A US House committee is set to vote today on whether to kill privacy rules that would prevent internet service providers (ISPs) from selling users’ web browsing histories and app usage histories to advertisers. Planned protections, proposed by the Federal Communications Commission (FCC) that would have forced ISPs to get people’s consent before hawking their data – are now at risk. Here’s why it matters.
What kind of personal data do internet service providers want to use?
Your web browsing patterns contain a treasure trove of data, including your health concerns, shopping habits and visits to porn sites. ISPs can find out where you bank, your political views and sexual orientation simply based on the websites you visit. The fact that you’re looking at a website at all can also reveal when you’re at home and when you’re not.
If you ask the ISPs, it’s about showing the user more relevant advertising. They argue that web browsing history and app usage should not count as “sensitive” information.
What’s changed?
The FCC has privacy rules for phones and cable television, but they didn’t apply to internet service providers. In October 2016 the agency introduced broad new privacy rules that prevent companies such as ATT, Comcast and Verizon from collecting and selling digital information about individuals including the websites they visited and the apps they used.
The new rules – dubbed the Broadband Consumer Privacy Proposal – would require broadband providers to get permission from subscribers before collecting and selling this data. Currently broadband providers can track users unless individuals opt out. The new rules were due to come into play as early as December 2017.
“Getting these rules was probably the biggest win in consumer privacy in years. If the repeal succeeds it would be pretty bad,” said Jeremy Gillula, from the Electronic Frontier Foundation.
How could ISPs use my personal data?
They sell it to advertisers. Having all the data relating to your browsing behavior allows them to offer highly personalized targeted advertising at a premium to big brands, which are injected into your browsing experience. ATT already tried such a program but killed it just before the FCC introduced the new privacy rules.
Meanwhile, Verizon attempted to insert undetectable “supercookies” into all of its mobile customers’ traffic, which allowed them to track all their browsing behavior – even if a web user was browsing in incognito mode or clearing their cookies and history. The company was sued for $1.35m by the FCC for not getting customer permission to track them.
Do all ISPs want to harvest our data?
No, not all ISPs want to abolish the privacy protections. A list of several smaller providers – including Monkeybrains.net, Cruzio Internet and Credo Mobile – have written to representatives to oppose the decision. “One of the cornerstones of our businesses is respecting the privacy of our customers,” they said.
How does this differ from the way Google and Facebook use our data?
It’s much harder to prevent ISPs from tracking your data. You can choose not to use Facebook or Google’s search engine, and there are lots of tools you can use to block their tracking on other parts of the web, for example EFF’s Privacy Badger.
Consumers are generally much more limited for choice of ISP, in some cases only having one option in a given geographical area. This means they can’t choose one of the ISPs pledging to protect user data.
Are any rules keeping ISPs in check?
In January the major ISPs signed a voluntary set of privacy principles, pledging to insist on opt-in consent before sharing “sensitive” information such as social security numbers and opt-out choice for “non-sensitive” customer information. Unfortunately, browsing history was included as “non-sensitive”.
These principles are based on rules created by the Federal Trade Commission, which used to be able to punish ISPs for violating customers’ privacy but is prohibited from regulating common carriers.
So how can users protect their browsing history?
You need to encrypt all your internet traffic. Some websites (like the Guardian) are already encrypted – marked out with HTTPS at the beginning of the URL – but ISPs would still be able to see which websites you have visited, just not the individual pages.
To mask all of your browsing behavior you can use a VPN service (which incurs a subscription cost) or try using Tor.
“Both make everyday browsing more complicated,” Gillula said.
