AT&T, Verizon, and Comcast are pushing back against concerns that the repeal of Obama-era internet privacy rules might harm their customers and lead to invasive business practices that rely on harvesting your personal data.
On Friday, the AT&T, Verizon, and Comcast each released statements touting their commitment to privacy and reassuring customers that little has changed since Congress moved to gut regulations that would make it easier for them to sell information about their online habits to third parties. But representatives from the Electronic Frontier Foundation, Public Knowledge, and the Center for Digital Democracy told BuzzFeed News that the consequences of the repeal may differ sharply from the comforting messages delivered by the telecom giants.
"There is a lot to say about the nonsense they've produced here," said Ernesto Falcon, legislative counsel at EFF. "There is little reason to believe they will not start using personal data they've been legally barred from using and selling to bidders without our consent now. The law will soon be tilted in their favor to do it."
At the beginning of Comcast's statement the company claims it will never sell the individual browsing histories of their customers. Comcast goes on to say that it will not share customers "sensitive" information without their permission. But "sensitive" has a very specific meaning when it comes to privacy rules.
According to the Federal Trade Commission's guidelines — which Comcast has pledged to abide by — browsing history is not always considered "sensitive" information, though privacy experts say it can contain revealing information about our financial, political, religious, sexual, medical, and social lives.
"Comcast saying that it doesn't sell individual browsing history is not the same thing as Comcast being prohibited from doing so."
One crucial distinction between "sensitive" and "non-sensitive" information has to do with consent. With non-sensitive data, internet providers don't need to get your explicit permission to collect and share it. In contrast, sensitive data requires that you opt-in, that you first give affirmative consent before ISPs can share it.
Perhaps one of the most important things the Obama-era privacy rules did was classify browsing history as sensitive data, giving Americans stronger protections online. The rules were passed by the Federal Communications Commission in October, and parts of the regulations were slated to kick in later this year. But the major carriers — including Comcast and AT&T — prefer the older FTC guidelines, in which customers' online habits can be surveilled, sorted, and sold more easily.
In his statement Friday, Gerard Lewis, Comcast's deputy general counsel and chief privacy officer, said: "We do not sell our broadband customers’ individual web browsing history. We did not do it before the FCC’s rules were adopted, and we have no plans to do so." (Disclosure: Comcast Corp.'s NBCUniversal is an investor in BuzzFeed.)
Verizon offered a pledge similar to Comcast's. "Verizon does not sell the personal web browsing history of our customers," wrote Karen Zacharia, Verizon's chief privacy officer. "We don’t do it and that’s the bottom line."
But Dallas Harris, a policy fellow with Public Knowledge said she isn't convinced that a mere pledge by a corporation can replace robust privacy protections. "Comcast saying that it doesn't sell individual browsing history is not the same thing as Comcast being prohibited from doing so," she said. "Without these rules, when and if they decide to start selling individual web browsing history, they can now bury it on page twenty of their privacy website and give you the option to opt-out 20 clicks away from where you log-in. That is unacceptable."
Jeff Chester, the executive director of the Center for Digital Democracy acknowledged that Comcast doesn't directly share the browsing histories of individual customers, but he still characterized the company's statement as "misleading." "It’s used for direct targeting by the ISP and is supplemented by brand and other digital media data," he said.
In AT&T's statement, Bob Quinn, the company's senior executive vice president pointed to the "web browsers, search engines, and social media platforms" that, he said, are actually the entities who collect and use the most consumer information online. Quinn argued that having stricter privacy rules for ISPs, "confuses" customers rather than protects them.
But Chester and other privacy advocates say that ISPs have significant visibility into our online lives, sometimes more so than Web companies like Facebook or Google. "[ISPs] have a lion’s share of geo-location and other specialized data," he said. "They should have safeguards instead of pointing to others."
Harris echoed that sentiment, noting that asking ISPs to implement stronger privacy rules seems a modest demand. "We are just asking internet providers to get your permission before they collect sensitive information about you," she said.