Several groups including ISP-backed NetCompetition, Americans for Tax Reform and a host of small-government advocates are calling on Congress to dismantle the FCC's broadband privacy framework, which it adopted in the waning days of former chairman Tom Wheeler's tenure.

The order requires ISPs to get their subscribers' permission before sharing Web browsing and app use histories with third parties for marketing and other purposes. It also includes data security and data breach notification rules as well as a prohibition on making information sharing a quid pro quo for service and a case-by-case look at offering incentives to share info. The FCC will also pre-empt state privacy, data security and data breach laws that conflict with its new rules.

In letters to the bipartisan leadership of the House and Senate, the groups asked that congress exercise its authority under the Congressional Review Act to rescind the FCC's Broadband Privacy order. The act allows Congress to review and reverse government regulations.

"Congress is fully justified in rescinding these rules both because the Order lacks proper legal grounding and because of the need to ensure real consumer privacy across contexts of user experience," the groups said. That is a reference to the fact that the framework applies to ISPs, but not edge providers like Yahoo! and Facebook and Google.

"The FCC’s approach is inconsistent with that of the Federal Trade Commission for nearly two decades, and will likely render harm unto consumers," they said.

That argument was made throughout the FCC's consideration of the framework, which passed on a party line vote 3-2.

"The FCC's questionable ability to regulate privacy standards, and its narrow view on what constitutes privacy protection, make its rules counterproductive to actual consumer privacy protections," the groups wrote. "In contrast, the FTC's approach to privacy does a better job of balancing protection of consumers’ privacy online with economic incentives to innovate in consumer products and services."

The FCC's authority to impose the broadband privacy rules stem from the FCC's Open Internet order, which the groups say is of questionable legality.

A federal appeals court has upheld the rules, but new FCC chairman Ajit Pai opposes the Title II-based Open Internet order and is expected to try to reverse that reclassification.

His name was not on the letter, but it did not take long for one House Democratic leader to provide his answer: No way.

“It’s clear that privacy critics feel emboldened to push for the elimination of privacy protections for American consumers, no matter the platform," Energy and Commerce Committee Ranking Member Frank Pallone, Jr. (D-N.J.). "This demand to gut the Federal Communications Commission is only the latest move and comes after ongoing attempts to hamstring the Federal Trade Commission. Consumers should not have to worry about their financial, medical and other personal information begin shared without their permission. I will continue to vigorously fight against these combined efforts to harm consumers and take away their privacy and data security.”

What is the price of privacy for Americans?

That’s the single question Federal Communications Commission chairman Tom Wheeler is mulling as his agency tries to craft new broadband privacy rules that would put more restrictions on cable operators and other Internet-service providers than so-called edge providers — such as search engines and social-media platforms — all of which use personal consumer information to boost their business models.

To advocates in both camps, it is yet another flashpoint in the issue of online privacy and the different treatment given to companies in different industries.

The FCC deeded itself authority over broadband privacy when it reclassified ISPs as common carriers, which exempts them from the Federal Trade Commission oversight that used to be their regulatory governor. Wheeler, joined by the FCC’s other Democrats, proposed new rules requiring customers to opt into sharing their information with third parties.

The issue has been a hotbed of debate not just for consumers, but for the affected companies chafing against regulation. At press time, “Protecting the Privacy of Customers of Broadband and Other Telecommunications Services” had generated more than 276,600 comments on the FCC’s docket; at one point, it racked up 17,753 comments in a single 30-day period. That was more than 10 times as many comments as the second-place docket.

The FCC’s current proposal to come up with bright-line rules on broadband customer privacy is only part of the larger issue of keeping consumer data safe from prying eyes while not kneecapping the targeted ad business model that allows for free online content. Protecting information from foreign and domestic hackers is a separate issue, though one that continues to dominate privacy vs. security discussions in Washington — in that case, national security.

Perhaps the biggest unknown involves the Internet of Things, which includes an endless variety of side doors into a user’s online information. (Quite literally, since it could include WiFi-controlled door locks.) As many as 200 million IoT devices could be deployed by 2020, according to Intel.

At stake for ISPs such as Comcast and Verizon Communications is their ability to profit from targeted marketing to their broadband subscribers versus edge providers ability to do so. Edge providers — firms such as Google, Facebook, Yahoo and others that provide Internet content — are not subject to the same restrictions on monetizing user information.

Wheeler’s proposed rules on broadband privacy — which include new restrictions on which types of information ISPs can share, new reporting requirements and deadlines — could come to a vote by the end of the year.

Complicating the enforcement of privacy rules is the jurisdictional issue of which agency regulates which activities. A simple question has a maddeningly complicated answer.

ISPs, for example, know where their customers are going online — and that information is highly prized by online marketers seeking to target ads. It’s for the FCC to decide how that data is used and what control consumers have over its use.

But the individual websites can also track their visitors, and that information, too, is valuable to third parties and online marketers. That data is under the FTC’s purview, although a recent federal appeals court decision has cast that into doubt.

As the FCC-branded gatekeepers of online information, cable operators and other ISPs are at the nexus of the issue.

Meanwhile, the Wheeler-led FCC says it must keep its hands off of edge providers. “[A]ny rules that apply to [only] broadband providers do not prevent” all other Internet companies from storing and manipulating that private information, said Scott Cleland, who runs NetCompetition, an e-forum backed by broadband companies.

“They only prevent one, the ISP,” Cleland said. “It is the functional equivalent of blocking one little square of a metal screen and imagining that one has plugged the whole screen.”

Public Knowledge has argued that Congress intended that broadband customers have control of how their information is used, period. They say that anonymization of that data, which ISPs say should be treated more lightly than identifiable personal information, would still “convey a windfall to the carrier at the expense of consumer control of the information in a way that Congress did not intend.”

ISPs point out that consumers also benefit through third-party use of their anonymized data since that data is the lynchpin of an ad-supported model of free online content that users have come to expect and, arguably, now view as something of an entitlement.

ISPs have pointed out that in other facets of privacy — such as app privacy and facial-recognition software — the Obama administration has sought to have stakeholders come up with voluntary guidelines rather than have government impose prescriptive regulations.

“The FCC’s proposed rules are seriously out of step with the technology-neutral approach — applied to both ISPs and non-ISPs — that that has guided the administration’s many efforts on privacy and cybersecurity policy, with great success,” Michael Powell, president of the National Cable & Telecommunications Association, told the leaders of the Senate Commerce Committee.

PAY FOR PRIVACY

The FCC’s proposed new broadband privacy rules do not ban what some dub “pay for privacy” — ISPs providing an incentive in the form of lower bills for users in return for customers allowing their information to be used for third-party targeted marketing. Indeed, Wheeler himself suggested to National Public Radio that was a way for consumers to control and monetize the value of that information.

But the chairman has left some wiggle room. The notice of proposed rulemaking asks whether “pay for privacy” is allowable under the Communications Act. It cites the example of AT&T’s GigaPower fiber-to-the-premises service that offers users a $30 price break off a $100 monthly fee for allowing their browsing information to be used to tailor ads.

ISPs have an ally in their fight against prescriptive rules in Jon Leibowitz, the former chairman of the FTC under President Obama from 2009 to 2013. He has been working hard to convince the FCC to take the FTC’s approach to privacy, which means enforcing existing privacy policies rather than creating new rules requiring customers to opt in to third-party use of their info for marketing purposes.

In a letter to the FCC, Leibowitz, co-chair of the 21st Century Privacy Coalition and a partner at Davis Polk & Wardell advocating for telecom and broadband providers, said that applying an opt-in privacy regime for ISPs that does not apply to edge providers — still subject to the FTC’s enforcement policies — would undercut consumer benefits.

Instead, he has said, the FCC should adopt the more flexible privacy-by-design approach adopted by the FTC during his tenure, tailoring protections and consumer choice to the sensitivity of the information and how it is being used, and encouraging increased transparency.

That’s a way to apply privacy regulations in a tech-neutral manner to edge providers and ISPs, Leibowitz has said. It is also at the heart of an alternative to the FCC proposal that has been championed by the NCTA and others.

SIDEBAR: Terror Watch

WASHINGTON — Terrorism has reached into various aspects of American life, online privacy among them.

Last fall, in the wake of the terrorist attacks in Paris and ongoing urban violence, some in Congress asked Federal Communications Commission chairman Tom Wheeler what the agency could do to disrupt social media or other Internet communications used by terrorists to recruit or spread their messages of hate.

Wheeler has said the FCC has a limited role — he has long insisted the agency can regulate Internet-service providers, but not edge providers such as Google, Yahoo or Facebook.

“We do not have jurisdiction over Facebook and other edge providers, and we do not intend to assert jurisdiction over them, and I don’t believe, as legitimate as your concern is, I don’t believe we have the jurisdiction to do the kind of thing that you suggest,” Wheeler told Congress when asked if the government could “shut them down.”

But some privacy groups are concerned that the Department of Homeland Security is trying to step in and start regularly monitoring social-media posts.

The Center for Democracy and Technology, a Washington, D.C.-based nonprofit group, has told DHS to back off a proposal to ask some foreign visitors to the U.S. to volunteer information about their social media participation when applying to visit, which it calls an “avenue for overly-intrusive government surveillance.”

In comments to DHS, the CDT said it was concerned about “unspecified review and [“suspicion-less”] monitoring of their public online activity,” calling it a threat to privacy and speech protections.

While DHS has said the information was voluntary, the center fears that will not be the case with folks being asked by the government to supply information in the process of trying to secure entry.

SIDEBAR: Driven to Detection

WASHINGTON — The Federal Communications Commission’s privacy purview extends to actual superhighways as well as the information superhighway.

As the auto industry begins to deploy collision avoidance and other vehicle-to-vehicle communications using dedicated short-range communications (DRSC) spectrum, consumer and privacy groups — as well as some lawmakers — are pushing the agency to come up with customer-information privacy protections as commercial and noncommercial uses are developed for the Internet of (Vehicular) Things.

The FCC opened an inquiry into the issue after Public Knowledge petitioned it for an emergency stay of the rollout of so-called Vehicle-to-Vehicle (V2V) services. Sens. Ed Markey (D-Mass.) and Richard Blumenthal (D-Conn.) wrote with their concerns, including that the FCC reserve the spectrum for matters of public safety, such as crash avoidance.

The issue is not just that cars can be hacked — which could put lives in jeopardy — but that retailers might sell commercial services using customer broadband information.

V2V services would make use of 5-GHz spectrum, the same swath of bandwidth cable operators use to fuel WiFi hotspots — the industry’s primary mobile broadband play. They’ve been pushing for more of that spectrum.

Public Knowledge says that the cybersecurity and privacy issues behind its effort are independent of the issue of sharing the band with WiFi. Delaying V2V rollout is necessary “whether or not the [FCC] allows operation of unlicensed devices in all or part of the DSRC band on a non-interfering basis.”

With regard to the retail issue, Public Knowledge points out that businesses could collect and analyze where a vehicle goes and how long it stays there — without the driver’s knowledge or consent. It could also serve them targeted ads via dashboard consoles, in-car entertainment systems or digtal billboards on gas pumps.