FCC Vote Means Internet Providers Need Permission to Share Your Data

http://www.npr.org/sections/thetwo-way/2016/10/27/499606251/fcc-vote-means-internet-providers-need-permission-to-share-your-data

by suprgeek • 10 years ago

540 112 10 years ago

npr.org

mankash666• 10 years ago

About time

Spartan-S63• 10 years ago

I agree. I'm also glad they specified "opt-in" consent and not "opt-out." They can't start collecting your data without your prior knowledge and authorization. This is a good thing.

Next step would be to disallow hijacking and data insertion into your stream of data. It would be a step towards cementing ISPs role as a dumb carrier of data.

tedajax• 10 years ago

Does this also preclude ISPs from not allowing you access to higher tiers of service without consenting to data collection? That is that in addition to requiring an opt-in they can't incentivize it at all by giving users who don't opt-in a degraded experience.

anigbrowl3• 10 years ago

I'm sure this will lead to radical alterations on paragraph 117 of the typical EULA, where everyone will notice it immediately and have a serious think about the economic value of their personal identifiable information. I have not looked at the actual motion yet but I suspect that companies will only have to answer consumer inquiries in general terms rather than giving them detailed statement. Oh well I've given up trying to safeguard my privacy anyway.

cordite• 10 years ago

Does a 60 page EULA count as an explicit yes under this?

anigbrowl3• 10 years ago

It'll take several years of litigation for anyone determined enough to get a straight answer to that question.

wmf4• 10 years ago

I am kind of surprised that this wasn't already regulated, considering that telephone privacy has been an issue for decades. Perhaps this is a case of an unwritten common-sense policy that is only being codified when ISPs start to break it (e.g. AT&T's now-canceled "Internet Preferences").

Spooky23• 10 years ago

Only landline phones have that kind of protection.

wmf4• 10 years ago

By that logic I have wired Internet so...

MayMuncher• 10 years ago

I wonder if this applies to airport or arena wifi. Would they be considered an ISP if they are providing internet to mobile devices?

chipperyman573• 10 years ago

No, an ISP does more than provide the routers that broadcast internet.

ars• 10 years ago

This is completely pointless. They'll just add some form you have to sign before giving you service and that's about it.

After all, do you read and act on the privacy notifications other providers give you?

Does this at least require them to provider service irregardless of your consent to share data? If not, this is a pointless law that just makes it look like they did something.

jmcdiesel• 10 years ago

Well, thanks to sites like HN and Reddit, as soon as they drop some dumb stuff in the contract, it will be brought to the surface and informed people will at least KNOW... tahts a big thing

TallGuyShort• 10 years ago

Not sure I'm as optimistic. Many long agreements include vague language that gives the author A LOT of leeway.

I'm more concerned about getting this fixed in healthcare. Recently had to get lawyers involved over a debt dispute for a bill that was never sent to insurance and that the hospital couldn't even verify because it came from a "partner" no one could contact. The chief argument against us: an agreement signed by my wife while in labor that placed all the responsibility for any bills, correct or not, on us with no recourse. I remember disputing it at the time but they insisted it was just a CYA form and they couldn't admit us without it.

nickff• 10 years ago

I think you are describing general problems with disclosure and consent regulations and common-law.

The regulators and legislators pursue and get credit for incremental actions, but there is no agent or body with accountability for overall impact. When regulators impose a new disclosure requirement, they often show that if a consumer reads the document, the individual will learn something; the problem is that when this document is page 53 of a 200 page disclosure, almost nobody reads it.

This issue was pointed out by Chief Justice Roberts when he said that he never read any of the prescription drug warnings that drug-producers have been required to provide (by courts and regulators).

mperham• 10 years ago

Yep, exactly. Comcast says "we can share your data", you agree because they're literally the only usable Internet offering in cities all across America.

devindotcom5• 10 years ago

You have to opt in and there can't be a penalty for opting out, the fact sheet says. That said, there may be a bonus for opting in — perks or whatnot. That will have to be settled separately, probably.

metaphorm• 10 years ago

it's really hard for me to understand what the meaningful difference would be between penalty for opting out vs. bonus for opting in. don't those amount to the same thing, in practice?

wheelerwj• 10 years ago

Or worse, they will structure it like AT&T's project Hemisphere and find a way to provide the same insights without sharing the data specifically. And they will do it without any forms or notifications at all.

alexbanks• 10 years ago

That was my thought. There'll just be a clause in the TOS that says "By accepting you give us the right to share your data" and that'll be that.

christianmunoz2• 10 years ago

Copied this from another comment of mine on this post, but it answers part of your question. From the FCC fact sheet[0] on the decision:

The Order prohibits “take-it-or-leave-it” offers, meaning that an ISP can’t refuse to serve customers who don’t consent to the use and sharing of their information for commercial purposes.

So at least they can't cut you off entirely if you don't consent/opt-in. The fact sheet also touches on the "pay for privacy" issue:

Recognizing that so-called “pay for privacy” offerings raise unique considerations, the rules require heightened disclosure for plans that provide discounts or other incentives in exchange for a customer’s express affirmative consent to the use and sharing of their personal information. The Commission will determine on a case-by-case basis the legitimacy of programs that relate service price to privacy protections. Consumers should not be forced to choose between paying inflated prices and maintaining their privacy.

Not an outright ban on discounting service for opt'ing-in, but looks like they're leaning towards not allowing something like that.

[0] http://transition.fcc.gov/Daily_Releases/Daily_Business/2016...

rmc• 10 years ago

This is completely pointless. They'll just add some form you have to sign before giving you service and that's about it. > After all, do you read and act on the privacy notifications other providers give you?

So that's an interesting thing that's come up in the European Union, where the "constitution"/"bill of rights"[1] mandates "consent" for processing of personal data, namely does one of those click though I Agree things count as "informed consent".

Let's be honest, vast majority of people aren't actually consenting to things that are in the contract.

[1] For political reasons there is no "European Union Constitution". However there is the "Charter of Fundamental Rights of the European Union" which is sorta a "Bill of rights"

teddythetwig• 10 years ago

We are working on an Erasmus+ grant project with my company ProctorExam, and due to the nature of the project, we've also included a privacy lawyer and a representative from SURF(The Dutch institution that deals with all things education). From discussions that we had last week, an "I agree" button does NOT count as informed consent because they aren't actually presented with what they are consenting to.

driverdan• 10 years ago

After all, do you read and act on the privacy notifications other providers give you?

Yes. Never sign a contract without reading it.

revelation3• 10 years ago

Maybe they can now regulate that ISPs can not modify IP payload?

What world are we living in where the post service is allowed to rip open mail and deface it.

wmf4• 10 years ago

The FCC has spent years fighting for net neutrality.

revelation3• 10 years ago

I'm not sure yours and their definition of net neutrality overlaps much.

I personally don't think "not modifying user data" above IP is much of a net neutrality issue either; it should be a felony issue, as is tampering with mail.

1812Overture• 10 years ago

We have a monopoly. Sign this or you don't get internet.

Spivak2• 10 years ago

Which is the absolute first thing they thought of.

ISPs are not allowed to refuse you service for opting out and they're also not allowed to make you "pay for privacy". We'll see how strictly this is applied but it implies that they're also not allowed to weasel out of it by giving a 'discount' to people who opt-in.

thomasthomas3• 10 years ago

lots of power for an entity of unelected officials....

hackuser3• 10 years ago

They are legally empowered by elected officials, just like the police, the courts, the entire Justice Department, military, State Department, NIH, NSF, IEEE (for some things), and many, many more.

What alternative is there? Our elected officials can't possibly have the time or the expertise to perform all those tasks themselves.

thomasthomas3• 10 years ago

the difference is the communication act of 1934 essentially lets the FCC create laws whereby the police etc don't have that power. the power to create laws should be held by elected officials imo.

the 5 leaders of the FCC get to unilaterally make regulations (laws) that affect every single citizen in america. everything from tv broadcasts to net neutrality

Spivak2• 10 years ago

If Congress legally empowered an un-elected five person 'Super Congress' that wielded the power of Congress itself to make laws independently would you feel like your voice at the ballot box was being undermined?

I'm not saying the US regulatory agencies are at that point, but I would feel better about them if their power was more directly checked by the Executive branch.

Instead of "FCC voted today on a new ISP resulations..." it would be "Today President Obama approves new FCC recommendation...".

supergeek133• 10 years ago

In theory they were supposed to have my permission before sharing with the government too... right? Not sure what this stops.

Think of it like when you authorize facebook or someone else to share data via OAuth, how many people read that list?

whatupmd• 10 years ago

B2B and B2G are a whole different ball-game. In B2B scenario they are exposed to class-action lawsuit for bad-behavior or government fine. In B2G scenario really only thing individual citizen can do is take it to the supreme court.

afarrell• 10 years ago

I wish the UK had this. Mobile phone/data providers send a header with HTTP requests to provide the site with your phone number which they can then use to charge you without permission.

SEJeff• 10 years ago

Wow seriously? That is semi-terrifying.

eeZah7Ux• 10 years ago

Only "semi"?

oldmanjay• 10 years ago

Terrifying, horrifying, amazing... none of these words have any impact left after huffpo and buzzfeed have watered them down to meaninglessness. They get to join "evil" on the scrapheap of linguistic history.

cunotaco• 10 years ago

As far as I know that only happens with trusted partners of your mobile provider.

initram2• 10 years ago

For some reason that makes it way worse in my book. It isn't some scumbags running a sketchy website you were tricked into clicking on - it's the very people you've entrusted to give you service.

hackuser3• 10 years ago

Doesn't the EU have extensive privacy laws?

anigbrowl3• 10 years ago

Kinda academic after Brexit

guelo• 10 years ago

HTTPS would avoid this. Though it's actually a perverse incentive for websites that want your phone number to not provide HTTPS services.

cloudjacker• 10 years ago

Permission like an android app

devindotcom5• 10 years ago

Interestingly there seems to be a loophole in that they can collect the data regardless of consent, but can't use or share it without consent. So chances are this sensitive data will be recorded and put in a database anyway, even if they're not lawfully allowed to look at it without anonymizing first - but a future law could also add an exception, keeping things for law enforcement for instance.

I'm triple checking with the FCC on this though.

wmf4• 10 years ago

IIRC that's what AT&T did; I guess it was too complex to feed an opt-out blacklist to their DPI boxes. ISPs are still in denial that this data is toxic waste. https://www.schneier.com/blog/archives/2016/03/data_is_a_tox...

If the FCC allows ISPs to collect data as long as they swear it will never be used, the ISPs can then sell it to law enforcement with a contract that says they will also "never use it". https://www.theguardian.com/business/2016/oct/25/att-secretl...

joering2• 10 years ago

I don't think that would fly if they are being sued?

How would LE defend money being spent on something that they cannot use? I mean any judge will see it, no?

JumpCrisscross• 10 years ago

Any idea why? Do they need Congress to do that (or give them the power to do it)? Or are these FCC politics.

revelation3• 10 years ago

There is no need for any sort of future law, that data is open to law enforcement already. That is the fundamental problem in all of this: decade old court decisions that determined you have no "reasonable expectation of privacy" in data you shared with a company.

AT&T turned this into a product:

http://www.zerohedge.com/news/2016-10-27/us-taxpayers-pay-at...

That may have been a useful policy in a time where you yourself could decide what data you shared, now that devices share data on your behalf that can be stored forever, aggregated, analyzed and what not it is clearly no longer acceptable. We desperately need a whitelist approach to companies storing and handling cleartext user- and metadata.

ez_psychedelic• 10 years ago

This will probably just turn into a line in the terms and agreements that everyone just clicks "yes" because they have to in order to use anything.

mcs_• 10 years ago

In some cases it is already like that. The choice will be share or stay offline.

btown• 10 years ago

From christianmunoz's comment:

Copied this from another comment of [his] on this post, but it answers part of your question. From the FCC fact sheet[0] on the decision:

The Order prohibits “take-it-or-leave-it” offers, meaning that an ISP can’t refuse to serve customers who don’t consent to the use and sharing of their information for commercial purposes.

So at least they can't cut you off entirely if you don't consent/opt-in.

[0] http://transition.fcc.gov/Daily_Releases/Daily_Business/2016....

Something1234• 10 years ago

Will you post the response to HN?

devindotcom5• 10 years ago

just did, fcc confirmed.

devindotcom5• 10 years ago

The FCC confirmed that yes, regardless of consent, the ISP can collect 'sensitive' information if it is anonymized/de-identified before use or sharing. The ISP does need to make it clear to the user what information is being collected, but there's no way at present to prevent them from collecting it at all. They're also barred from attempting to de-anonymize the data, though a third party probably could.

More info here:

http://transition.fcc.gov/Daily_Releases/Daily_Business/2016...

bitJericho2• 10 years ago

It can be prevented through the use if a secure proxy.

twblalock• 10 years ago

Interestingly there seems to be a loophole in that they can collect the data regardless of consent, but can't use or share it without consent. So chances are this sensitive data will be recorded and put in a database anyway, even if they're not lawfully allowed to look at it without anonymizing first - but a future law could also add an exception, keeping things for law enforcement for instance.

I'm not all that worried about law enforcement. I think it is much more likely that the database will be hacked and the data will just get shared that way.

The only way to protect private data is to prevent the ISPs from collecting it in the first place. Otherwise, everyone knows the ISP has the data whether they share it or not, it's a big juicy target, and it's probably not that difficult to get to.

Drakim• 10 years ago

Or it will be sold without permission in secret, and when it comes to light, the ISP will get a slap on the wrist much smaller than what they gained from selling the data.

jgord• 10 years ago

..because the fact that your _paying_ them, along with the general morality, is in itself not enough of an inducement.

Frogolocalypse7• 10 years ago

Remember the hoo-haa when Wheeler was appointed chairman of the FCC? He seems to have proven his detractors wrong.

elhenrico• 10 years ago

It's there any way to obfuscate my browsing data? As in a program that visits random sites. I've searched but never found something like this.

makecheck• 10 years ago

If the data is collected at all, it can be collected incorrectly (e.g. stored in such a way that it is stolen eventually, “permissions” be damned). Still solving the wrong fundamental issue.

We desperately need to work on reducing the importance of data itself. We must assume by default that all information will be improperly handled pretty much anywhere (or, that the task of keeping it secure indefinitely is just too hard).

That means: data whose usefulness expires extremely quickly (with corresponding protocols), and the complete retirement of stupid bits of information we now carry like social security numbers and credit card numbers that can instantly screw you in the wrong hands. In fact, we ought to have proxies for EVERYTHING; I don’t know why I even have to hand out my home address, for instance, when in theory I could give a company some temporary proxy address that routes to my house only as long as I ALLOW that forwarding; after that, it becomes meaningless and cannot be used for junk mail.

mirimir• 10 years ago

No matter what anyone says, it's prudent to assume that everything is logged.

dsr_• 10 years ago

"Commissioner Ajit Pai, who voted no, cautioned that the "cold reality" is that nothing in the new rules will stop those companies from "harvesting and monetizing your data," including the websites visited, YouTube videos watched or search terms entered on any device."

Any reasonable person reading that would infer that Pai thinks that these rules are not sufficient and is in favor of stricter rules. That turns out not to be the case at all.

6DM• 10 years ago

After this comes an "update" to your privacy statement where you have to agree or you loose service...

blurbleblurble• 10 years ago

"the vote was 3-2 along party lines"

for real?

FCC Vote Means Internet Providers Need Permission to Share Your Data

Related Stories