The FCC and a handful of state attorneys general have created an unprecedented enforcement partnership to go after internet service providers that violate consumers’ data privacy and security.

Currently, the Federal Trade Commission has authority over broadband data privacy and security issues, but the Federal Communications Commission’s Democratic majority is in the process of bringing the internet under its regulatory authority by reclassifying broadband access as a Title II telecommunications service subject to its regulation.

FCC chair Jessica Rosenworcel said the agency is formalizing the cooperation with attorneys general in Illinois, Pennsylvania, Connecticut and New York, all Democrats, through a memorandum of understanding (MOU) with each.

Under the agreements, the Democratic-headed FCC and the Democratic AGs will coordinate investigations and prosecutions and share resources and expertise.

“I am thankful to these four partners for prioritizing interagency cooperation, and we welcome other state leaders to join us in this effort to ensure we work together to protect consumers and their data,” Rosenworcel said of the partnership.

“These strategic partnerships … will allow us to maximize our efforts to address risks arising from the misuse or mishandling of sensitive data we entrust with service providers and the continued threats posed by cybercriminals and foreign adversaries,” FCC Enforcement Bureau chief Loyaan Egal said.

The move means states that want to launch investigations into ISPs will get the FCC Enforcement Bureau staff's expertise, as well as help with things like subpoenas.

Rosenworcel pointed to the success of its new state AG partners in cracking down on robocalls, and looks to leverage that effort in policing ISP conduct when it comes to data protection, privacy and security.

The FCC’s participation will be coordinated through its Privacy and Data Protection Task Force.

President Joe Biden's principal telecom adviser has launched an inquiry into the impact of data collection, storage and use on the civil rights of marginalized communities.

As part of that inquiry, the National Telecommunications and Information Administration (NTIA) on Wednesday (January 18) asked for public comment on how “the ways in which firms collect, share and use data” — including for targeted online advertising — “can exacerbate existing structural inequities.”

Those ways can include online job ads that target some groups but ignore others, the NTIA said in its Privacy, Equity, and Civil Rights Request for Comment, as well as the inequitable impact of data breaches on low-income communities and apps that could make users more subject to discrimination (for example, an LGBTQ dating app that reveals details about someone's movements).

The comments will inform a report on whether and how such data practices can negatively affect marginalized communities and how existing civil rights or privacy laws can be used to address those harms and what new privacy protection proposals could be adopted.

The inquiry follows Biden’s op-ed in The Wall Street Journal calling for “robust federal protections for Americans’ privacy” and an end to “discriminatory algorithmic decision-making," NTIA said.

“Everyone in America deserves strong privacy protections,” NTIA administrator Alan Davidson said in announcing the inquiry. “This is especially important for marginalized communities, where the consequences of privacy invasions can be more starkly felt. Data collection and sharing creates the risk of new digital discrimination replicating previous forms of profiling, redlining and exclusion.” ▪️

The Biden administration is telling the Federal Trade Commission that while potential privacy legislation is good, it is no reason not to aggressively pursue regulations, including “abandoning” the notice and choice approach to Big Tech’s use of consumer data.

That came in the National Telecommunications & Information Administration’s comments to the FTC in its ongoing privacy regulation rulemaking proceeding.

FTC chair Lina Khan — who, unlike the FCC, has a Democratic majority to work with — has made it clear she thinks Big Tech’s privacy practices need more government oversight.

“The significant presence of potential federal legislation in consumer privacy reform discussions does not obviate the importance of the FTC’s efforts to adopt strong, comprehensive rules governing commercial surveillance and data security,” NTIA told the commission.

“The complexities and pace of today’s digital world long ago outpaced what notice and transparency can accomplish as a predominant focus of privacy policy, and they cannot be the primary bulwark against invasive or unfair data practices,” the agency said.

As part of that shift in approach, NTIA said, the FTC should also shift the burden on mitigating privacy risks from individuals to businesses. One way to achieve that would be to adopt tough new limits on the purposes data can be used for.

NTIA also said the FTC needs to require companies to minimize the data they collect and restrict them from gathering data for one purpose and using it for another — like for targeted ads, to better protect children — and consider restricting facial recognition technologies. ▪️

President Joe Biden on Friday signed an executive order implementing a United States-European Union agreement on new cross-border data privacy protections, protections that have been on shifting sands since an international court threw out a previous agreement.

The Executive Order on Enhancing Safeguards for United States Signals Intelligence Activities (E.O.) outlines the steps the U.S. is taking under the new EU-U.S. Data Privacy Framework. The framework is essentially a data protection safe harbor for companies that agree to comply with it.

Those steps include providing companies with greater legal certainty by creating an independent and binding process for individuals who believe their personal data was collected in violation of U.S. law. It also mandates handling requirements for personal information and requires U.S. intelligence agencies to update their policies and procedures in line with those new protections.

Allowing digital goods to flow freely across borders is worth $7.1 trillion in commerce between the EU and the U.S., the White House said, and is key to American companies participating in a world economy.

A new agreement was needed after the EU’s Court of Justice ruled the U.S. couldn't live up to its part of agreement to protect data privacy. Concluding that it did not sufficiently protect data transferred from the EU to the U.S. — particularly involving U.S. government intelligence agency access — the Court of Justice in July 2020 invalidated the so-called privacy shield, prompting the EU and U.S. to get to work on a successor agreement that would pass court muster.

Among those welcoming some of that greater certainty when it comes to how data is protected comes from the computer companies vital to those flows.

“Since that EU court ruling, the two economies have been without clear guidelines for data transfers on the most trafficked route on the globe — impacting transactions such as travel reservations, social media communications, and insurance claims that implicate trillions of dollars of annual economic activity," the Computer & Communications Industry Association (CCIA) said.

“We appreciate President Biden’s action to keep data flowing between the U.S. and EU, underpinning one of our deepest and most mutually beneficial trading relationships," CCIA president Matt Schruers said. “Data transfers are at the heart of the transatlantic relationship, fueling the trade that keeps both of our economies running and brings benefits to consumers and businesses of all sizes who need legal clarity on mechanisms to transfer data.”

Online advertisers, who rely on free flows of information in which to place their messages, were also pleased with the order.

“Today, the Biden administration has taken a big step forward, announcing stronger protections for data transferred to the U.S. and setting the stage for a final agreement with our allies,” Interactive Advertising Bureau executive VP of public policy Lartease Tiffith said. “Data flows are crucial for the mutual development of medical, cybersecurity and other technologies, as well as media, advertising and consumer goods. With so many disruptions to commerce during the last few years, IAB is excited about this new development to ensure secure cross-border data flows. IAB looks forward to working with the EU and U.S. to fully implement the new agreement.”

BBB National Programs certainly saw a better digital business climate on the horizon.

“At BBB National Programs, we commend the White House, the U.S. Department of Commerce, and their counterparts in the European Commission for lifting the cloud of uncertainty that has been hanging over Privacy Shield for more than two years,” the organization said in a statement. “As the longest-running Independent Recourse Mechanism (IRM) provider, the first recognized under Privacy Shield, trusted for more than 20 years by businesses of all sizes, we view this formal commitment to the EU-U.S. Data Privacy Framework as a huge milestone for the $7 trillion trans-Atlantic economy.”

Jason Oxman, president and CEO of tech trade group the Information Technology Industry Council (ITI), said: “Today’s actions will help restore business certainty and safeguard continuity of key business operations as data moves across the Atlantic, while also upholding European citizens’ fundamental rights, and the security and public safety interests of the U.S., EU, and other qualified states. We appreciate the Biden Administration’s attention to this critical issue and look forward to working with the European Union to implement the EU-U.S. Data Privacy Framework over the coming months.” ■

The House Energy & Commerce Committee has approved a comprehensive data privacy protection regime that would limit targeted online advertising and ban it for youth.

The vote on the legislation, which followed a lengthy markup in the committee Wednesday (July 20), was 53-2.

The bipartisan American Data Privacy and Protection Act (H.R. 8152) is a comprehensive national privacy regime that would require companies to collect only the data necessary to provide their products or services, bill advocate Common Cause has said, and would allow consumers to correct or delete their data. There are also prohibitions on discriminatory data practices, algorithms and ad delivery.

The bill would require consumers to get a clear and conspicuous opportunity to opt out of targeted advertising, And if a consumer is younger than 17 and an advertiser knows this, they cannot be targeted with advertising at all.

The bill also creates a Youth Privacy and Marketing Division within the Federal Trade Commission charged with protecting the privacy of children and minors and with looking out for marketing directed at kids. The division will have to report to Congress annually on how successful it has been in its mission and on any emerging concerns about protecting the privacy of children and minors.

House E&C chair Frank Pallone (D-N.J.) pointed out that there is strong support for the bill in the Senate as well, so he appeared confident that the bill would pass both chambers and make it to President Joe Biden’s desk. ▪️

“USTelecom commends the House Energy & Commerce Committee for taking an important step toward a national privacy framework," said SVP, government affairs, Brandon Heiner. "While there is more to be done, we look forward to continuing to work with Congress to ensure any privacy law provides all of America’s broadband customers the protection they deserve.”

The Interactive Advertising Bureau, which says it cannot support the bill, warned that the legislation will create a less friendly online environment not just for advertisers and small businesses but for the average online user whose speed and convenience of online experience depend on data.

"By some estimates, the proposed legislation is more punitive than EU regulations, which harm investments," said Lartease Tiffith, EVP of public policy for IAB. "In an effort to ‘rein in Big Tech,’ Congress is stumbling down the same path, despite the consequences to small businesses and a vital industry."▪️

Congress took another step Thursday (June 23) in its years-long process of trying to come up with a bipartisan comprehensive federal data-privacy law, a measure both Democrats and Republicans have said is needed in an online world of ubiquitous movement and use of data.

That step came in a lengthy markup and subsequent “yes” vote on an initial version of the American Data Privacy and Protection Act in the House Energy & Commerce Committee's Consumer Protection subcommittee. The vote approved what both sides signaled was an initial pass at a bill that needs more work.

Democrats and Republicans indicated this latest attempt had the best chance in years of gaining bipartisan support, but all said more work needed to be done. The decision to advance the bill was more about signaling that all were willing to continue to work on it than that it had reached even its approximate final form.

The legislation was approved and favorably referred to the full committee by voice vote with no audible nays to be heard. It has already seen various changes since the initial draft, changes reflected in the bill which was approved as an Amendment in the Nature of a Substitute (which committee members shorthand to “AINS”) to the original draft.

That draft bill was circulated earlier this month. 

There were four amendments offered up to the substitute during the Thursday markup, but all were immediately withdrawn. The idea behind offering them was to make various points about what their sponsors felt needed to be changed in the bill. They were withdrawn so the bill could continue the process of change, which will come in negotiations between now and a markup/vote in the full committee, and also between that vote and a full House vote if necessary.

Rep. Kelly Armstrong (R-N.D.) offered and withdrew three of the four amendments. His issues were with what he said was an insufficiently clear preemption of state laws, raising the possibility privacy violators could face multiple lawsuits.

Armstrong said he was concerned courts will read the bill's numerous exemptions from state law preemptions as the effective absence of state law preemption altogether. Some courts view carveouts from preemptions as fatal to the overall preemption clause because it clouds Congress' intent and those courts default to preserving all relevant state laws, he said.

Rep. Armstrong said the bill as currently written could subject a covered entity to multiple enforcement actions — federal, state and private rights of action— on the same prohibited conduct.

The other amendment offered to make a point and signal further negotiation was from Rep. Debbie Lesko (R-Ariz.). It related to what she said was Big Tech's discrimination based on political viewpoint, both Republican and Democrat.

Among many other things, the bill as approved by the subcommittee would allow web users to opt out of “targeted advertising” when surfing the web, whose free content has been supported by such ads.

Also: Privacy Bill Allows for Turning Off Targeted Advertising

The Information Technology Industry Council (ITI) has told Congress that while it thought the legislators were on the right track, the bill's definition of “targeted advertising” would “prevent the ad-supported internet business model from continuing.”

Since 2019, ITI, whose members include some of the most-affected edge providers — Amazon, Apple, Google, Meta (formerly Facebook) and Twitter — has been arguing that it is part of the solution to data privacy, offering up what it says is a legislative roadmap for a federal privacy law. ▪️

“For years, the technology sector has called on Congress to enact comprehensive federal privacy legislation that builds mutual trust, protects consumers, and supports continued innovation,” said John Miller, ITI SVP of policy and general counsel of the subcommittee's vote Thursday. “Today we are one step closer to that reality. While the bill in its revised form represents tangible progress, and we appreciate the Subcommittee’s efforts to address critical issues we and others raised, more work remains to recalibrate this measure before it is enshrined as a national privacy standard. We commend the Subcommittee for advancing this important effort and look forward to continuing to constructively engage with policymakers as the bill moves forward.”

Witness John Miller, senior VP of policy and general counsel for the Information Technology Industry Council (ITI), told Congress Tuesday (June 14) that it was on the right track, sort of, with the bipartisan federal privacy bill's definition of "targeted advertising" but it would "prevent the ad-supported internet business model from continuing."

ITI members include Amazon, Apple, Google, Meta (formerly Facebook), and Twitter, to name only a few.

The American Data Privacy and Protection Act would allow users to opt out of that "targeted advertising" when surfing the web, whose free content has been supported by such ads.

Miller said everyone agrees privacy legislation is needed -- one reason is so that states do not come up with their own patchwork of privacy laws, a model Miller called "unsustainable."

Also: IAB Tech Lab Launches GPP Global Ad Privacy Permissions Standard

But Miller did point to state laws in Virginia, Colorado and Utah for their definitions of targeted advertising, saying the draft would be better if it more closely followed those states, which he said "struck the right balance to enable internet companies to reasonably advertise to their users on their sites while protecting their privacy interests.”

While Miller said the draft bill deserves thoughtful consideration and is "the most credible bipartisan and bicameral effort yet to advance comprehensive federal privacy legislation in the United States," ITI has a lot of issues with it.

In addition to the definition of targeted advertising, ITI said the definition of "sensitive covered data" is overly broad. The definition of what qualifies as sensitive info deserving of special protection has been one of the major sticking points of past attempts to achieve bipartisan consensus on a way forward.

ITI also said the bill does not distinguish sufficiently between the different entities that use data or their obligations regarding its privacy.

Edge providers also have an issue with the bill's private right of action, which allows users to sue for violations of data privacy. ITI said that given the "already strong" enforcement by the Federal Trade Commission and Justice Department provisions in the draft, "it is reasonable to ask whether including a Private Right of Action is necessary to ensure robust enforcement."

While the private right of action has been narrowed, ITI said it is still too broad and will likely lead to a "wave of litigation."

Committee Chairman Frank Pallone (D-N.J.) suggested in his opening statement that Big Tech was essentially the problem that needed fixing.

"Comprehensive, national privacy legislation is necessary to limit the excesses of Big Tech and ensure Americans can safely navigate the digital world," Pallone said. "There is simply no real “choice” when consumers must trade their personal data to use essential services. People cannot navigate the modern world without their smartphone or email address. And with the minimal protections that apply today, most Americans have little reason to think their data won’t be used in unanticipated ways."

Since 2019, ITI has been arguing it is part of the solution, offering up what it says is a legislative roadmap for a federal privacy law. ■

The discussion draft of a bipartisan data privacy bill has been circulated that would allow web users to "turn off" targeted advertising and take other steps to secure data privacy and protection.

The draft bill, which was unveiled Friday, is billed as the first such effort that has gotten bipartisan and bicameral (House and Senate) buy-in and one which requires "regulatory parity across the internet ecosystem."

The draft was circulated by Reps. Frank Pallone (D-N.J.) and Cathy McMorris Rodgers (R-Wash.), the chair and ranking members, respectively, of the House Energy & Commerce Committee, as well as Sen. Roger Wicker (R-Miss.), ranking member of the Senate Commerce Committee.

Absent from the list of the draft's backers was Sen. Maria Cantwell (D-Wash.), chair of the Senate Commerce Committee, which was billed as from  "House and Senate leaders."

In a statement, Cantwell signaled she had more than a few issues with the bill. 

 “For American consumers to have meaningful privacy protection, we need a strong federal law that is not riddled with enforcement loopholes," she said. "Consumers deserve the ability to protect their rights on day one, not four years later [The bill provides a private right of action for violations, meaning users can sue, but only beginning four years after enactment of the act]. Americans also deserve a law that imposes a duty of loyalty on the companies that collect and monetize personal data so that the companies cannot abuse that data.”

The trio of draft backers did single out Consumer Protection Subcommittee Chair Jan Schakowsky (D-I..), ranking member Gus Bilirakis (R-Fla.), and "numerous members of the Senate Commerce Committee" for their leadership on the draft.

Also: IAB Tech Lab Launches GPP Global Ad Privacy Permissions Standard

On the targeted advertising front, the bill would require that consumers be given a "clear and conspicuous means" of opting out of such ads "prior to any targeted advertising and at all times afterwards."

It would also prevent targeted advertising to anyone under 17 if a covered entity has "actual knowledge" that the individual is 16 or younger. Those entities are also prevented from transferring covered data from anyone 13-17 to third parties without express consent.

To make sure that the government is paying close attention to how young people are being marketed online, the bill would create a Youth Privacy and Marketing Division at the Federal Trade Commission that "shall be responsible for addressing privacy and marketing concerns with respect to children and minors." The division will have to submit annual reports to Congress and add on-staff experts in "youth
development, data protection, digital advertising, and data analytics."

Other highlights of the draft:

The bill prevents the collection or use of data in a way that discriminates against anyone based on "race, color, religion, national origin, gender, sexual orientation, or disability."

The bill requires data minimization on the front end, so no more data is collected than necessary for an allowable use.

The bill creates a generally opt-out data collection regime, except for certain sensitive data, for which users must give their permission first (opt in).

“We appreciate the bipartisan momentum in the U.S. Congress to advance U.S. privacy protections and look forward to reviewing the specifics of the draft bill released today,” said ITI: The Information Technology Industry Council President Jason Oxman following the draft's release. “For years, ITI has urged U.S. policymakers to enact a comprehensive federal privacy law that builds mutual trust, protects consumers, and supports continued innovation, and we will evaluate the bill with those objectives in mind.” ■

A bipartisan quartet of state attorneys general -- from Texas, Indiana and both Washingtons (the state and the District of Columbia) -- are suing Google over location data privacy and its use in targeted advertising.

The AGs argue that Google misled consumers by tracking their locations even when they believed they had disabled that feature, then using the data for targeted ads, to the "enormous" enrichment of the online platform.

"Google provides a setting called 'Location History' and tells users that, if they turn it off, 'the places you go are no longer stored," said the Texas AG's office. "In spite of this assurance, Google continues to track users’ location through other settings and methods that it fails to adequately disclose."

Also: Sen. Blumenthal Says Google, Bing Must Drop Suicide Site

Sen. Richard Blumenthal (D-Conn.), who has been on Google's case about alleged misuse of location data since at least 2017, including asking the Federal Trade Commission to investigate, signaled it was about time.

“The stunning allegations in this bipartisan suit by four attorneys general show, yet again, that tech companies continue to mislead, deceive, and prioritize profits over protecting user privacy," he said. "I’ve long raised alarm over Google’s location data deceptions and Big Tech’s lies must stop. Congress must urgently meet this moment in the privacy crisis by passing a comprehensive law that provides the privacy protections that Americans need and deserve.”

According to a copy of the Texas suit, the AG's are telling the courts that Google "has systematically misled, deceived, and withheld material facts from users in Texas about how their location is tracked and used and how to stop Google from monetizing their movements. More to the point, while many Texans may reasonably believe they have disabled the tracking of their location, the reality is that Google has
been hard at work behind the scenes logging their movements in a data store Google calls “Footprints.” But while footprints generally fade, Google ensures that the location information it stores about Texans is not so easily erased." ■

The Federal Trade Commission has been almost exclusively an enforcement agency, but under new chair Lina Khan it is looking at coming up with new rules to address what Khan calls "lax security practices, data privacy abuses and algorithmic decisionmaking that may result in unlawful discrimination."

That is according to a copy of a letter this week to Sen. Richard Blumenthal (D-Conn.), who pushed for such a rulemaking.

In her response this week. Khan said that given the urgency of the issues Blumenthal identified (see below), she believes the FTC "must consider deploying its full set of tools, including rulemaking."

And that consideration is more than just contemplation.

"The Commission is considering initiating a rulemaking under section 18 of the FTC Act* to address lax security practices, data privacy abuses, and algorithmic decision-making that may result in unlawful discrimination," she told Blumenthal. "Rulemaking may prove a useful tool to address the breadth of challenges and harms that can result from commercial surveillance and other data practices. Critically, rules could establish clear market-wide requirements and address potential harms on a broader scale."

Also: FTC Asked to Ban Surveillance Advertising

Back in September, Blumenthal wrote Khan asking her to begin a rulemaking process to "protect consumer privacy, promote civil rights, and set clear safeguards on the collection and use of personal data in the digital economy."

Part of that is in recognition of the fact that there is no percentage in waiting around for Congress to pass comprehensive national privacy legislation, which almost everybody seems to agree is needed but on which the specifics--what is defined as personal data and whether it is an opt-in or opt-out regime--Republicans and Democrats cannot agree.

Or as Blumenthal put it in the letter: "As Congress continues to develop national privacy legislation, FTC action on this front will ensure that Americans have every tool at their disposal to protect their privacy in today’s online marketplace."

Blumenthal slammed Big Tech in his letter to Khan, saying those companies had used "unchecked" access to personal info to protect their market position from startups and force consumers to live with "continuous data breaches and security lapses that compromise their intimate personal records." And for communities of color, he said, social media was responsible or new forms of discrimination and a market that "punishes companies for protecting and respecting users."

* Under Sec. 18 of the FTC Act, the commission is empowered to issue rules that specify the acts or practices that are unfair or deceptive. ■

A pair of House Energy & Commerce Committee Republicans on Tuesday (Nov. 3) unveiled a discussion draft of national privacy legislation, the Control Our Data Act, which would establish a “national privacy standard,” and they are drafting every GOP member of the Consumer Protection Subcommittee to work on it.

Also read: New Federal Data Privacy Bill Introduced

For the legislation to go anywhere, they will have to get buy-in from Democrats who control the committee and the House, though given how long it would take for a comprehensive bill to make it to a vote in either House or Senate, the Republicans may be hoping that by that time the 2022 midterms voters may have given them the upper hand and control of committees.

House E&C ranking member Cathy McMorris Rodgers (R-Wash.) and Consumer Protection ranking member Gus Bilirakis (R-Fla.), who teamed on the draft, said that, guided by four main principles, the bill will set clear rules for consumer privacy and data security, hot button issues in Washington as both sides of the aisle hammer Big Tech over its handling, or mishandling, of both.

The principles:

1.) “The internet does not stop at state lines, so why should one state set the standard for the rest of the country? Creating arbitrary barriers to the internet may result in different options, opportunities, and experiences online based on where you live.

2.) “A lack of transparency has led to where we are today and any federal bill must ensure people understand how their information is collected, used, and shared. We must also ensure that companies who misuse personal information must be held sufficiently accountable.

3.)”Any federal bill must ensure companies are implementing reasonable measures to protect people’s personal information.

4.) “We must also protect small businesses and innovation. We know that in Europe, investments in startups are down more than 40% since their data protection and privacy law — the General Data Protection Regulation — went into effect. We must guard against a similar situation here. We want small businesses hiring coders and engineers, not lawyers. 

The GOP member marching orders are as follows:

• Bilirakis will focus on creating a Bureau of Consumer Privacy and Data Security within the Federal Trade Commission;

• Rep. Fred Upton of Michigan will focus on how to define the legitimate purpose is defined for the use and retention of consumer data is handled so as not to become a cybersecurity target;

• Rep. Bob Latta of Ohio will focus on the need for a standard that avoids conflicting regulations and allows for proper third-party data sharing;

• Rep. Brett Guthrie of Kentucky will handle risk assessment and mitigation techniques like blockchain to protect consumer data;

• Rep. Larry Bucshon of Indiana will deal with privacy by design, that design being reasonable policies for collecting, using and sharing data;

• Rep. Neal Dunn of Florida will focus on data security;

• Rep. Debbie Lesko of Arizona will handle categories of sensitive information and anti-discrimination policies;

• Rep. Greg Pence of Indiana will work on the definition of small and midsized entities as well as the definition of personal information, which has been a huge sticking point between Republicans and Democrats;

• Rep. Kelly Armstrong of North Dakota will focus on the proper use of the FTC's enforcement authority, collaboration with state attorneys general, self regulatory guidelines and safe harbors.

“Today’s announcement from Reps. McMorris Rodgers and Bilirakis is the latest reminder that there is broad support to enact comprehensive data privacy legislation in Congress,” said Privacy for America, a coalition of advertising industry groups pushing for federal privacy legislation. “We note that there are significant areas of agreement in proposals advanced by members of both parties on the core principles to protect all Americans. We encourage members of Congress to come together to reach agreement on a framework that will lead to real privacy protections for consumers — no matter where they live — and establish clear rules of the road that allow for the responsible use of data.”

House Energy & Commerce Committee Republican leadership said Thursday (Aug. 19) that they had big issues with the theft of data from T-Mobile, saying Congress has to pass privacy legislation ASAP.

“The T-Mobile data breach is of serious concern. While we have more to learn to determine how this breach happened and its potential wide-ranging consequences, we urge all companies to do everything they can to safeguard and protect American’s personal information," they said in a statement.

"They" were E&C ranking member Cathy McMorris Rodgers (R-Wash.), Communications and Technology Subcommittee ranking member Bob Latta (R-Ohio), and Consumer Protection ranking member Gus Bilirakis (R-Fla.).

They pointed out that last month the committee approved bipartisan legislation to promote cybersecurity information sharing.

That appeared to be a reference to H.R. 4046, the “NTIA Policy and Cybersecurity Coordination Act,” which would authorize the NTIA's Office of Policy Analysis and Development and re-christen it the Office of Policy Development and Cybersecurity.

The office administers the network security information sharing program established by Congress in the Secure and Trusted Communications Act. It passed along with a raft of tech/cybersecurity bills last month.

But they said more needs to be done. "We need to build on that work to protect Americans’ privacy. This breach is yet another example of why Congress must pass a national privacy and data security law. We need strong national standards that ensure industries can innovate, strengthen cybersecurity and data privacy, and keep up with the evolving ways bad actors steal personal information.”

Both Republicans and Democrats have argued for national legislation, but have yet to agree on just what should be in that law.

Rep. Suzan DelBene (D-Wash.) has introduced the Information Transparency and Personal Data Control Act, which would create a federal data privacy law enforced by the Federal Trade Commission. 

Also Read: Senate Commerce Tees Up Federal Privacy Bills

DelBene said a patchwork of different state laws only leads to confusion and that a national standard is necessary to create a uniform set of rights, something various legislators have been trying to do for years.

The FCC, under former Democratic chairman Tom Wheeler, passed privacy rules but Republicans in Congress nullified them.

The DelBene bill would require a user's consent (opt-in) for any collection, storage or sharing of sensitive personal information, and a user could opt out of that collection, storage and sharing of non-sensitive information as well. 

Other bill highlights:

1. Plain English: Requires companies to provide their privacy policies in "plain English." 

2. Disclosure: Increases transparency by requiring companies to disclose if and with whom their personal information will be shared and the purpose of sharing the information. 

3. Preemption: Creates a unified national standard and avoids a patchwork of different privacy standards by preempting conflicting state laws.

4. Enforcement: Gives the Federal Trade Commission (FTC) strong rulemaking authority to keep up with evolving digital trends and the ability to fine bad actors on the first offense. Empowers state attorneys general to also pursue violations if the FTC chooses not to act.

There would have to be at least a biennial third-party "privacy hygiene" audit of any party collecting or storing or sharing sensitive personal information, with a small business exemption from the audit for those collecting, storing, or sharing that information from 250,0000 or fewer individuals per year.

There would also be no opt-in requirement for the use of either sensitive or non-sensitive info to detect or prevent fraud, theft, other criminal activity; protecting the "vital interests" of a consumer; responding to a "valid legal process"; monitoring criminal activity if agreed to beforehand by the individual; protecting property against unauthorized access; advancing a substantial public interest including for archival or scientific or historical or public health reasons; authorized uses for credit reporting; completing a transaction to provide a good or service requested by a consumer; complying with federal, state or local laws; and conducting product recalls and servicing warranties.

Also Read: CCPA Enforcement Begins without Final Rules

The bill would give the Federal Trade Commission the authority to enforce the privacy laws irrespective of the limitations in the Federal Trade Commission Act on its authority over common carriers, to which the new law applies.

Media buyer GroupM said it has collaborated with Unilever to create a Data Ethics Compass, an online tool to help evaluate the risk involved with using data assets to target consumer with marketing campaigns.

The tool is used when campaign are being planned to judge the appropriateness of using data, based on, among other things, who the data is collected, and also to consider whether consumers might feel that the way the data is being used is “creepy.”

Also Read: GroupM Brand Safety Report Looks at CTV

The Compass takes into consideration where the campaign will run, where the advertiser and agency is located and the category in which the client competes.

“Our Data Ethics Compass provides clients a consistent approach on how best to navigate ethical risk and prioritize and respect the privacy of people on the other side of the screen,” said Krystal Olivieri, GroupM’s Global senior VP for data strategy and partnerships. “This new capability demonstrates GroupM’s belief that even though you have access to certain data, it doesn’t mean you should always use it. We have an obligation as an industry to re-establish an appropriate balance.”

Also Read: GroupM Starts Addressable TV Ad Company in Canada

The compass is designed to highlight concerns the agency and its client might want to address before launching campaigns employing data using a continuum ranging from green and yellow, which would indicate low to acceptable risk, to orange and red, warning of potential problems.

“Creating a responsible digital ecosystem continues to be a priority for Unilever and adding an ethical overlay for use of data in media is a key next step,” said Jennifer Gardiner, Unilever’s senior director of media. “Consumers are growing increasingly distrustful of advertising and lack clarity in how their data is being collected and used in profiling tactics. Our partnership with GroupM on the launch of this much-needed tool sends a reassuring and bold signal that we must all hold ourselves, our partners and agencies to the highest standards, truly putting consumers first.”

As more marketers adopt advanced advertising approaches, including addressable advertising the use of data because more integral to the process. Marketers and media companies want to use the data to make advertising more engaging and improve the media experience for consumers. But privacy is also also a concern among consumers and violating a customers trust could lead to severe consequences.

“The burgeoning of privacy protection laws around the world reflects the widespread consumer demand to have the interests of the individual paramount in considerations concerning data usage,” said Nicola McCormic, general conceal at GroupM. "With ethics ranking three times more important to company trust than competence, binary decisions taken on whether data is ‘opted in’ or not are no longer sustainable in our industry. GroupM’s Data Ethics Compass enables us to think more holistically about data use and the impact on the end-user.”

A pair of websites have settled with the Federal Trade Commission over complaints that they failed to provide sufficient data security. 

FTC Chairman Joe Simons has assured legislators the agency will be a forceful enforcer of online privacy and data security. 

Settling with the agency were online rewards website ClixSense and games website i-Dressup.com, which agreed to settle the FTC's charges that they both failed to provide reasonable data security, which led to respective breaches by hackers.   

The FTC said i-Dressup.com violated the Children's Online Privacy Protection Act (COPPA) by "failing to obtain parental consent before collecting personal information from children under 13 and failing to provide reasonable security for the data i-Dressup collected." 

As a result, a hacker got access to approximately 2.1 million users, including almost a quarter million who identified themselves as under 13. 

ClixSense was accused of false and deceptive conduct for its cybersecurity claims when, instead, said the FTC, "ClixSense failed to implement minimal data security measures and stored personal information in clear text with no encryption." 

The FTC said ClixSense "allowed hackers to gain access to the company’s network through a browser extension that ClixSense downloaded." The result was that hackers obtained "clear text information regarding 6.6 million consumers, including some 500,000 U.S. consumers." The hackers offered up for sale the personal information of 2.7 million people, including "full names and physical addresses, dates of birth, gender, answers to security questions, email addresses and passwords, as well as hundreds of Social Security numbers." 

I-Dressup.com will have to pay $35,000 and promise not to violate COPPA again.

ClixSense, and its operator, James V. Grago Jr., have to not misrepresent the site's security anymore--or any other business Grago operators--plus take steps to beef up that security. The votes to settle the complaints were 5-0. 

"All of our infrastructures are starting to look very similar," said NCTA executive VP James Assey during the first panel discussion of the Free State Foundation's 11th annual telecom policy forum in Washington (agenda) on Tuesday (March 26). His remark set the stage for much the day's perspective -- if not for total consensus -- throughout the day as industry and academic experts plus federal officials examined the need for new regulatory policies in an era of converging technologies, competing platform players and urgent privacy and security demands.

Assey also said that current conditions, including the emerging role of 5G wireless technology, augur the need to revise "Title VI" (rules in the 1984 Cable Communications Policy Act) that may no longer be valid.

"That type of hybrid architecture requires greater similarity" in policies, Assey said. "Any future approach to spectrum needs more coordination. Congress could speed that change."

Expanding his remarks to include the growing presence of platforms -- that is, non-telecom providers, such as Google and Apple -- Assey insisted that, "We're very confident in our path...and on keeping focused."

Fellow panelist Kathleen Ham, senior VP, government affairs at T-Mobile USA, endorsed Assey's view.

"We're at a crossroads," she said. "There's definitely a convergence going between cable and wireless," and in a predictable puff about the next generation wireless service, she added, "We don't know what 5G will bring, but it's going to be good." She acknowledged that new competitive policy-making should be part of the legislative agenda.

Further supporting the need to prepare for the shifting environment, Verizon senior VP Kathleen Grillo focused on her "concern" about state laws on platform accountability as well as rules on privacy and issues such as 5G tower siting that are "confusing for consumers." She stressed that such complications underscore the "value of a national framework."

An FSF panel of academic experts further set the stage for new policies, which also happened to be the subtitle for FSF's seminar: "Getting Law and Policy Right."

"The distinction between the web and the edge are becoming indistinct," said University of Pennsylvania Law Professor Christopher Yoo, noting that it is "harder to justify net neutrality," and proposing that a future evaluation will involve "device neutrality."

FCC's O'Rielly and FTC's Simons Weigh In

FCC commissioner Michael O'Rielly agreed that the policy "structure should be changed."

"How we define the marketplace is so important in the video space," he said, emphasizing that this is no longer "just about cable, broadcast or satellite.

"Many of the FAANGs are fighting for the same space," O'Rielly said, using the popular acronym for Facebook, Apple, Amazon, Netflix and Google. "The silos we've lived with for so long are no longer appropriate. We have to take that to the legislature. Title VI no longer makes any sense."

In an on-stage dialogue with former Congressman (and retired Verizon lobbyist) Tom Tauke, O'Rielly also said that he is not "squeamish" about pre-empting state or local regulations on issues such as wireless tower siting or other factors.

"Absolutely not," he said. "Wireless spectrum does not respect [local] boundaries. The internet is interstate in nature, and I'm willing to preempt" whatever is necessary.

Federal Trade Commission chairman Joseph Simons, in the concluding keynote of the FSF program, focused on paid prioritization and the FTC's newly launched data handling review of internet service providers, which was unveiled that day.

"Paid prioritization is a type of price discrimination, which is ubiquitous in the economy" and not illegal, Simons said. He cited loyalty cards, coupons, senior discounts and frequent shopper deals as comparable legal price preferences.

But he warned that the FTC "could take action against ISPs if they block applications without adequately disclosing those practices or mislead[ing] consumers about what applications they block or how."

"Our consumer protection authority could also apply to throttling," Simons added. "We would consider whether the alleged throttling had countervailing benefits, and whether there were reasonable steps consumers could have taken to avoid it."

Simons also joined the call to seek more direction from Congress on how to handle privacy and data security issues.

"I have urged Congress to enact legislation that would give the FTC three tools," he told the FSF audience, citing civil penalties for privacy and data security violations; targeted rulemaking authority involving technological developments; and jurisdiction over nonprofits and common carriers.

"The process of enacting federal privacy legislation will involve difficult policy tradeoffs that I believe are appropriately left to Congress," Simons said.

As for its latest enforcement of ISP privacy practices, he said the focus will be on how ISPs are collecting, using, combining and disclosing personal information about consumers that they collect via fixed and mobile internet, advertising platforms and analytical services.

Simon's remarks summarized an underlying theme of the FSF conference: the growing recognition that converging technologies and overlapping services require a new approach to regulatory policies.

"Laws and regulations intended to promote privacy may build protective moats around large companies ... making it more difficult for smaller companies to grow, for new companies to enter the market, and for innovation to occur," Federal Trade Commissioner Noah Phillips told the Internet Governance Forum USA conference in Washington on July 27. 

Phillips indicated that communications and technology companies, "some of which already possess significant amounts of data about people," will be of special interest when the FTC begins its extensive probe into privacy and other digital business practices starting in September.

"Competition must be part of ... our conversation about privacy," said the new commissioner in one of his first the public presentations since taking a Republican seat at the FTC in May. Echoing the words of FTC chair Joseph Simons, who also was sworn in two months ago, Phillips warned that, “If you do privacy in the wrong way ... you might end up reducing competition. You might create a situation in which you entrench the large tech platforms [and] make it very difficult for ... new entrants and smaller firms to get the attention of the consumers that they’re trying to reach.”

Related: Trump Taps Simons for FTC Chair

Phillips's prepared remarks were laden with objectives from both sides of the regulatory spectrum, ranging from pro-business protections to concerns that lobbying by incumbent technology providers could shut out innovative upstarts. Citing arguments about the risks inherent in “leveling the playing field” among firms doing different things with different kinds of data makes sense, Phillips insisted.

"We do not want the regulatory burden to be so onerous that it excludes potential market entrants or inhibits innovation," he said.

But Phillips also emphasized the "brand effect" advantage that big companies have in the marketplace, because consumers "are likely to trust the companies they know." That leads to "another, more insidious, effect that any regulatory regime can have: Large companies can manipulate legal requirements to their own benefit more easily than smaller competitors or new entrants."

"The benefit to incumbents is not just lobbying for laws that favor them; it is also implementing seemingly neutral laws or regulations in ways that benefit them at the expense of their would-be competitors," Phillips added.

Phillips' focus on privacy reinforced the opening keynote that morning by David Redl, assistant Secretary of Commerce for Communications and Information, and head of the National Telecommunications and Information Administration.

"We will be looking to strike a balance between prosperity and privacy that is in line with American values – and we’re listening to a broad cross-section of stakeholders to find that balance," Redl said. 

Redl cited NTIA's plan to publish the high-level principles along with a Request for Comment in order to "begin engagement on how to move forward to reach the goals set out in the document." He did not specify a timetable for this process.

Redl also summarized NTIA's cybersecurity and ongoing Intellectual Property projects, including its triennial review process under the Digital Millennium Copyright Act.

Learning from Europe's GDPR

Acknowledging the kerfuffle about Europe's recently imposed General Data Protection Regulation (GDPR), Phillips contended that for Europeans, it represents an expression in law of their view that the protection of personal data is a fundamental right.

"For the U.S., it may provide a test case for how a different privacy regime than our own might work," the FTC commissioner continued. "My concern is that early signs point to precisely the effects on competition that I fear." 

Phillips said that as U.S. regulators consider the potential benefits of new privacy protection, "We must consider the costs, too, on competition and innovation."

"GDPR provides us with a great opportunity to see how a large-scale privacy regime works in practice, and for us in the United States to learn from Europe’s experience."

Related: Sen. Blumenthal Preps U.S. Version of EU Privacy Framework

Phillips also used the IGF-USA platform to plug the FTC's multi-day, multi-part hearings that will explore privacy and other "broad-based changes" in the economy. The FTC expects its hearings, announced last month, to consist of up to 20 sessions from September through January 2019. Topics will include evolving business practices, new technologies and international developments that "might require adjustments to competition and consumer protection enforcement law, enforcement priorities, and policy."

In announcing the comprehensive investigation, the FTC said it seeks initial input by Aug. 20 on factors such as the competitive effects of corporate acquisitions and mergers and analyses of monopsony power. It also invited comments about the role of intellectual property and competition policy in promoting innovation and implications about the use of big data, artificial intelligence and predictive analytics.

Twitter took, naturally, to Twitter to announce that it will shut down its TV apps for three platforms – Roku, Android TV and Xbox – on May 24.

Related: Disney to Develop Shows for Twitter

Twitter didn’t elaborate on the reason in a tweet announcing the decision, but reports are that it’s shutting them down as it works on tweaks to ensure they are compliant with the European Union’s General Data Protection Regulation (GDPR), when it takes effect May 25. For now, Twitter’s apps for Apple TV and Amazon Fire TV will continue.

[embed]https://twitter.com/TwitterSupport/status/998956840674193409[/embed]

TechCrunch said other factors contributed to the decision, including a lack support a “standard regular supported video player” on Roku and Xbox and that Twitter’s been trying to move more of its base to first-party mobile apps and its desktop website.

Still, the decision to cut back support for a set of TV-connected platforms so it can focus on compliance with the new data privacy law in Europe also arrives as social networking giant continues to carve out content deals with dozens of content programmers, including NBCU, ESPN, Viacom and Hearst. 

"We need comprehensive privacy legislation and real net neutrality legislation enacted at the federal level now, not later, and the CRA vote just delays that and gives members of Congress an easy out." -Mike Montgomery, CALinnovates

Nearly every day brings new stories of children being tracked, Russians being indicted, and online-fueled hate exploding into real-world violence – all while the big tech platforms that enable this chaos report record earnings and shrug off Congressional oversight without breaking a sweat.

The internet has never been more vital to our lives, our culture and our economy, but it has never been more out of balance.

The American people are demanding comprehensive action to rein in these giant platforms, protect our privacy and permanently keep cyberspace open and free – with 80% believing the big platforms haven’t done enough to secure their networks. Nearly 60% are concerned the government won’t do enough to solve the problem. Yet, amazingly, the only internet bill on the agenda in Congress is a backward-looking resolution that will actually reduce our privacy protections.

The resolution is called the “CRA” (for Congressional Review Act), and it’s being pitched as a way to protect net neutrality. But that’s a complete charade. We need comprehensive privacy legislation and real net neutrality legislation enacted at the federal level now, not later, and the CRA vote just delays that and gives members of Congress an easy out instead of pushing them to draft, debate and support real, bipartisan, pro-consumer legislation.

The CRA doesn’t enact any permanent net neutrality protections. It also does nothing to protect our privacy, secure the internet from Russian bots or election attacks, bring accountability to all tech platforms across the board, or boost innovation and ensure competition.

All the CRA would do if it passed (something that itself is extremely unlikely in a Republican Congress) is temporarily restore an old and out-of-date version of net neutrality that applies to broadband providers only and then send the entire issue back to the Federal Communications Commission, where anything could happen – including reversal of even those limited rules.

And worse, in the process, the CRA would strip away one of the key internet privacy protections Americans currently enjoy. Right now, the Federal Trade Commission is the lead privacy cop for the big cable and telecom companies. It protects Americans from unfair and deceptive practices online, including breaches of privacy policies and other abuses of our data. This is why the Obama Administration made “strong enforcement by the Federal Trade Commission” the centerpiece of its Consumer Privacy Bill of Rights in 2012.

But the CRA would eliminate the FTC’s jurisdiction over internet providers – creating a privacy gap when more data protection, not less, is necessary.

Congress has an enormous opportunity in front of it. There is wide, bipartisan agreement that we need new, stronger rules of the road for the entire internet – tech platforms, broadband providers, and any entity collecting and using consumer data.

The recent Facebook hearings had members of both parties demanding accountability and calling for solutions. One Representative from a district decimated by online opioid sales put it most directly, saying, “Facebook is actually enabling an illegal activity, and in so doing you are hurting people.”

It’s not often the stars align in this way – and it would be a dereliction for Congress to squander this chance for real progress in favor of an empty, feel-good CRA.

Instead, Congress should be driving toward comprehensive legislation to strengthen our privacy; make net neutrality permanent; apply it to all companies that pick and choose what we can see and do online; and require real cybersecurity and data protection that includes strong penalties for companies that breach our trust.

That’s the kind of vote a woke Congress would take.

Mike Montgomery is the executive director of CALinnovates, a technology advocacy organization.

Cyber-attacks on "critical infrastructure" and theft or espionage involving commercial intellectual property remain the top concerns of the global cybersecurity community, Robert L. Strayer, Deputy Assistant Secretary for Cyber and International Communications and Information Policy at the U.S. Department of State said Thursday (April 19).

In remarks at the Media Institute's monthly luncheon in Washington, Strayer emphasized, "No business is unaffected by cybertheft" and warned that "we will continue to see threats to the digital ecosystem."   

Strayer declined, when asked by MCN, to specify media or telecom operators, including cable TV, as part of the "critical infrastructure." But he acknowledged that the U.S. Department of Homeland Security and other federal agencies are constantly examining ways to foil "bad actors" who could disrupt or hack into the operations of American companies.

He said U.S. and global partners "have to think of all the misuses" of cyber systems. He emphasized the growing role of the digital economy and noted that international groups such as the G7 and G20 nations "are increasingly looking at technology issues" such as blockchain, that are affecting traditional global systems.

"As we look around the world, we want to assure an open flow of data," Strayer said, but at the same time "it is absolutely critical to preserve a decentralized model." He emphasized that many countries want to regulate the internet, but that U.S. policy will continue to "push back against that." 

Strayer acknowledged that in the U .S. and most democracies, the digital infrastructure is in the hands of the private sector.

"We should not expect companies to operate in cyberspace any differently" than they do in conventional environments, Strayer said, but he warned that the task - including public/private collaboration - may be very challenging.

New cybersecurity standards will be "voluntary," he said, adding that "industry is driving the solution." He cited the need "to achieve maximum economic value" as companies battle cyberattacks.

Strayer cited Europe's "General Data Protection Regulation (GDPR)" that goes into effect on May 25, restricting many ecommerce and digital media practices in an effort to assure consumer privacy. He did not offer an opinion about whether such restraints may eventually emerge in the U.S., especially amid the current furor over activities at Facebook, Google and other companies that collect personal data.

He focused, instead, on ways that federal enforcement agencies are developing systems "to improve our defenses" and create a "cyber-posture" to fight cybercrimes. He said that systems are now "so interconnected that these threats can race around the world" almost instantly.

To battle such scourges, Strayer explained that the State Department and other U.S. agencies have about 150 "digital economy officers" at embassies and other locations worldwide to identify potential cybercrimes and to development enforcement tactics, often in collaboration with host countries.

Strayer also cited forecasts that estimate about 200,000 people will be needed to handle America's cybersecurity requirements in the coming years - a significant job creation stimulant.

“Today, data needs to be extremely specific and clean — vetted, collected and shared in a privacy-conscious and ethical manner.” —Allison Metcalfe, LiveRamp

The TV industry has been struggling to bridge the gap between traditional linear TV and digital channels. On one hand, traditional linear TV has grappled with cross-device viewership, loss of perceived value compared to digital slow-to-measure campaign reporting, and an ongoing battle against the immediacy of digital. There’s also the growing number of cord-cutters that threaten its very existence.

On the other hand, there is digital, a leading medium for content consumption, but not devoid of its own challenges — fraud, transparency and flawed last-click attribution among them. To say the industry is at a crossroads would be an understatement. Brands often react prematurely by de-prioritizing television, or they try to simply swap dollars and strategies between TV and digital, which underscores the massive convergence between the two.

That’s where advanced TV comes in.

The era of advanced TV means that TV and digital are no longer mutually exclusive. Further, advanced TV is seemingly the best of both worlds. In theory, better data and technology will enable TV to not only regain its rightful position in the marketing ecosystem, but it should actually help the medium grow.

Solving for the Data Equation

In 2017, transparency became table stakes; That is, it was universally demanded by consumers. As a result, brand reputation emerged as a key concern for advertisers and marketers hoping to foster long-term trust and loyalty. Advertisers now need to be able to understand the sourcing and methodology of a target segment to ensure that it is compliant with relevant laws and best practices; and they need to put up proverbial “guardrails” with regard to data quality, which is no easy feat, given the proliferation of third-party data flooding the marketplace. There is no single-source currency, and many data sets are anonymous or come from digital, which means they must be modeled prior to use for targeting or measurement in TV, which is subject to different governmental regulations and consumer expectations.

Today, data needs to be extremely specific and clean — vetted, collected and shared in a privacy-conscious and ethical manner. Access to clean, proven data is the first challenge that the industry is working to address as TV advertising evolves.

Digital and TV: Working Together

The second challenge is clearly outlining the similarities and differences that exist between the TV and digital ecosystems. By doing this, brands and marketers will be able to solve current growing pains related to tracking viewership and cross-screen strategies. Informed with these critical considerations, marketers can begin to quickly and effectively implement identity solutions to make smarter targeting decisions that deliver measurable impact. And although change can be uncomfortable, multichannel video programming distributors, programmers, agencies and brands can all agree on one thing: the fundamental need to follow viewers wherever they consume content. Industry stakeholders — even competitors — are also united by the desire to be “customer obsessed.”

Taking a step back, when advertising budgets are reallocated, TV is typically first on the chopping block. That is because marketers believe they can reinvest those dollars into digital for a greater return-on-ad-spend (ROAS), whether that’s reach, impressions, etc. By the end of last year, headlines screamed about digital finally surpassing TV for the first time. To put this in context: there are tens of thousands of digital advertisers, and a significant amount of impressions are still fraudulent. By point of contrast, the TV ecosystem is underwritten by a few hundred national advertisers, and while there are issues such as skipability and declining viewership, there is no fraud.

The true value of bringing data and technology to TV is better targeting and measurement. Thus, there will be growth within the TV ecosystem itself. It’s about using the best of digital to the benefit of the TV market.

Issues With Fragmentation

The last hurdle to clear is fragmentation, which has proven particularly cumbersome following the rise of cable. It continues to be problematic today as connected/over-the-top (OTT) solutions amplify the issue.

Inevitably, certain players want to create their own Customer Data Platforms, and in the process we risk a future with high walled gardens in addressable TV, akin to what we have in digital.

Some of the discomfort in today’s data-driven TV ecosystem stems from the fact that key players have led measurement standardization to date. Many assume that a shift in measurement and the implementation of more identity solutions in addressable TV metrics needs to be all encompassing.

Resolving the Identity “Crisis”

Layering identity resolution in advanced TV empowers marketers to target individuals or households, in much deeper, relevant and more nuanced ways for a holistic view across the ecosystem.

Connected TV is a cookie-less environment with no device ID, and linear TV is often only able to target at the household level. That’s where people-based measurement fits into the picture.

People-based marketing in the TV ecosystem gives marketers the power to track and tie consistent, anonymous IDs across an entire marketing campaign. For example, a target segment can be built for a digital campaign on desktop and mobile, and then analyzed to show the lift digital had on TV, and the loop that TV advertising closed for digital.

It will be imperative that marketers apply learnings across both channels in order to understand the inherent opportunity and how that will impact ROAS.

Meeting in the Middle

The reality is that change will be steady, and that the market will ultimately reach a state of equilibrium. In the meantime, we need to allow and account for market maturation, and give data-driven TV strategies time to gain adoption, while proactively seeking new technologies and solutions that allow TV to evolve on its own.

Allison Metcalfe is general manager of TV for LiveRamp, an identity resolution provider specializing in people-based marketing.

WASHINGTON — Here are just some of the issues raised last week as the capital and the nation focused on how better to protect online users' data in a world of almost universal collection and sharing. 

If social media sites can't figure out how to self-regulate, or are unable to do so, Washington has made clear it will step in.

Related: Specter of D.C. Crackdown on Edge Looms [subscription required]

• Does there need to be a government digital consumer protection agency with powers to regulate privacy?
• How can social media sites in general balance the need to weed out terrorists, hate speech, and threats of violence without straying into censorship of non-threatening speech?
• Do consumers have a fundamental right to control their online data and can that co-exist with the social media business model?
• How will new European Union General Data Protection Regulations (GDPR) going into effect next month dovetail with U.S. policies? (Facebook, for example, has pledged to provide those data control tools and options to its U.S. users.)
• If social media platforms are expected to police their content, as legislators have made clear, who decides what gets blocked, and how is that decision made?

Related: Pai Says He's Unsure Whether Social Media Benefits Outweigh Downside

• Should the edge be more regulated, or internet service providers be less regulated? Or do both need more “regulatory motivation” to protect privacy?
• Should all the members of the virtuous internet circle be mandated to require opt-in consent from users to collect their data, to share their data, to sell it to third parties, or any or all of the above?
• Who owns and controls our online personas, and what control do we have over them?
• How do Facebook and other social media define hate speech and is there a bias against conservative and religious speech given Silicon Valley's liberal bent?
• How can social media sites protect against being weaponized in election meddling, or is a site like Facebook too big (billions of communications per day) to prevent such weaponization?

Related: Murdoch Says Facebook Should Pay for Trusted News

• Will opt-in restrictions on data sharing with marketers threaten the ad-supported model that allows for free online content, and will that need to be a trade-off for securing users' control over their data?
• Has Facebook become a "self-regulated superstructure for political discourse," and is that a good or bad thing?
• Is there tension, as lawmakers saw it, between the business interests of the edge and users’ interests, or between users' desire to share info with various apps and their desire, on the other hand, to "lock down" that info? Zuckerberg suggested it was more the latter.
• Did the Cambridge Analytica incident violate the 2011 Federal Trade Commission privacy settlement? (If so, then Facebook could face hefty fines.)
• Is Facebook a publisher, a media company, a tech company or some amalgam of all of those?
• If Congress concludes that edge providers should be regulated like a utility, does that mean ISPs will be reclassified under Title II of the Communications Act, alongside websites?

WASHINGTON — Facebook chairman and CEO Mark Zuckerberg was shown the Capitol Hill woodshed last week, and edge providers may never be the same.

“U.S. policymakers were so enamored by Silicon Valley over the last decade that they turned a blind eye to their abuses,” Roslyn Layton, visiting scholar at the American Enterprise Institute, said of what has become a bipartisan push for privacy protections aimed at edge providers.

Related: Law Limits Cable’s Use of Customer Information

Edge providers, which include Facebook, Amazon, Netflix and Google, often referred to as FANG, use a customer’s internet service provider to deliver their service.

But whether they are “abuses” or, as Zuckerberg suggested in his testimony, online tools developed for good but hijacked by the bad guys, the eyes of Washington lawmakers are open and looking toward possible regulation or legislation to give online users — that is, most of us — some degree of control over where our personal data is going and what it is being used for.

Privacy on the Edge: Legislators' Questions

Zuckerberg made clear that Facebook does not sell data to advertisers, but it does depend on targeting ads based on user data to bring in the $40 billion in business it did last year.

Expect to hear the phrase “opt-in” a lot in the coming days, as policymakers try to come up with the best way to give users control of information. Ahead of the hearing, Sens. Ed Markey (D-Mass.) and Richard Blumenthal (D-Conn.) introduced the Privacy Bill of Rights bill with opt-in for everyone.

Opting In to Opt-In

ISPs have said they can live with a regime in which customers pro-actively opt in to share personal info, as long as it applied to companies like Facebook and Google, as well as Comcast and Charter Communications.

Zuckerberg said he also agreed in principle, though he frequently used terms like “generally agree,” “the details matter” or something “useful to discuss” to avoid definitive endorsements of any particular legislative or regulatory approach. He did signal that he thinks regulation is inevitable — likely one reason he was talking not about whether there would be regulation, but making sure it was the “right” regulation.

Zuckerberg tried to draw a distinction between ISPs and the edge — he said it is lack of ISP competition versus choice in platforms — and suggested regulation should take that into account. The Facebook CEO said he certainly did not think of his company as having a monopoly. But he was not getting a lot of agreement from the legislators in attendance, most of whom are on Facebook and rely on it to reach constituents.

Facebook and others are now tasked with figuring out how to make terms of service contracts clearer, another issue that drew a lot of attention last week and multiple calls for transparency.

Related:(Law) Schooling Facebook | Facebook Boosts Political Ad Disclosures

The scrutiny of Zuckerberg from both parties in both houses of Congress certainly felt like the final crash of a drumbeat that has been building, fueled by data breaches, fake news, election meddling and third-party monetization of online information.

ISPs and others have said there needs to be a shift in the attitude of Washington toward the garage innovators that have long since morphed into data-collecting behemoths that threaten privacy like never before.

Reckoning, and Rules, Draw Closer

That day of D.C. reckoning for Facebook and other edge providers seems close at hand, the Facebook chairman’s serial apologies notwithstanding. Perhaps the larger question, in the face of European regulators who have moved much more aggressively, is: Can a Congress so stifled by partisan rancor pass any meaningful legislation soon?

Rep. Jan Schakowsky (D-Ill.) cited a long history of mea culpas, which is why she said self-regulation just won’t work. Those included apologies from 2003, 2006, 2007, 2010, 2011, 2017 and 2018. On the subject of the protections that Zuckerberg said Facebook was supplying users at the point of decision, Schakowsky asked, “Who is going to protect us from Facebook?”

Zuckerberg spent almost 10 hours over two hearings on April 11 and 12 apologizing for breaching the trust of Facebook users, saying the company had taken many steps to correct the problems with data sharing and third-party access to data, and outlined some of the changes it has made. But that rang hollow with many legislators.

They pointed to the company’s 20-year, 2011 consent decree with the Federal Trade Commission, in which it promised to give users notice and opt-in control of sharing of their data with third parties.

Zuckerberg said he did not think that access to data by Cambridge Analytica — the data firm controlled by right-wing donor and President Donald Trump supporter Robert Mercer — in violation of Facebook’s policies violated that decree, but he did say it was a mistake not to inform the FTC about the incident. Reports in The New York Times and U.K. newspapers The Observer and The Guardian cited documents which said Cambridge Analytica used data improperly obtained from Facebook to build voter profiles.

The FTC is currently investigating Facebook over that incident, as are U.K. authorities.

Zuckerberg, sounding like an ISP CEO pitching a voluntary network neutrality regime, argued last week for voluntary measures to address the company’s various issues, like mistakes in taking down conservative and political speech that did not violate its community standards, the weaponization of the platform by foreign election-meddlers, better informing viewers of how their data was being used, and more. But he also did not rule out regulation.

Seeking the Right Rules

Zuckerberg said he was not opposed to new privacy regulations, but that they had to be the “right regulation.” He seemed at least open to the possibility of a law requiring user opt-in permission for sharing their data with third parties, but said the details of such legislation were important.

And while Republicans are generally on the side of voluntary industry initiatives, this issue could be an exception.

Republican Sen. John Kennedy of Louisiana put it bluntly: “Mr. Zuckerberg, I come in peace. I don’t want to vote to have to regulate Facebook. But, by God, I will.”

Rep. Greg Walden (R-Ore.) told Fox News Channel that he wasn’t ruling out calling Twitter and Google to Washington for hearings, and sought input from Zuckerberg as to which other tech CEOs should get an invitation to testify in Washington.

Republicans are especially concerned that the left political leanings of many Silicon Valley executives translate to a bias against conservative views, a point that Zuckerberg conceded was valid. That is why some Republicans are not ready to push Facebook and others to take more control of their online content.

Just how Facebook’s new artificial intelligence algorithms decide what hate speech is, and what news to place in user’s News Feeds, is a topic of ongoing discussion, but only one of many raised by Washington’s new interest in drilling down into the edge business model.

The Facebook CEO told Congress that examples of conservative speech being censored were mistakes that had been corrected. He said mistakes involving liberal speech were also made, but that there was no directive from corporate to weed out any speech based on its politics, only on whether it was hateful or threatening. There, too, Facebook could do a better job, Zuckerberg said.

But “we’ll do better” solutions to problems involving billions of interactions among billions of people are unlikely to stem the tide.

Regulation and legislation are now clearly on the table for the Big Four edge providers — Facebook, Google, Twitter and Amazon — as Americans come to the realization of just how much of their data is being harvested and shared online. There was talk last week about hauling Twitter and Google before Congress as well.

ISPs have been arguing that any legislation or regulation of the ’net needs to include the edge, which makes more money off of, and collects far more data, from users. That argument has clearly found an audience.

If the current climate in Washington is any gauge, the death of privacy is a hot-button issue, and fueling the outrage in this partisan city are details that the Facebook/Cambridge Analytica data-mining issue involved selling the information to the Trump presidential campaign.

But it goes beyond privacy to ad dollars, the ones Facebook and others are attracting with all those billions of eyeballs, and the data being mined and monetized by relatively unregulated edge providers while their broadcast and cable competitors for those ads dollars remain regulated.

The buzz inside and outside D.C. last week over Zuckerberg’s appearance certainly made it seem like a flashpoint in the policy battle between ISPs and edge providers, though the focus was on Web users and their data.

Issue in the Spotlight

News networks blocked out coverage, on-air and online, for Zuckerberg’s testimony. The Open Markets Institute even launched a website to live-stream the hearings, and an #AskZuck digital ad campaign to get the online public to suggest questions that they wanted answered, with representatives of Free Press and the ACLU on hand to provide input as well.

“Facebook is a corporate monopoly whose business model is surveillance and user manipulation,” Open Markets Institute executive director Barry Lynn said. “It is a threat to our democracy.”

The group also launched a petition to express the sentiment that the edge not be let off the hook after the hearing lights were turned off “and Facebook’s lobbyists flood in.” The institute’s advisory board includes Tim Wu, who famously coined the term network neutrality.

That “don’t trust but verify” sentiment was echoed by several legislators during the Zuckerberg hearings as well, though Rep. Billy Long (R-Mo.) warned Congress did only two things well, nothing and overreacting, warning Zuckerberg to expect the latter.

Facebook supporters weren’t waiting until after the hearing to stick up for the social-media site. The Information Technology & Innovation Foundation was trying to head off a stampede toward regulating the edge before Zuckerberg even took the stand. The group, whose board members include representatives of Apple, Twitter, Amazon and Google, said Congress should resist the urge to legislate “how tech companies design their services.”

Instead, it said, “Members of Congress and regulators should hold Facebook accountable for its public commitments and past promises, and ensure that the company [Facebook] continues its transformation into a more responsible corporate citizen.”

Congress has now made privacy an issue, and is unlikely to look away soon.

“Facebook failed us,” Sen. Bill Nelson (D-Fla.), ranking member of the Senate Commerce Committee, said bluntly. That’s something Zuckerberg has all but acknowledged, chalking it up to a young, idealistic company whose growth and reach raced ahead of its ability to address data protection. But to Nelson that sounded more like nails on the chalkboard than chalk.

“Not only did they fail to safeguard the personal information of millions of users, they concealed it from us — and this is not the first time the company mishandled user information,” Nelson said. “Only now are they coming clean and informing those who have had their information compromised and telling us they are going to make things right.”

“The startling consumer abuses by Facebook and other tech giants necessitate swift legislative action rather than overdue apologies and hand-wringing,” Sen. Richard Blumenthal (D-Conn.) said of the need for legislation to give users opt-in control.

Still, not everyone was on the “regulate the edge” bandwagon, particularly in the House, where several members in addition to Long warned of overreacting.

Rep. Greg Walden (R-Ore.), chairman of the House Energy & Commerce Committee, who presided over one of the Zuckerberg hearings last week, told an audience at the NAB Show in Las Vegas earlier last week that the CEO was an incredible innovator. He said he was more in favor of cleaning out the regulatory underbrush so that all flowers could bloom in that landscape of permissionless innovation and light-touch regulation.

Hill Democrats, at least, have fought hard against that approach and refused to take ISPs at their pledges to protect internet privacy and openness, pledges that can be enforced by the Federal Trade Commission. Many of them seemed similarly unwilling to take edge providers at their word, particularly given that litany of past transgressions and apologies.

Putting an extra urgency on U.S. policymakers to figure out how to treat online data collection and privacy is the European Union’s upcoming General Data Protection Regulation, which take effect in May.

“These will likely become the global standard unless the U.S. acts quickly,” Layton said.

Few industries collect more intricate data about a person’s media consumption than cable operators — and few are as highly regulated.

Cable operators, as the conduit by which most of us access entertainment and internet, are privy to reams of customer information ranging from what shows an individual watches, what room in their house they watch it in, the websites they surf and the credit cards they use.

But the industry and the government, perhaps anticipating the onslaught of privacy issues collecting that information could bring, have put in place safeguards to ensure that data is protected.

Related: Specter of D.C. Crackdown Looms Over Edge

The Cable Act of 1996 severely limits what a cable operator can do with the data it obtains. According to Section 661 of the act, a cable operator can use personally identifiable data only to deliver service to that person. It can share that information with a third party only with the prior written consent of the customer, or to comply with a court order.

While that would seem to hamstring operators, they have been able to use the data they glean from customer habits mainly to improve service — like being able to detect and rectify service problems in specific areas of their networks — and to offer additional services. As one operator put it, if they notice a customer isn’t taking phone service from the cable company, or may be downloading content that would warrant a faster internet speed, they can contact that customer directly.

Privacy Pledge

Cable operators have also gone the extra mile. Many, such as Comcast, Cox Communications and Charter Communications, have pledged to never sell personal customer information to third parties. But even with those restrictions, operators can still do a lot with the data.

Most operators are reluctant to talk about how they use the information.

In an email message, Cox spokesman Todd Smith said the cable company, like others, uses personalized data to improve the customer experience.

“We know that when customers interact with us they want it to be efficient and respectful of them and their time,” Smith said in the email message. “We leverage data from interactions to enhance our ongoing efforts to improve the experience. We are specifically doing a lot of work right now to map several what we’re calling Customer Journeys (everything from marketing and order process, to install and promotion rolloffs/renewals). The quality of information we gather during these processes helps us better serve existing and new customers in the future.”

Privacy on the Edge: Legislators' Questions

At Canoe Ventures, the advanced advertising consortium that includes Comcast, Cox and Charter, head of business development, sales and marketing Chris Pizzurro said that while the uses of customer data are many, so are the restrictions.

For example, Pizzurro said MSOs regularly extract household IDs and device IDs from settops and broadband routers, “so the cable operator knows what is going on in your home; making sure the system is running the way it should.”

The operator can also use that information to market its own products and services to customers. But for Canoe, the restraints are tight. Pizzurro said that Canoe can only use customer information like household IDs and device IDs for troubleshooting purposes.

“It’s all very specific and geared toward our service assurance product,” Pizzurro said. “We can’t go out willy-nilly and use it for targeting purposes or other advanced ads things.”

Canoe Ventures, which originally was formed as an interactive advertising vehicle for cable operators, abandoned that tack about five years ago and has mainly concentrated on dynamic ad insertion of video-on-demand streams. That business has picked up considerably in the last half-decade. Pizzurro said five years ago, reaching 1 million ads viewed in a month would be a Holy Grail moment for the company. Today, 1 billion monthly ad views are commonplace.

“We’ve grown 20% quarter over quarter over the last five years,” Pizzurro said. “With all the data that’s flying through the system, we’ve managed to be good stewards and shepherds without incident.”

Pivotal Research Group analyst Brian Wieser said if any new regulation comes out of the Facebook hearings, it will likely be focused on the social-media platform and would probably benefit Google the most. The cable industry would have little to worry about, he added.

“If the entire industry is forced to implement it, you will probably see a deceleration in growth for the overall industry,” Wieser said. “My guess is that Facebook and Google will probably take share. There are going to be some smaller players who won’t justify being in business.”

SIDEBAR | CPNI 101 | by John Eggerton

Cable operators, in the provision of their traditional video service, have long had fairly strict rules about what they can and can’t do with the personal information they collect from subscribers (Customer Propriety Network Information, or CPNI).

According to the Federal Trade Commission, they must provide reasonable access to personal records they retain and provide an opportunity to correct any errors. They also may not disclose any of that information to a third party without “written permission” from their customers.

There are different, but similarly strict, rules regarding voice-over-internet protocol phone service information.

Roku has hit back against a new Consumer Reports study finding that smart TVs from makers such as Samsung, LG Electronics, Sony, Vizio and TCL (which makes a line of Roku-powered TVs) are vulnerable to hackers, holding that they can be broken into to track what viewers are watching.

As USA Today notes, Consumer Reports said it was able to break into a TCL/Roku TV using a feature that Roku developed that enables remote use of a remote control on other platforms, including smartphones.

"What we found most disturbing about this, was the relative simplicity of," how easy it was to hack those products, Glenn Derene, Consumer Reports' senior director of content, told the publication.

Gary Ellison, Roku’s VP of trust engineering, posted a blog item holding that Consumer Reports “got it wrong,” at least with respect to how Roku's platform was characterized.

“This is a mischaracterization of a feature,” he wrote. “It is unfortunate that the feature was reported in this way. We want to assure our customers that there is no security risk.”

Ellison acknowledged that Roku enables outside developers to create remote control applications that consumers can use to control their Roku product using an open interface, and added that consumers also have the ability to turn off that feature.

He also said Roku’s support of ACR (automatic content recognition), another technology that Consumer Reports viewed as a vulnerability because it can be used to target ads, is an opt-in feature.

But, as USA Today rightly points out, data gathering practices and general privacy issues with smart TVs have been drawing scrutiny.

About a year ago, for example, Vizio agreed to pay $2.2 million to settle federal and state charges that millions of its connected TVs were collecting viewing data without the consumer’s knowledge or consent.

Child advocacy and privacy groups are calling on the Federal Trade Commission to investigate several smartwatch brands and the risks they pose to children, part of a global effort, they said. They also want them pulled from store shelves.

The groups, which include Consumers Union, Public Citizen and the Center for Digital Democracy, said in a filing with the FTC that the watches, essentially wearable smartphones, have "significant" security flaws and lack privacy protections.

Privacy groups are filing similar complaints in Belgium, Denmark, the Netherlands, Sweden, Germany and the UK.

The research that led to the filings was conducted by the Norwegian Consumer Council, the same group whose investigation prompted a complaint against the Cayla "smart" doll over similar data security concerns.

Related Video: #WatchOut (by the Norwegian Consumer Council)

While the watches are meant to allow parents to keep up with their children, the groups said research has shown that a stranger can "take control of the watch with a few simple steps, allowing them to eavesdrop on conversations the child is having with others, track and communicate with the child, and access stored data about the child’s location."

The groups argued that violates both Sec. 5 prohibitions on false and deceptive practices and the Children's Online Privacy Protection Act.

"The devices create a new vulnerability that allows a third party to find a young child at precisely the time when the child is separated from a parent or guardian," they said.

Related: Markey, Barton Press Mattel on Baby Monitor Privacy

"The Trump Administration and the Congress must bring America’s consumer product safety rules into the 21st century,” said Jeff Chester of the Center for Digital Democracy. “In the rush to make money off of kids’ connected digital devices, manufacturers and retailers are failing to ensure these products are truly safe. In today’s connected world that means protecting the privacy and security of the consumer — especially of children.

"Both the FTC and the CPSC [Consumer Product Safety Commission] must be given the power to regulate the rapidly growing Internet of Things marketplace,” he added. "These devices are supposed to give parents peace of mind and enable secure communications. But some can be hacked; they don’t use encryption, and the 'SOS' function may not work."

Chester was one of the earliest and strongest voices for more child privacy and data protections given the potential of online platforms, and now the growing internet of things, to collect and share information.

The groups gave the FTC credit for having extended privacy protections to children and recognizing the risks of interconnected devices, but said the FTC in the past has also failed to take enforcement action on previous complaints about child safety.

They cited, for example, a 2010 agreement between New York state and a company that stopped selling kids' online conversations to marketers, a complaint consumer groups also lodged with the FTC, which took no action.

The rapid, technology-fueled evolution of the TV business has created opportunities and challenges for advertisers and programmers. None of those has more upside than tapping into the “smart” part of the smart TV.

It’ has taken a few years for the market to appreciate what it means to have a connected TV. The device that dominated the last 70 years of entertainment and advertising was suddenly blessed with new capabilities. The advent of smart TVs was potentially disruptive, and even threatening, to certain entrenched players, such as set-top box makers with a vested interest in dumb TVs; traditional service providers, who distributed the boxes as a revenue source; and the measurement industrial complex that profits from small panels and iffy set-top-box data.

These parties have resisted — and at times have actively hindered — the development of a vibrant smart TV ecosystem. That is, until the changing TV landscape starting showing the networks, agencies and programmers just how transformative these new data streams can be.

Data Drives Pace of Innovation
Now, internet-connected TVs (and streaming devices) are providing a more intuitive content experience and are helping audience-based buying and addressable advertising reach scale. All of those innovations depend on one thing: data. And unlike data from set-top boxes, panels or other sources, smart TVs measure all types of viewing, and as it happens — over-the-air, through a set-top box or via an over-the-top service. Smart TV data brings transparency to a clouded TV data market.

Related > Consumers Uncomfortable With Smart TV Data Collection: Survey

Earlier this year, in a case involving Vizio, the Federal Trade Commission for the first time clarified the required fair information practices for capturing and using information about the content playing on TVs.

As these and other data-market participants continue to digest and apply these new rules of the road, Vizio has led the industry in educating consumers about the collection and use of viewing history. We firmly believe that collecting and using this data — in nonidentified ways — means better, more relevant experiences on all of their entertainment devices for consumers.

Here are the main pillars of the new standards set by the FTC for all TV makers:
1. Smart TV makers must prominently disclose their viewing data collection, use and sharing practices — including how the data is augmented, such as with demographic or cross-device information or inferences, the types of companies to whom it is disclosed and the purposes of the disclosure (i.e., analytics, audience measurement and ad targeting).

2. The notification must be unavoidable and separate from any terms of service or privacy policy.

3. Smart TV makers must get express permission from TV owners before collecting, using or sharing television-viewing information.

Only if the entire industry comes into better compliance with these new (government-mandated) standards for collecting and using viewing history will the promise of smart TVs to deliver better entertainment and a more precise and efficient programming and advertising marketplace be fulfilled.

Unfortunately, not all companies appear to us to be equally committed to meeting the new legal standards, even though those standards are now clear. Our testing indicates that many companies are still hiding behind opaque, muddying disclosures, rather than leveling with consumers in plain, easy-to-follow disclosures as the FTC has required.

The FTC’s requirements for prominent notice of actual practices and explicit consent have been plainly stated for many months now. Any past legal uncertainty has long been cleared up. There is no excuse in today’s market for not being compliant in these basic respects.

If a TV maker can’t execute a firmware update or other mechanism to meet its clear obligations, then it’s hard to see why the right answer is to persist with tracking practices the FTC has deemed unfair.

Metrics Cleanup Will Take Time
Because compliance is not 100% across the industry and many actors are using back-door tactics to gain consumer consent (such as TV ad tech posing as something else), cleaning up the market is not a fast or easy endeavor. Many companies, brands and agencies are therefore seemingly reliant on squishy metrics. Agencies buy and resell these metrics on a campaign basis and perhaps don’t realize the potential breaches of privacy, the general lack of standards or the associated risks.

This doesn’t have to be the case. Those companies have to change their models to be more transparent, from the opt-in until the data is delivered. At Inscape, we can’t hide or obscure anything; when our partners receive their data, a daily device count is one of the key metrics. But we know that is not the case for everyone.

There is simply no easy third-party way to track which clients are or are not detecting content. And therein lies the challenge. It’s like counting impressions based on the number of people who have the internet instead of those that actually saw the ad on a screen.

As an industry, we can and must do better.

When flawed data — information poorly gathered and misrepresented — is peddled, the resulting smoke and mirrors harms media buyers and could lead to more regulatory sanctions and complaints from wary viewers and brands. We’re all fortunate to have businesses based on television, a wonderfully sophisticated device whose potential is just beginning to be tapped, 80 years after it first entered the living room. The industry needs to work together to ensure that the smart TV environment remains secure and to build a higher-functioning source of consistent and actionable viewership data.

Jodie McAfee is senior vice president of sales and marketing atInscape.tv.

There’s been a lot of attention and questions about consumer privacy in recent days. At Comcast, we respect and protect our customers’ personal information. Always have, always will. We do not sell our broadband customers’ individual Web browsing history. We did not do it before the FCC’s rules were adopted, and we have no plans to do so.

Comcast has committed to privacy principles that are consistent with the FTC’s privacy regime, which has applied to all entities in the Internet ecosystem for over 20 years and which continues to apply to Internet edge companies like Google, Facebook, and Amazon. We believe this commitment is legally enforceable in multiple ways, including by state attorneys general.

There has been a lot of misleading talk about how the congressional action this week to overturn the regulatory overreach of the prior FCC will now permit us to sell sensitive customer data without customers’ knowledge or consent. This is just not true. In fact, we have committed not to share our customers’ sensitive information (such as banking, children’s and health information), unless we first obtain their affirmative, opt-in consent.

Our privacy commitments to our customers go even beyond this protection of sensitive information that has dominated the dialogue this week. If a customer does not want us to use other, non-sensitive data to send them targeted ads, we offer them the ability to opt out of receiving such targeted ads.

We also continue to comply with various federal laws protecting privacy, such as the Communications Act, the Children’s Online Privacy Protection Act, and the Electronic Communications Privacy Act, as well as dozens of state privacy and data-security laws.

In view of all the misinformation and inaccurate statements that have been made in the last week, we want to make sure that our customers understand how strong our privacy protections really are. So we will revise our privacy policy to make more clear and prominent that, contrary to the many inaccurate statements and reports, we do not sell our customers’ individual Web browsing information to third parties and that we do not share sensitive information unless our customers have affirmatively opted in to allow that to occur.

Gerard Lewis is the senior vice president, deputy general counsel and chief privacy officer for Comcast.

Congress and President Donald Trump are poised to kill the first real protections for commercial privacy that Americans have online. On March 23, phone and cable giants allied with the GOP Senate majority to overturn the historic consumer-data safeguards adopted last fall by the Federal Communications Commission.

AT&T, Comcast and Verizon Communications — the country’s dominant providers of high-speed broadband — along with industry and its congressional GOP allies, intensely oppose the new FCC rule. Why? Merely because it gives Americans some say in whether their sensitive information, such as web browsing activity and geo-location, can be used for digital marketing purposes.

That’s right. The new FCC safeguard about to tossed into the legislative waste bin merely says that ISPs must first ask for permission before they can take this personal data in order to target us. Such an “opt-in” approach, requiring prior informed consent, is heretical to digital marketers, whose profits depend on using all of our information without ever really having to ask to do so.

Until the FCC stepped in, it was the Federal Trade Commission that served as the primary federal agency handling Internet privacy. But unlike the FCC, which can readily issue regulations to protect the public, the FTC is constrained from doing so. More than three decades ago, the advertising industry successfully lobbied Congress to curb that agency’s rulemaking authority (during a fight over another media issue — whether there should be limits on children’s advertising).

Primarily, the FTC can only punish companies that engage in “unfair” or “deceptive” acts — such as lying to customers about how they use or protect our information. But if a company writes a privacy policy that basically provides them with unlimited access to all our data — which is what they do — the FTC is basically powerless to do anything at all. Which is why the phone and cable giants, along with Google and Facebook, prefer the FTC. It provides the illusion of having actual oversight and limits, when really nothing much is possible.

Under the FTC’s watch, Americans have just experienced an unprecedented loss of their privacy. In the last few years, for example, digital marketers have aggressively pushed the boundaries of what information they gather from us and how it can be used.

Our offline and online data is now routinely merged, generating “profiles” that connect our street address to the “cookies” and other online identifiers provided by our digital devices. Our precise geolocation is also regularly captured by mobile phones and “apps” that stealthily send our whereabouts to online companies and retail stores. Massive one-stop data broker “clouds” have emerged that provide reams of information, including about our finances, health, political interests, ethnicity — sold to marketers large and small.

Our data “profiles,” or digital dossiers, have become invaluable corporate assets that are bought and sold in milliseconds by powerful computers scattered across the globe, our identities traded for profit, as if they are just another commodity. Ongoing advances in how data is analyzed and used —  “big data” — is ushering in even more ways companies can more precisely determine who we are, what we do, where we go, and how we should be treated.  

The leading phone and cable broadband ISPs have made major investments in tapping into the latest “big data” techniques. For example, Verizon recently introduced “Smartplay,” which helps deliver “smarter advertising” by creating what it calls “individual viewer personas that capture viewing history, account profile details and other valuable data.”

Comcast Labs employs “big data research teams” that have expertise in “machine learning algorithms, forecasting models, intelligent image and video search, automated scene analysis, voice biometrics, recommender systems, personalization, and deep metadata.” AT&T is relying on its “Consumer Insights Platform” team to turn “big data into big insights.”

ISPs also partner with leading data providers, such as Acxiom and Oracle, to enhance the robust details they already have about their broadband and video service subscribers. The big ISPs have also been on a shopping spree, acquiring companies that further their digital data advertising clout. Verizon acquired AOL and is now in the process of buying Yahoo; AT&T bought the leading satellite TV company, DirecTV, in part because of its digital ad capabilities; it now wants to fold Time Warner into its empire. Comcast has swallowed up ad-tech companies such as Visible World, FreeWheel, and StickyAds (and its NBCUniversal subsidiary has also embarked on its own formidable data-driven ad initiative).

It is precisely because ISPs provide us access to residential broadband or wireless networks that they have a unique window into our lives. While Google and Facebook have their own far-reaching capabilities, they are primarily ad-supported marketing companies. When we pay a (hefty) monthly subscriber fee for Internet access, we should not also be exposed to having our Internet provider capture every bit of information it can, let alone tie that data together with what we do when we use our mobile and gaming devices or watch TV.

The FCC’s new privacy rule builds on the agency’s network neutrality policy requiring that companies providing access to the Internet must operate in a fair and nondiscriminatory manner. Longstanding safeguards for protecting the privacy of our voice conversations over the telephone network have been brought into the 21st century — and now it’s also our broadband communications that must be respected. (Network neutrality is also under threat of elimination by the Trump FCC.)

The ISPs and ad-industry lobbyists disingenuously claim that having the FTC protect consumer privacy for all Internet companies, including ISPs and data giants like Google, is the most effective approach. It would be so, perhaps, if the FTC had any real clout. Many of the companies and trade groups urging that the FTC replace the FCC as a privacy regulator have lobbied against giving the trade commission actual authority to do so. They cynically know that turning over our broadband privacy to the FTC will mean business as usual — more of our offline and online data endlessly flowing into sophisticated databases that provide advertisers and other commercial entities (and perhaps government) detailed actionable blueprints of our lives. It will also mean that the only real potential privacy protection Americans have had to make their own mind up about whom to share data with and for what purpose will be lost.

The ISPs, data-marketing companies and their supporters are also fighting against the privacy rule because they know we are also on the eve of a new era — the Internet of Things — that will generate even more personal information about us. In today’s digital era, data is power. That’s why we shouldn’t let Congress and the broadband companies overturn the first real protections we can have. This will be an opportunity to challenge Donald Trump’s vision of the United States as principally a corporatist society where the welfare of commercial special interests is more important than the needs of the average American.



Jeff Chester is executive director of the Center for Digital Democracy, a Washington, D.C.-based consumer digital-rights group.

A bill reintroduced by Sens. Ed Markey (D-Mass.) and Richard Blumenthal (D-Conn.) would require manufacturers of connected cars to get an owner's opt-in permission to use any information collected by the car for advertising or marketing purposes -- such as triggering a gas pump ad for a local restaurant as the car rolls into the station for a fill-up.

The Security and Privacy in Your Car Act of 2017 (SPY Car Act) would direct the National Highway Traffic Safety Administration and the Federal Trade Commission (which oversees device privacy) to set cybersecurity standards for cars.

In addition to user opt-in for sharing of data, the bill would require "clear and conspicuous notice" to vehicle owners or lessees of the collection, transmission, retention and use of data collected from their cars.

The opt-in would extend to data used for car safety systems. Owner or lessees who decided not to opt in would still get access to navigation tools and other features "to the extent technically possible."

Opting in to data sharing for marketing or ad purposes can't be a condition for the use of any non-marketing related features or functions.

Those car-related provisions track with the FCC broadband privacy rules -- opt in, no marketing quid pro quo -- that Republicans in Congress are trying to overturn, and both Markey and Blumenthal strongly support.

The senators are also reintroducing an aircraft cybersecurity bill.

“Whether in their cars on the road or in aircraft in the sky, Americans should be protected from cyberattack and violations of their privacy,” Markey said of the two bills. “If hackers access the critical systems of a car or plane, disaster could ensue and our public safety could be compromised. We must ensure that as technologies change, our safety and privacy is maintained. I thank Sen. Blumenthal for his partnership on this critical issue.”

The House is scheduled to vote Monday evening (Feb. 6) on the Email Privacy Act, a bill that would protect data in the cloud.

A version of the bill, which would boost protections of information stored in the cloud, passed the House unanimously in the last session of Congress in April and supporters were hoping for clean passage in the Senate as well, but it was held over by the Senate Judiciary Committee after amendments were offered that could have undone a compromise approach.

The baseline bill updates the Electronic Communications Privacy Act to require the government to get a probable cause criminal warrant to access emails, social media posts and other online content stored in the cloud by internet service providers and other email service providers, like Google. In a nod to the longevity of cloud storage, it eliminates the 180-day sunset on stored communications. Previously a warrant was not required for communications stored beyond 180 days.

Consumer technology companies were urging the House to pass the bill, which it said was crucial to boosting privacy protections.

"The Electronic Communications Privacy Act of 1986, written before Congress, could imagine U.S. citizens' sharing and storing personal information on third-party servers, is woefully out of date," said Consumer Technology Association president Gary Shapiro. "Quick action is needed to protect the privacy rights of U.S. citizens and properly regulate government access to private communications stored by third parties. The House of Representatives has an opportunity to act now by passing the Email Privacy Act, requiring the federal government to acquire a warrant prior to accessing emails and other forms of digital communications -- the same standard applied to our physical mail.

.

"We applaud Reps. Kevin Yoder (R-KS) and Jared Polis (D-CO) for introducing the Email Privacy Act and urge his colleagues to advance this critical legislation," Shapiro added.

Whether and how the Federal Trade Commission moves ahead with its current examination of smart television sets -- especially their role in the ongoing privacy brouhaha -- depends on a number of factors, including industry and public response to the current call for comments, which runs through Friday, Jan. 6.

Related Video > The FTC's Fall Technology Series: Smart TVs, Part 1

The new administration's impetus to develop privacy regulations is questionable, and the controversy over the FCC's recent broadband privacy rules augment the uncertainty about federal examination of TV sets' ability to monitor viewers.

"Smart TVs are testing the privacy expectations that consumers developed in the era of traditional television," Jessica Rich, director of the FTC's Bureau of Consumer Protection, said in her opening remarks at an FTC Smart TV policy workshop on Dec. 7. She cited -- as did many subsequent speakers -- "the fundamentally different relationship" that viewers have with TV sets and computers, insisting that "it matters whether consumers think of their smart TVs as a computer or a television ... and whether they recognize that today it may be both."

"We've been watching this industry since its infancy," Rich continued, noting that privacy policies -- such as those developed during the FTC's review of TiVo's viewer data collection activities 15 years ago -should be update. She observed that the 1984 Cable Privacy Act and the 1988 Video Privacy Protection Act addressed the "video providers of the day" but that streaming technology and other delivery approaches -- including features of Comcast's Xfinity system -- are encouraging the FTC to examine the "benefits and risks of smart TV" and determine a need for legislative action.

Rich acknowledged the value to advertisers of smart TVs' ability to monitor viewing patterns. She said that the FTC recognized "the fine-grained audience measurement which can help niche video programmers get ad dollars that may not have registered with more blunt video tools."

The FTC's December workshop attracted several hundred attendees, including electronics makers, privacy advocates and digital marketing executives; it was the third session of the agency's "Fall Technology Series," which also looked at ransomware and drones.

Cable industry executives were not involved. The NCTA is "not participating in the proceeding; just observing it," an NCTA spokesman told Multichannel News.

The workshop's panel on "Consumer Understanding and the Regulatory Framework" generated a string of concerns about the relationship between viewers and their TV sets, including persistent findings  audiences don't know they are being tracked.

"Consumers don't understand the complex interplay and relations that come into play with smart TVs," said Claire Gartland, consumer protection counsel and director of the Electronic Privacy Information Center. She voiced concern that data "disclose personal lifestyle factors" that could be used, for example, by insurers to determine medical eligibility.

Dallas Harris, a policy fellow at Public Knowledge, the advocacy group, characterized the process as "learned helplessness," where consumers "feel concerned about losing control of their own information." Harris said the "FTC and FCC will have to work together" since neither has complete jurisdiction over the Cable Privacy Act.

She cited the connections between Comcast and third parties over TV and online data collection.

"There's got to be a better way to explain we're not using your PII [Personally Identifiable Information] but we still know who you are," Harris said.

Emmett O'Keefe, senior VP of advocacy at the Data and Marketing Association (formerly the Direct Marketing Association) warned attendees "not to jump to conclusions about the need for smart TV privacy regulations," adding, "These are services we've used for years and are just migrating to new devices as technology evolves."

O'Keefe, a former Cablevision Systems and Amazon lobbyist, called smart TVs a "natural extension of online services."

Uncertain Outlook

Kevin Moriarty, an attorney in the FTC's Division of Privacy and Identity Protection and an organizer of the Smart TV Workshop, told Multichannel News that the event -- with about a dozen speakers -- generated "a lot of interesting things, but that's not a test for whether we'll write a report."

He said the FTC will "continue to look at data-related issues." The agency reports only about half the time after such public events, he explained.

Despite the invitation for public and industry comments about the FTC Smart TV examination, as of Dec. 27 the docket contained only two submissions -- both from individuals and both submitted before the December workshop.

During one panel, Maria Rerecich, director of the Electronics Testing Team at Consumer Reports, said her group is working on new research standards for use with smart TVs and other forms of electronic monitoring. She expects the standards will be introduced in early 2017.

The FTC will pick up some of the smart TV privacy issues at its second annual "PrivacyCon" workshop on Jan. 12 in Washington. Several Smart TV Workshop  participants cited the growing relationship between TV/privacy factors and the broader examination of digital privacy and big data usage across multiple platforms. The FTC's initial PrivacyCon, this year, drew about 300 attendees and 1,500 webcast "virtual attendees."

In an interview after the December FTC workshop, Tim Hanlon, a long-time digital ad executive, cited the importance of Automatic Content Recognition (ACR) in the development of smart TV policies. Hanlon, who is now CEO of the Vertere Group, a Chicago boutique investment advisory and strategic consulting firm that works with electronics and media companies, attended the workshop on behalf of clients.

He later told Multichannel News that ACR's ability to recognize "content that hits the glass" is at the core of these examinations. The technology can keep track of what's on the screen "no matter the source" (cable, over-the-top, streaming or broadcast).

"Some people think that's the ultimate," Hanlon summarized. "ACR data is hugely helpful  to media, notwithstanding privacy. ...  It's a way to understand consumer behavior,  a realistic way to understand the myriad of media consumption habits today. At the very least it supplements what Nielsen tells us today."

As evidence of the importance, Hanlon cited recent deals, such as Nielsen's acquisition of Gracenote, a  provider of media and entertainment metadata, including ACR capabilities.

What is the price of privacy for Americans?

That’s the single question Federal Communications Commission chairman Tom Wheeler is mulling as his agency tries to craft new broadband privacy rules that would put more restrictions on cable operators and other Internet-service providers than so-called edge providers — such as search engines and social-media platforms — all of which use personal consumer information to boost their business models.

To advocates in both camps, it is yet another flashpoint in the issue of online privacy and the different treatment given to companies in different industries.

The FCC deeded itself authority over broadband privacy when it reclassified ISPs as common carriers, which exempts them from the Federal Trade Commission oversight that used to be their regulatory governor. Wheeler, joined by the FCC’s other Democrats, proposed new rules requiring customers to opt into sharing their information with third parties.

The issue has been a hotbed of debate not just for consumers, but for the affected companies chafing against regulation. At press time, “Protecting the Privacy of Customers of Broadband and Other Telecommunications Services” had generated more than 276,600 comments on the FCC’s docket; at one point, it racked up 17,753 comments in a single 30-day period. That was more than 10 times as many comments as the second-place docket.

The FCC’s current proposal to come up with bright-line rules on broadband customer privacy is only part of the larger issue of keeping consumer data safe from prying eyes while not kneecapping the targeted ad business model that allows for free online content. Protecting information from foreign and domestic hackers is a separate issue, though one that continues to dominate privacy vs. security discussions in Washington — in that case, national security.

Perhaps the biggest unknown involves the Internet of Things, which includes an endless variety of side doors into a user’s online information. (Quite literally, since it could include WiFi-controlled door locks.) As many as 200 million IoT devices could be deployed by 2020, according to Intel.

At stake for ISPs such as Comcast and Verizon Communications is their ability to profit from targeted marketing to their broadband subscribers versus edge providers ability to do so. Edge providers — firms such as Google, Facebook, Yahoo and others that provide Internet content — are not subject to the same restrictions on monetizing user information.

Wheeler’s proposed rules on broadband privacy — which include new restrictions on which types of information ISPs can share, new reporting requirements and deadlines — could come to a vote by the end of the year.

Complicating the enforcement of privacy rules is the jurisdictional issue of which agency regulates which activities. A simple question has a maddeningly complicated answer.

ISPs, for example, know where their customers are going online — and that information is highly prized by online marketers seeking to target ads. It’s for the FCC to decide how that data is used and what control consumers have over its use.

But the individual websites can also track their visitors, and that information, too, is valuable to third parties and online marketers. That data is under the FTC’s purview, although a recent federal appeals court decision has cast that into doubt.

As the FCC-branded gatekeepers of online information, cable operators and other ISPs are at the nexus of the issue.

Meanwhile, the Wheeler-led FCC says it must keep its hands off of edge providers. “[A]ny rules that apply to [only] broadband providers do not prevent” all other Internet companies from storing and manipulating that private information, said Scott Cleland, who runs NetCompetition, an e-forum backed by broadband companies.

“They only prevent one, the ISP,” Cleland said. “It is the functional equivalent of blocking one little square of a metal screen and imagining that one has plugged the whole screen.”

Public Knowledge has argued that Congress intended that broadband customers have control of how their information is used, period. They say that anonymization of that data, which ISPs say should be treated more lightly than identifiable personal information, would still “convey a windfall to the carrier at the expense of consumer control of the information in a way that Congress did not intend.”

ISPs point out that consumers also benefit through third-party use of their anonymized data since that data is the lynchpin of an ad-supported model of free online content that users have come to expect and, arguably, now view as something of an entitlement.

ISPs have pointed out that in other facets of privacy — such as app privacy and facial-recognition software — the Obama administration has sought to have stakeholders come up with voluntary guidelines rather than have government impose prescriptive regulations.

“The FCC’s proposed rules are seriously out of step with the technology-neutral approach — applied to both ISPs and non-ISPs — that that has guided the administration’s many efforts on privacy and cybersecurity policy, with great success,” Michael Powell, president of the National Cable & Telecommunications Association, told the leaders of the Senate Commerce Committee.

PAY FOR PRIVACY

The FCC’s proposed new broadband privacy rules do not ban what some dub “pay for privacy” — ISPs providing an incentive in the form of lower bills for users in return for customers allowing their information to be used for third-party targeted marketing. Indeed, Wheeler himself suggested to National Public Radio that was a way for consumers to control and monetize the value of that information.

But the chairman has left some wiggle room. The notice of proposed rulemaking asks whether “pay for privacy” is allowable under the Communications Act. It cites the example of AT&T’s GigaPower fiber-to-the-premises service that offers users a $30 price break off a $100 monthly fee for allowing their browsing information to be used to tailor ads.

ISPs have an ally in their fight against prescriptive rules in Jon Leibowitz, the former chairman of the FTC under President Obama from 2009 to 2013. He has been working hard to convince the FCC to take the FTC’s approach to privacy, which means enforcing existing privacy policies rather than creating new rules requiring customers to opt in to third-party use of their info for marketing purposes.

In a letter to the FCC, Leibowitz, co-chair of the 21st Century Privacy Coalition and a partner at Davis Polk & Wardell advocating for telecom and broadband providers, said that applying an opt-in privacy regime for ISPs that does not apply to edge providers — still subject to the FTC’s enforcement policies — would undercut consumer benefits.

Instead, he has said, the FCC should adopt the more flexible privacy-by-design approach adopted by the FTC during his tenure, tailoring protections and consumer choice to the sensitivity of the information and how it is being used, and encouraging increased transparency.

That’s a way to apply privacy regulations in a tech-neutral manner to edge providers and ISPs, Leibowitz has said. It is also at the heart of an alternative to the FCC proposal that has been championed by the NCTA and others.

SIDEBAR: Terror Watch

WASHINGTON — Terrorism has reached into various aspects of American life, online privacy among them.

Last fall, in the wake of the terrorist attacks in Paris and ongoing urban violence, some in Congress asked Federal Communications Commission chairman Tom Wheeler what the agency could do to disrupt social media or other Internet communications used by terrorists to recruit or spread their messages of hate.

Wheeler has said the FCC has a limited role — he has long insisted the agency can regulate Internet-service providers, but not edge providers such as Google, Yahoo or Facebook.

“We do not have jurisdiction over Facebook and other edge providers, and we do not intend to assert jurisdiction over them, and I don’t believe, as legitimate as your concern is, I don’t believe we have the jurisdiction to do the kind of thing that you suggest,” Wheeler told Congress when asked if the government could “shut them down.”

But some privacy groups are concerned that the Department of Homeland Security is trying to step in and start regularly monitoring social-media posts.

The Center for Democracy and Technology, a Washington, D.C.-based nonprofit group, has told DHS to back off a proposal to ask some foreign visitors to the U.S. to volunteer information about their social media participation when applying to visit, which it calls an “avenue for overly-intrusive government surveillance.”

In comments to DHS, the CDT said it was concerned about “unspecified review and [“suspicion-less”] monitoring of their public online activity,” calling it a threat to privacy and speech protections.

While DHS has said the information was voluntary, the center fears that will not be the case with folks being asked by the government to supply information in the process of trying to secure entry.

SIDEBAR: Driven to Detection

WASHINGTON — The Federal Communications Commission’s privacy purview extends to actual superhighways as well as the information superhighway.

As the auto industry begins to deploy collision avoidance and other vehicle-to-vehicle communications using dedicated short-range communications (DRSC) spectrum, consumer and privacy groups — as well as some lawmakers — are pushing the agency to come up with customer-information privacy protections as commercial and noncommercial uses are developed for the Internet of (Vehicular) Things.

The FCC opened an inquiry into the issue after Public Knowledge petitioned it for an emergency stay of the rollout of so-called Vehicle-to-Vehicle (V2V) services. Sens. Ed Markey (D-Mass.) and Richard Blumenthal (D-Conn.) wrote with their concerns, including that the FCC reserve the spectrum for matters of public safety, such as crash avoidance.

The issue is not just that cars can be hacked — which could put lives in jeopardy — but that retailers might sell commercial services using customer broadband information.

V2V services would make use of 5-GHz spectrum, the same swath of bandwidth cable operators use to fuel WiFi hotspots — the industry’s primary mobile broadband play. They’ve been pushing for more of that spectrum.

Public Knowledge says that the cybersecurity and privacy issues behind its effort are independent of the issue of sharing the band with WiFi. Delaying V2V rollout is necessary “whether or not the [FCC] allows operation of unlicensed devices in all or part of the DSRC band on a non-interfering basis.”

With regard to the retail issue, Public Knowledge points out that businesses could collect and analyze where a vehicle goes and how long it stays there — without the driver’s knowledge or consent. It could also serve them targeted ads via dashboard consoles, in-car entertainment systems or digtal billboards on gas pumps.

The Broadband Internet Technical Advisory Group (BITAG), the nonprofit multistakeholder group focused on broadband network management issues, is working on a report on the technical side of security and privacy in the Internet of Things world.

The report will look at smart phones, tablets and computers, as well as the sensors and monitors being woven into the fabric of daily life.

"Some IoT devices are shipped with security flaws that can put end users at risk and negatively affect their Internet experience, for a variety of reasons," BITAG said in announcing the repot. "To address the technical issues underlying these security and privacy related concerns, BITAG’s technical working group will analyze this topic and issue a report that will describe the issue in depth, highlight technical observations, and suggest appropriate best practices.

Lead editors on the report, which is planned for the fall, will be Jason Livingood, VP of Internet services, for Comcast, and Nick Feamster, computer science professor at Princeton University.

The review will be chaired by BITAG executive director Douglas Sicker.

The announcement comes the same day the issue is getting a deep dive on Capitol Hill. "The Internet of Things: Modernizing Transportation and Infrastructure," is the subject of a hearing in the Senate Surface Transportation and Merchant Marine Infrastructure, Safety and Security.

Georgetown University law professor Paul Ohm came strongly to the FCC's defense in testimony for a June 14 House Communications Subcommittee hearing on the FCC's proposed broadband privacy (CPNI) framework.

The hearing was labeled "FCC Overreach: Examining the Proposed Privacy Rules," so it was clear what the Republican majority that called the hearing thought of the proposal, which, among other things, is to require opt-in subscriber permission to share customer data, a requirement not put on edge providers, who also share data.

But Ohm said the FCC had acted "appropriately and wisely" to apply sector-specific rules to ISPs.

A divided FCC voted March 31 to propose the new privacy regime, but has not voted on a final order.

Ohm's principal arguments for that FCC approach were: (1) ISPs are "important gatekeepers of privacy"; (2) Congress recognized the need for "sectoral" privacy rules and that the FCC is "well-advised to create rules that draw bright and easily administrable lines rather than utilize murky balancing tests, in order to protect consumer expectations and engender consumer trust"; and (3) the proposed rules preserve a level playing field and ISPs "retain the ability to compete directly with search engines and other providers of edge services subject to precisely the same privacy law framework as any other company."

He conceded a need to toughen privacy rules for actors other than ISPs, but suggested the answer is to give the FTC more authority, not tailor the FCC approach to the FTC's current ability only to enforce violations of voluntary privacy policies or otherwise go after conduct that is unfair or deceptive.

The Federal Trade Commission used to oversee broadband privacy, using its enforcement power to go after false and deceptive practices to make sure privacy policies were adhered to. The FCC, which inherited oversight when it reclassified Internet access as a telecom service subject to common- carrier regs, is taking a different approach, proposing rules that require users to opt in to having their customer information shared with third party marketers.

FCC chairman Tom Wheeler has said the different approaches to edge and ISP privacy are appropriate because consumers can far more easily switch from one search engine or site to another, but cannot do so with ISPs, which lack the same ease of switching or competitive choices.

WASHINGTON — The former chairman of the Federal Trade Commission under President Obama is among those cautioning the FCC about its framework for new broadband-privacy rules.

In comments on the Federal Communications Commission’s framework, former FTC chairman Jonathan Leibowitz signaled he was on the same page as multichannel video programming distributors, which have pushed the FCC to adopt the FTC’s model of enforcing existing privacy policies, rather than flex its rule-making muscles with new regulations that could create an uneven playing field between ISPs and edge providers.

Leibowitz, now a partner at law firm Davis Polk & Wardell who counsels on privacy and congressional advocacy, said his approach was “not to erect stop lights dictating what companies and consumers can and cannot do, but rather to strike the right balance between privacy and innovation.”

He said he found some things to applaud in the proposal, but signaled the FCC had not gotten the balance quite right.

Leibowitz praised FCC chairman Tom Wheeler for seeking rules that were consistent with the FTC’s “privacy-by-design approach.” The FCC’s design, though, “overshoots the mark,” he said.

The regulations proposed by the FCC for broadband providers “go well beyond those imposed on the rest of the Internet economy,” Leibowitz said.

MVPDs are particularly concerned with the proposal to prevent Internet providers from sharing users’ information with third parties unless they get affirmative, opt-in consent. That’s something edge providers such as Google and Facebook are not required to do.

Such regulations would undercut the consumer benefits the FCC is trying to protect, Leibowitz said.

He recommended the FTC approach of focusing on the type of data being collected, providing heightened protection for the most sensitive information.

Leibowitz also argued, as have ISPs, for a technology neutral approach. He said the government should not pick winners and losers and that browsers, social-media platforms and operating systems have access to “all or nearly all” of a consumer’s online activity.

The FCC does not have authority over edge service providers, Wheeler has contended, though ISPs counter that the FCC has not been otherwise reluctant to use its Section 706 authority to advance communications.

The Senate Judiciary Committee has held over consideration of legislation updating the Electronic Communications Privacy Act (ECPA) after amendments were offered that could have undone a compromise approach.

Similar legislation, the E-Mail Privacy Act, passed unanimously in the House, and supporters were hoping for clean passage in the Senate as well.

The bill updates ECPA to require the government to get a probable cause criminal warrant to access e-mails, social media posts and other online content stored in the cloud by Internet service providers and other e-mail service providers, like Google. In a nod to the longevity of cloud storage, it eliminates the 180-day sunset on stored communications. Previously a warrant was not required for communications stored beyond 180 days.

During a business meeting to mark up a Senate version Thursday (May 26), committee chairman Charles Grassley (R-Iowa) agreed to hold over the bill rather than press the issue with a vote, pointing out that the bill's sponsors had asked that it be held over.

Ranking member Sen. Patrick Leahy (D-Vt.), one of those sponsors, thanked Grassley for the move.

But Grassley said there was broad consensus that the 1986 ECPA bill needed revising given the advances in technology. He said that most agree that given the way email is used and stored it hardly makes sense for its protection to hinge on whether it is 180 days old or whether it has been opened at all.

"The privacy of Americans should be protected," he said, and should not depend on [an] email's age at all."

Leahy, who wrote much of the original bill, said he agreed it needed to be updated.

"Digital files ought to be treated the same as the papers in our filing cabinets in our homes," Leahy said. He pointed to the House passage 419 to 0, adding that the Senate should "give some attention to that, given that there are those who thought that neither body could pass a unanimous resolution that the sun rises in the east."

Leahy pointed to the broad support, but also pointed to last-minute concerns, expressed in Republican amendments, and said he supported delaying moving the bill to the floor in the interests of preserving the broad coalition -- "from the right to the left" -- rather than see it "destroyed."

Not to pass the bill, he said, "would be an enormous mistake and turning our back on the tremendous work both parties did in the House..."

Several amendments had been proposed over the past few days by Republicans, including one by Sen. Orrin Hatch of Utah, the International Communications Privacy Act (ICPA), that would have addressed government surveillance outside the U.S. by securing data privacy internationally.

ICPA would reign in what Hatch called the overreach of law enforcement's ability to access data worldwide.

"Currently, the U.S. government takes the position that it can compel a technology company to turn over data located anywhere in the world belonging to a citizen of any company so long as the data can be accessed by a company subject to U.S. jurisdiction.

Hatch did not introduce the amendment, but did introduce it as a standalone bill. Grassley said he was making no promises, but would see how that bill "fit into" the committee's agenda.

The FCC at press time Thursday (May 12) had not yet posted what one group said was a couple of thousand comments critical of the chairman's broadband privacy proposal.

The FCC is proposing to require broadband providers to get customers' approval (an "opt-in" regime) to share their information with third-party marketers, something not required of edge providers like Google and Yahoo!

At press time, only 28 comments were in the docket, one more than the day before, when the Protect Internet Freedom group, which is strongly opposed to both the new rules and the Open Internet order that prompted them, complained that online petitioner comments had not shown up and wondered why.

READ MORE:Former FTC Chair Has Issues With FCC's Opt-In CPNI Regime | Advertisers Warn Hill on FCC Broadband CPNI Item

FCC chairman Tom Wheeler was asked about the missing comments at a Senate hearing on the broadband CPNI (customer proprietary network information) privacy proposal Wednesday (May 12), and said it was a software glitch on the group's end that the FCC was working on resolving.

FCC spokespeople were not available for comment at press time on the status of the comments.

RELATED:Advertisers Warn Hill on FCC Broadband CPNI Item | Group Seeks FCC Answer on Missing Broadband Privacy Comments

The heads of the major ISP/cable/telco trade associations have told Congress the FCC needs to back off new opt-in-centric rules on broadband CPNI (customer proprietary network information), and instead adopt an FTC-like approach to privacy.

That came in a letter to the leaders of the Senate Judiciary Committee, which is holding a hearing May 11 on the new FCC privacy framework, from the heads of the American Cable Association, National Cable & Telecommunications Association, CTIA, USTelecom and the Internet Commerce Coalition.

It was a busy day in the letter-writing department as advertising trade groups registered similar concerns to the senators.

The FTC does not have privacy rules, but instead enforced broadband privacy through enforcement actions--filing court suits or settling complaints--using its authority to go after false or deceptive advertising if companies strayed from promises made in privacy policies.

But the FTC's authority to regulate broadband privacy went away when the FCC reclassified Internet access as a Title II service beyond the reach of the FTC.

The associations advised Congress that there was nothing in the Title II reclassification that warrants departure from that FTC approach based on effective notice by ISPs to consumers and meaningful choice over their data--but not a mandatory opt-in regime.

They are not happy with the FCC proposal to make opt-in the default for sharing most consumer information with third parties for targeted marketing purposes, meaning they would have to affirmatively agree to it.

"This would lead to absurd results, such as restricting an ISP’s ability to market accessories that work with a consumer’s device," they told the senators. "It also would make it difficult for consumers to have access to discounted offers from their providers. This broad opt-in requirement, irrespective of the sensitivity of data, would be inconsistent with common Internet practice and would harm consumer welfare. More important, it would be confusing to require consumers to opt-in to ISP data use and sharing because consumers would likely not understand how the opt-in regime would apply."

The groups were the same ones who advised the FCC to use the FTC approach before FCC Chairman Wheeler unveiled his opt-in approach to sharing data with third-party marketers.

They said they support a "Reasonable framework," but said Congress might need to help the FCC "realign" its proposal with the FTC approach to make it so.

Accelerating their objections to the FCC's "unlock the box" set-top proposal, minority programming and ownership advocates took their message to Capitol Hill last Thursday (April 14), backing up Rep. Yvette Clarke (D-New York), who said she envisions that a "protracted struggle" over the plan "will set us back in the drive for diversity."

The Brooklyn, N.Y., legislator, a member of the Subcommittee on Communications and Technology of the House Energy and Commerce Committee, warned that the revenue restrictions triggered by the FCC plan "could lead to the ultimate extinction" of small and medium-sized programmers, including minority and special-interest programmers.

Thursday's assault on the FCC proposal was the latest in the escalating battle against the set-top Notice of Proposed Rulemaking.  Last month Clarke, other members of Congress and diversity organizations asked the Government Accountability Office to run an impact study of the plan’s implications.

"Major disruptions that fail to consider bargaining power will impact placement, affecting advertising dollars and, in turn, the ability to remain competitive and to sustain livelihoods," Clarke told an audience of about 50 people, mostly Congressional staffers and supportive lobbyists, in a House Office Building meeting room.

"Many have stated that the FCC’s new set-top proposal will, in fact, open up the marketplace so that these diverse and independent programmers gain more visibility, especially through OTT platforms," she said, but then warned, "There is no current guarantee that Silicon Valley will do a better job at prioritizing diverse and inclusive programming based on what they have demonstrated so far."

Frank Washington, CEO of Crossings TV, a Sacramento, Calif.-based firm that packages Asian (mostly Chinese) programs on cable systems, pointed out that the FCC's NPRM never uses the term "localism," which he considers a vital ingredient in programming. 

Washington also insisted that the biggest problems in the FCC proposal are not only the "unanswered questions" but, more significantly, "the unasked questions" about the plan’s impact.

"They are talking about creating an alternative universe," said Washington, a one-time legal counsel to an FCC chairman and later deputy chief of the FCC's Broadcast Bureau. "There is no accountability in this alternative universe." 

He urged the Commission to "let the marketplace drive the progress," not impose an untested system that will affect revenue and distribution.

Although the recently-created Future of TV Coalition (topped by the NCTA, Comcast, Time Warner Cable, and many other MSOs and industry vendors) was not officially part of the program, the organization’s message permeated the Capitol Hill program. 

For example, Carlos Gutierrez, general counsel for the LGBT Technology Partnership, outlined views on data privacy implications that echoed the Coalition’s.

Gutierrez cited the "troubling lack of specifics in the NPRM" and emphasized that the FCC plan would not require new STB suppliers to comply with "the same privacy provisions as cable operators."

"The NPRM doesn't have a mechanism to account for data breaches by OTT providers," Gutierrez said, underscoring the importance of that protection.

Dr. Nicol Turner-Lee, vice president of policy and chief research officer of the Multicultural Media, Telecom and Internet Council (MMTC), voiced concerns that the FCC plan would morph into a federal mandate. 

"The government should not pick winners and losers," Turner-Lee said. "Government should not mandate the ways consumers get to the content they want."

She added that the FCC has not looked at diversity in a serious way, especially as part of the STB plan.

Washington, calling on his long background in media since he left the FCC, said that based on recent conversations he has had at the agency, the "FCC people are feeling the heat."

An advisory group to the European Union has said it can't endorse the "privacy shield" proposal agreed to by the EU and U.S. to succeed a data protection agreement invalidated last year, according to the Information Technology and Innovation Foundation.

The ITIF said it was disappointed that the group -- the Article 29 Working Party,  made up of EU's data protection regulators --  could not support the negotiated framework.

"The new agreement offers a host of new protections, obligations and opportunities for redress that affirm the commitment of the U.S. government to safeguard European data and respect the rights of European citizens," the ITIF, a technology policy think tank, said. "Moreover, the agreement has achieved widespread support on both sides of the Atlantic from many policymakers, businesses and advocacy groups for offering an opportunity to move forward after the European Court of Justice invalidated the Safe Harbor agreement in the Schrems decision."

If the privacy shield proposal is approved, it would replace the Safe Harbor agreement that an EU court invalidated over concerns about the U.S. being able to hold up its end of the agreement given the government surveillance revealed by the Edward Snowden leaks. The framework requires companies to provide notice of what personal information is being collected and stored, the purposes it is used for and an "opt out" mechanism.

The ITIF said the fact that the advisory group thinks the agreement needs work isn't a reason not to approve it.

"While members of the Article 29 Working Party should continue to offer suggestions on how to strengthen this agreement — and there are opportunities for improvement — the opportunity for improvement should not preclude official approval of the agreement," the ITIF said.

The Trans Atlantic Consumer Dialogue, civil society groups that also had issues with the shield, said the signal from the advisory committee was clear and should be heeded.

"We hope that the European Commission will take the opinion of the Data Protection Authorities very seriously. It is clear that the Privacy Shield does not adequately protect EU consumers’ fundamental rights," said Jeff Chester, U.S> co-chair of TACD's Information Society Committee. "The Commission must reconsider its adoption. The EU cannot afford to set a precedent like this and allow fundamental rights and values to be high jacked by political and commercial interests.”

A large portion of Americans appear willing to share their personal information in exchange for a product or service, but some offers are more attractive than others.

That is the takeaway from a new Pew Research Center report based on a survey of 461 U.S. adults and 80 participants in nine focus groups on attitudes toward what Pew billed as the "key tradeoff" of the digital economy.

Pew offered up six hypothetical tradeoffs involving sharing varying degrees of personal data and asked respondents whether that tradeoff was acceptable.

The majority (54%) said they were OK with facial recognition cameras in the workplace to catch thieves of employees' personal belongings, with the footage staying on file as long as the company wished, and even if it were used to measure employee attendance and performance. Only 24% said that would not be acceptable, with 21% saying it would depend on circumstances. There were no statistically significant differences in answers by age, gender or income.

Far fewer would trade personal data for receiving targeted advertising in the scenario presented by Pew. That scenario was free access to a social media platform that allowed for interaction with other alumni for an upcoming reunion in exchange for creating a profile and supplying a photo that would be used by the site to deliver tailored advertising.

Only 33% said that tradeoff would be acceptable, while 51% said it was not and 15% said it depended on the circumstances. The generational breakdown is telling. Four of 10 under 50 said they were OK with that, but only 24% of those over 50 said it was acceptable.

“Many policy makers and companies are anxious to know where Americans drawn the line on privacy – when they will resist privacy intrusions and when they are comfortable with sharing personal data,” said Lee Rainie, director of Internet, Science, and Technology research at Pew and author of the report. “These findings show how people’s decisions are often context-specific and contingent. A phrase that summarizes their attitudes is, ‘It depends.’ Most are likely to consider options on a case-by-case basis, rather than apply hard-and-fast privacy rules.”

WASHINGTON, D.C. -- Two top White House technology experts, speaking at a seminar here on "The Future of U.S. Digital Infrastructure," emphasized the primacy of security and privacy protections as critical to future build-outs and upgrades of digital infrastructure.  

They and their fellow panelists also offered various perspectives on the evolving competitive landscape, including the role that Google Fiber and emerging wireless broadband technology will play.

Federal chief information officer Tony Scott (pictured on right) cited the "relentless pressure" for "digital development."  But he suggested that industry is short-sighted just to "put stuff in and leave it until it breaks."  He singled out the push for Internet of Things services, warning that today's system is "not designed for the kinds of cybersecurity issues [we'll] face."

Thomas Kalil, deputy director of policy for the White House Office of Science and Technology Policy (pictured on left), urged federal agencies and departments to rethink their propensity to cling to legacy systems.

The systems in place at agencies and departments aren't going to last forever, and government needs to adopt a cycle of constant refresh, Scott said during the Dec. 9 event, hosted by Brocade and the Information Technology and Industry Council at the National Press Club here.

Federal IT Priorities: Top Executives Look to 2013 and Beyond

In a recent survey on Federal IT Reform (click here to download the summary), senior government IT executives laid out their vision for the coming year, detailing challenges and identifying priorities.

Commenting on the report, Scott said: "We have to have a mindset of working this out in a way -- economically, policywise -- that keeps riding the curve and practices that through all of the ecosystems that contribute to this. It's no different than paving roads. You don't just put a road in and then wait until it breaks apart. You repave them every once in a while. And every once in a while you have to tear it up and put a whole new road down. We [must] get in that cycle."

Scott continued, "You see a lot of markets where you have one or two dominant players,"  and noted that wireline and wireless competition "put the fear of God" into companies to invest in their networks.

Kalil said the United States will not be complacent and is looking at ways to improve in terms of technology development and investment.

Scott said he's excited about the opportunities that the Internet of Things could bring to government — if not a little hesitant. He likened the flood of network-connected devices and sensors to “free love in the '60s." IoT, he said, has been booming with little consideration in Washington as to how policy must be fashioned around that.

“There were no checks on interoperability,’’ said Scott, who was previously CIO at VMWare in Palo Alto. “It was, ‘I can interact with you, therefore I shall, no matter what, and under all circumstances.' That’s not necessarily a good thing in all cases, so I think we’ve got to have some models and some broadly enforceable rule sets that can apply ... that will actually, if done right, encourage the kind of growth that I think we all see.”

WASHINGTON — What exactly, are the rules for Internet privacy, and who has the right to enforce them?

Those two issues are at the heart of one of the most contentious debates roiling the broadband industry today. The Federal Communications Commission’s reclassification of Internet access as a common-carrier service under Title II of the Communications Act gives the agency new powers to create rules for “protecting” broadband customer proprietary network information (CPNI).

That new authority could lead to creating “opt-in” methods for collecting online personal information that many public-interest groups have been clamoring for, and could take a bite out of targeted behavioral advertising. It is unclear just how the FCC will approach its self-given power to regulate in the space, which is the main dissenting issue that Internet-service providers have with much of the Title II order.

The new broadband CPNI oversight has also created a jurisdictional tug-of-war between the FCC and the Federal Trade Commission, which has been overseeing broadband privacy but must relinquish those duties to the agency under the new rules, unless Congress steps in.

“To have the FCC usurp the authority of the Federal Trade Commission is a very bad idea,” Rep. Bob Goodlatte (R-Va.), the House Judiciary Committee chairman, told C-SPAN in an interview. “It’s going to lead to regulation of the Internet in ways that some of the people who have been calling for that have not imagined.”

UNCERTAINTY BREEDS WORRY

The fear of the FCC’s regulation of broadband privacy is similar to industry fears about the Internet conduct standard contained in the new Open Internet rules, which is fear of the unknown.

The FCC tried to give Internet-service providers some guidance in an Enforcement Bureau advisory issued May 20, but that guidance was essentially a call for ISPs to make good-faith efforts to protect privacy (and if you are unsure, run it by us and we’ll try to advise you).

That is the sort of “you’ll know it when the FCC sees it” approach that has ISPs taking the agency to court over its Internet conduct standard, a plan to potentially take government action against a broad “catch-all” (the FCC’s term) standard to sweep up conduct not prevented specifically under its bright-line network neutrality rules but that could “harm internet openness.”

Among the Title II provisions the FCC decided to impose were the customer-privacy provisions in Section 222 of the Communications Act of 1934.

“Section 222 makes private a customer’s communications network information — i.e. with whom they communicate and from where they communicate — unless a user provides express consent for its commercial use,” said Scott Cleland, chairman of NetCompetition, a pro-competition online forum supported by broadband interests, who added that the FCC has some “big decisions” to make. (See sidebar)

The FCC opted to forbear, or choose not to apply, the specific telephone-centric language of the section, preferring to come up with some new definitions for broadband CPNI protection. Just what those new definitions are and what they might cover is at the heart of the debate.

TURF WAR

In pushing to retain jurisdiction over online data security, Jessica Rich, director of the Federal Trade Commission’s Bureau of Consumer Protection, told Congress at a March hearing that the FCC’s decision to reclassify ISPs under Title II, which removes the issue from FTC purview, had made it harder to protect consumers.

A bill that passed out of the House Energy & Commerce Committee would move some of the CPNI authority the FCC has just given itself back to the Federal Trade Commission by giving the latter agency authority over data privacy when that privacy has been violated due to a breach. The bill would make not protecting personal information per se false and deceptive, empowering the FTC to sue any company — including a cable operator or telecom carrier — that fails to do so. The measure says companies must “implement and maintain reasonable security measures and practices” to protect that information, so the FTC would have to decide what would pass muster.

Rep. Frank Pallone (D-N.J.), ranking member of the House Energy & Commerce Committee, has expressed his concern that moving that oversight back to the FTC could be an “enormous problem” because it could allow those ISPs to get out from under FCC privacy oversight through self-regulatory mechanisms at the Federal Trade Commission.

While the FCC has rulemaking authority — and has signaled it could come up with broadband-specific rules — the FTC is limited to using its power to sue companies over false and deceptive conduct.

Under the proposed new legal regime, the FCC and the FTC would share jurisdiction over broadband personal information. The bill gives the FTC cybersecurity and breach oversight, but leaves privacy protections to the FCC, though FCC chief counsel for cybersecurity Clete Johnson has said that is a distinction without a difference.

Johnson told Congress that the way the bill divides up accountability and narrowly defines what information could be protected, the FCC would lose the authority over protecting a subscriber’s viewing-history information, including the shows they watch and the movies they order. At present, what a Congressman watches in Las Vegas stays in Vegas, and under the protection of the ISP there.

“[W]hether a company (either by human error or technical glitch) mistakenly fails to secure customer data or deliberately divulges or uses information in ways that violate a customer’s privacy rights regarding that data, the transgression is at once a privacy violation and a security breach,” he said.

But getting Congress to pass a bill is a tall order, so unless the courts reject the FCC’s Open Internet rules for a second time, the agency is going to be coming up with some form of privacy-protection enforcement regime for broadband information.

CALL FOR HELP

At a panel at last month’s INTX in Chicago, National Cable & Telecommunications Association executive vice president James Assey said that folks trying to comply with the law are looking for help from the FCC as they try to figure out how to comply and get “some assurance” that what they are doing won’t run afoul of the law.

At a meeting of the Advanced Television Systems Committee in Washington, D.C., NCTA president and CEO Michael Powell warned against the government inserting itself into the role data can play in tailoring consumer experiences. He conceded that the use of personal data had troubling elements, but cautioned the government could “distort the market” if it acted prematurely.

The NCTA had no comment on the FCC’s Enforcement Bureau advisory, but it did not weigh in with thanks for the new guidance.

The NCTA and other ISPs outlined their concerns over the Section 222 issue in their May 13 request that the U.S. Court of Appeals for the D.C. Circuit stay the Title II reclassification and its attendant new broadband CPNI authority.

Telco AT&T estimated it would lose hundreds of millions of dollars in revenues if it had to stop using broadband-related CPNI while it implemented consent mechanisms based on having to “guess” what future FCC rules might be.

While broadband providers can, and do, lawfully use information about customers’ Internet service to develop customized marketing programs, the ISPs said they now can’t be sure what will be acceptable under the new rules and could be held liable if they guess wrong.

The FCC appears to have the votes to flex its muscle on privacy.

A month ago, the FCC held a workshop essentially launching the process of figuring out what it was going to do with its new privacy authority. FCC chairman Tom Wheeler framed the issue in historical terms, citing the Federalist Papers and intercepted telegraph messages during the Civil War.

“Consumers have the right to expect privacy in the information networks collect about them,” he said, adding that a in digital world, everybody is leaving digital footprints “all over the place.”

Privacy is unassailable, as the virtuous circle of innovation begetting innovation essential, he said.

Wheeler clearly views privacy — like competition and access — as one of those issues that must be viewed in the sweep of history and with the long view from the high hill. That could make it difficult for opponents of strong new FCC privacy regulations to dissuade him from that course with an argument that lies in the weeds of policy.

That’s the same view that helped move his position toward Title II in the first place.

At INTX, Democratic FCC member Jessica Rosenworcel signaled that there were a number of areas where the agency needed to be looking, including monetization of customer data and ad analytics. She said it would be important to align those obligations with the FCC’s traditional cable privacy oversight and suggested the agency needed to have a rulemaking — and that the chairman had acknowledged as much — because it was an area “where time and technology have made really significant changes and we are going to have to figure out how to protect consumer privacy and manage all those benefits from the broadband ecosystem at the same time.”

“You can dial a call, write an email, post an update on a social network and purchase something online, and you can be sure that there are specialists in advertising and data analytics who are interested in exactly where you are going and what you’re doing,” she said. “And then, finally, we all know that the monetization of data is big businesses, and that slicing and dicing is only going to continue.”

Commissioner Mignon Clyburn has said the public demands a “regulatory backstop” on broadband privacy and she is ready to use that power.

SKEPTICAL GOP

The FCC’s Republican minority is hardly convinced — but they are the minority.

Commissioner Ajit Pai told cable operators at INTX that one thing he gleaned from the FCC’s privacy workshop was that nobody really knows where the agency goes from here.

Commissioner Michael O’Rielly told an INTX crowd that the FCC’s understanding of privacy was “prehistoric” and “to now say that we are going to jump in the middle of this space is extremely problematic.” As to the impact on monetizing data, he pointed out that was why a lot of Internet content was free.

Privacy advocates definitely see a chance to push for tough privacy provisions.

Jeff Chester, executive director of the Washington, D.C.-based Center for Digital Democracy and a leading advocate for online privacy law and regulation, said the FCC has “long looked the other way as phone and cable companies, with their broadband partners, secretly grabbed customer data so they could do more precise set-top box and cross-device tracking and targeting.”

The FCC needs to use its new powers under Title II to force privacy protection on broadband giants, he said. But the FCC should also look at how “Google, Facebook and other data technology companies work alongside the Verizons and Comcasts, in order to develop effective safeguards for the public,” he added, suggesting his own sweeping change.

“The FCC should issue a new ‘Bill of Consumer Rights’ for the digital video era,” Chester said.

The public still has a strong expectation of privacy, said Harold Feld, senior vice president of Washington, D.C.-based public-interest group Public Knowledge. That point was supported by a recent Pew Research study that found that more than 90% of respondents said it was important for them to control who can access information about them online and what information is being collected.

Feld told the FCC at its privacy workshop that “rock solid” phone-network privacy protections need to move into the IP-delivered world. “This is not about, ‘Well, the universe is an awful place for privacy, so who cares anymore.’ ”

Clearly the FCC cares, but until it weighs in with a new regime — and starting June 12, unless the Title II reclassification is stayed by the courts — ISPs will have to trust their gut and likely verify with the FCC as well.

Privacy’s Big Three

If the Federal Communications Commission’s reclassification of broadband as a Title II telephone service is not stayed in court, the ISP industry’s business model could be dramatically affected by how the agency implements Section 222 “Privacy of Customer Information.”

Section 222 makes private a customer’s communications network information, i.e., with whom they communicate and from where they communicate — unless a user provides express consent for its commercial use.

The FCC has some big and telling decisions to make:

Privacy Protection Predictability: Does the FCC believe in a consumer-centric implementation of Section 222, where consumers enjoy privacy protection predictability because the FCC interprets that consumers own or legally control their Section 222 private-network information, and that anyone who wants to commercialize it, must first get the consumer’s express consent? If not, can everyone but an ISP use this legally private Section 222 information in any way they want, whenever they want for most any commercial purpose they want, without notifying or securing the affected consumer’s consent?

Competitive Privacy Policy Parity: Does the FCC want to promote competition, consumer choice and a level playing field by ensuring that all competitors compete based on the same consumer privacy protection rules? If not, will the FCC pick market winners and losers by allowing only FCC-favored competitors to earn revenues in targeted advertising?

FCC Do Not Track List: Will the FCC create a Section 222 Internet “Do Not Track” list like the FTC created the “Do Not Call” list enjoyed by three-quarters of Americans? Why would it not be in the public interest for the FCC to use Section 222 to make available a similarly simple and convenient mechanism for Americans to choose to opt out of unsolicited tracking of where they go on the Internet via a national FCC Do Not Track list that would protect consumers’ private information from commercialization without permission?

In short, how the FCC implements its newly asserted Section 222 “Privacy of Customer Information” authority will speak volumes about the FCC’s true priorities. Will the FCC choose to protect consumers’ privacy interests, or Silicon Valley’s advertising interests?

Scott Cleland is chairman of NetCompetition.org, an e-forum promoting broadband competition and backed by broadband providers.