, as legitimate as your concern is, I don’t believe we have the jurisdiction to do the kind of thing that you suggest,” Wheeler told Congress when asked if the government could “shut them down.”

But some privacy groups are concerned that the Department of Homeland Security is trying to step in and start regularly monitoring social-media posts.

The Center for Democracy and Technology, a Washington, D.C.-based nonprofit group, has told DHS to back off a proposal to ask some foreign visitors to the U.S. to volunteer information about their social media participation when applying to visit, which it calls an “avenue for overly-intrusive government surveillance.”

In comments to DHS, the CDT said it was concerned about “unspecified review and [“suspicion-less”] monitoring of their public online activity,” calling it a threat to privacy and speech protections.

While DHS has said the information was voluntary, the center fears that will not be the case with folks being asked by the government to supply information in the process of trying to secure entry.

SIDEBAR: Driven to Detection

WASHINGTON — The Federal Communications Commission’s privacy purview extends to actual superhighways as well as the information superhighway.

As the auto industry begins to deploy collision avoidance and other vehicle-to-vehicle communications using dedicated short-range communications (DRSC) spectrum, consumer and privacy groups — as well as some lawmakers — are pushing the agency to come up with customer-information privacy protections as commercial and noncommercial uses are developed for the Internet of (Vehicular) Things.

The FCC opened an inquiry into the issue after Public Knowledge petitioned it for an emergency stay of the rollout of so-called Vehicle-to-Vehicle (V2V) services. Sens. Ed Markey (D-Mass.) and Richard Blumenthal (D-Conn.) wrote with their concerns, including that the FCC reserve the spectrum for matters of public safety, such as crash avoidance.

The issue is not just that cars can be hacked — which could put lives in jeopardy — but that retailers might sell commercial services using customer broadband information.

V2V services would make use of 5-GHz spectrum, the same swath of bandwidth cable operators use to fuel WiFi hotspots — the industry’s primary mobile broadband play. They’ve been pushing for more of that spectrum.

Public Knowledge says that the cybersecurity and privacy issues behind its effort are independent of the issue of sharing the band with WiFi. Delaying V2V rollout is necessary “whether or not the [FCC] allows operation of unlicensed devices in all or part of the DSRC band on a non-interfering basis.”

With regard to the retail issue, Public Knowledge points out that businesses could collect and analyze where a vehicle goes and how long it stays there — without the driver’s knowledge or consent. It could also serve them targeted ads via dashboard consoles, in-car entertainment systems or digtal billboards on gas pumps.