Battle for Online Privacy

The battle for online privacy: What you need to know

by Marguerite Reardon

There's a new FCC chairman in town. And like his boss, President Donald Trump, he isn't a fan of regulation.

Ajit Pai has wasted no time in scaling back rules passed by his Democratic predecessor, Tom Wheeler.

This includes putting the brakes on new rules that govern what companies can do with your online data. Proponents like consumer advocacy groups argue that the rules protect your privacy, while internet service providers say that the regulations are too strict and don't apply to online companies like Facebook and Google.

So what's all this mean for consumers? CNET has put together this FAQ to help explain the ins and outs.

So what's going on with the FCC and my privacy?

The Federal Communications Commission had been pushing through rules requiring internet service providers to disclose in plain language how consumer data is collected, how it's shared with third parties and how it's used by outside firms. It also sets specific requirements for companies to report security breaches to consumers.

The data security provision was part of a bigger set of privacy regulations approved by the FCC in October designed to protect sensitive personal information online. In addition to dealing with breaches, the new rules would limit what companies can do with the personal data they collect about you.

The rules also prohibit broadband providers from sharing your information, such as your name, location or online activity, with third parties without your consent.

But last week Pai put the data security provision on hold.

Is this a big deal?

Yes. According to a report published last year, Americans were more worried about their data privacy than they were about losing their main source of income.

Have these rules gone into effect?

Not yet. The FCC voted to put on hold the data security provision of the rules. And the provision that requires customers to "opt in" to allow your internet service provider to share personal information with marketers is still being reviewed by the White House's Office of Management and Budget.

So what's this mean for me?

Since the FCC's rules never actually went into effect, you won't likely notice much difference in how companies are protecting your privacy. Your broadband provider, whether that's AT&T, Verizon or Comcast, will still be able to sell some information about you to advertisers, just as Google and Facebook can. Say hello to more targeted advertising.

But without new rules, these broadband providers may get more aggressive in how the information is used and who gets to use it. This doesn't mean a complete free-for-all. The FCC will likely apply similar standards to those the Federal Trade Commission uses to police privacy concerns with online players.

The FCC has demonstrated that it can step in to protect consumers. In April 2015, after it passed net neutrality rules giving it jurisdiction over privacy, the agency fined AT&T $25 million for failing to protect customer information, including Social Security numbers.

Who is in support of these rules?

Supporters include consumer advocates, like Free Press and Public Knowledge, and Democrats, such as Sens. Ed Markey of Massachusetts and Al Franken of Minnesota, as well as Wheeler, the former FCC chairman who championed these rules. These folks say the FCC rules will provide better protections for consumers. These rules, they say, are justified because consumers have few choices when it comes to broadband.

Online giants including Google, Facebook, Netflix and Apple haven't been too loud about their support, but the rules benefit them competitively, so they're happy about them too.

Who wants to tear them down?

On the other side of the debate are the big cable and phone companies and Republicans, such as Sens. Jeff Flake of Arizona and John Thune of South Dakota. The two Republicans who were on the FCC when the rules passed also oppose the rules. Pai is one of them, and he's leading the charge to dismantle the rules.

Why have the rules been controversial?

Folks who oppose these rules say it's not about protecting privacy. They think the FCC's stricter approach to privacy puts broadband wireless companies at a disadvantage, especially with online advertisers. Google and Facebook, the giants of online advertising, are subject to much less strict requirements under the FTC. Critics want the agency to adopt rules that are in line with the FTC's approach.

What's the difference between the FCC and FTC approaches to privacy?

The main difference is in how consumers give consent to have their information shared. Under the FCC rules, consumers would have to opt in to have their personal information shared with marketers. The FTC model only requires companies provide a way to opt out of having their personal information shared with third parties.

"Consumers typically elect the default choice out of laziness and respect for the status quo," said economist Hal Singer, whose firm does work for AT&T and Verizon, in an op-ed for Multichannel News. "By making it relatively easier for edge providers [ie Google, Facebook, etc.] to access consumers' data, the FCC has perversely impaired the ability of ISPs to compete for online advertisers."

How does this relate to net neutrality?

Before the FCC passed its net neutrality regulations, the FTC had jurisdiction over protecting consumer privacy on broadband services, just as it polices consumer privacy for internet companies. But when the net neutrality rules were adopted in 2015, the agency reclassified broadband so that the service would be treated more like a utility, similar to the old-style telephone network. Because of this new classification, the law requires the FCC, which is the "expert" agency for communications, to handle privacy concerns. (The FCC is also in charge of protecting privacy on phone networks.)

What does that mean for my privacy on the internet?

Even without formal rules in place, the FCC is still in charge of protecting privacy for wireless and broadband customers. And it will continue to look at privacy concerns on a case-by-case basis. But the agency will not be using the strict rules and standards it set in October. Instead, it will use a similar approach to what the FTC uses to keep tabs on companies like Facebook and Google.

This means that AT&T, Verizon or Comcast will be able to sell your personal information to marketers without requiring you to give your consent. But it also means that the agency will answer and investigate claims of privacy abuse by these companies.

What's next?

There are a number of ways this could play out. Congress could step in and use the Congressional Review Act to kill the privacy regulation. It could also pass a new law putting the FTC back in charge of regulating privacy for broadband. The FCC is reviewing the rules after several companies filed petitions to have the regulation thrown out. So the FCC could start proceedings to dismantle the rules, too.

It's also possible that Congress or the FCC will undo the net neutrality regulation and return broadband to its previous classification, which would put the FTC back in charge of broadband privacy.

In any case, it's unlikely the rules that were passed by Democrats, who controlled the FCC in October, will ever go into effect.

Regardless of whether you think the FCC or the FTC should be the top cop policing internet privacy, the issue of online security isn't going away anytime soon.