“House Republicans just voted to let your Internet provider sell your browsing history without your permission,” Business Insider declared. “Congress intends to sell off your Internet privacy,” bellowed Esquire magazine. “This politician gave away your data,” the Daily Beast bellowed. “Now buy hers.”
All of this is, of course, highly misleading. In the real world, Internet Service Providers were allowed to sell your use information yesterday, last month, last year, and in fact at any point since the sound of a 56k modem was something Americans heard every single day. The rule in question wasn’t even going to go into effect until this December.
The sale of user data is as old as the use of the Internet for business and advertising. In the not-so-distant past, at least one provider (Earthlink) actually advertised itself as an ISP that did not sell consumer information, as a selling point.
In short, privacy has not gotten worse as a result of this regulatory repeal — it has merely not improved in a way some had hoped it would.
The problem with the rule that was just repealed — and the reason current Federal Communications Commission Chairman Ajit Pai penned a passionate dissent against it — is that it really would not have improved online privacy. It merely pretended to do so, instead boosting the ability of one set of Internet companies to use customers’ data at the expense of another set of companies.
Consider, for example, that most Americans use multiple ISPs in the course of a day — home, office and mobile. But as the Electronic Privacy Information Center observed in its comments on the FCC privacy rule, they only use one Google, one Gmail, one YouTube, one Apple (for apps like iMessage, which tracks the phone numbers you contact) and one Facebook. All of these latter — known in the regulatory lingo as “edge providers” — can track, use, and sell the data on your Internet use. They would have continued to be able to do so under the rule that Congress just repealed.
What the Obama FCC tried with this rule was to give Google, Facebook, and other “edge providers” a leg up by kneecapping competitors who want to harvest and sell the exact same personal use data to advertisers. And those “edge providers” arguably have access to much more — and to much more intimate — personal information than your ISP.
For example, your ISP cannot see encrypted traffic. And so, for example, it cannot use the contents of your private emails in order to help third-party advertisers serve you ads appropriate to your interests. Google can do that, and in fact, it already does.
This also means, assuming you use HTTPS (which everyone should be doing), that when you search for information on sexually transmitted diseases or watch movies on Netflix, your ISP cannot even see what you searched for or watched — not even the full URL. They only see that you visited Google.com or Netflix.com. Google and Netflix, on the other hand, see all the details. The rule just struck down would not have put any limits on how they can use that information.
This makes the FCC rule seem not only strangely ineffectual but also suspiciously like a favor to a special interest. Google and other large online companies would like to create barriers to entry into the business of selling users’ data. Business is good and certain large Internet companies don’t want to have to compete with other large Internet companies.
“[D]ue to the FCC’s action today,” Pai wrote when the rule was first handed down in October, “those who have more insight into consumer behavior (edge providers) will be subject to more lenient regulation than those who have less insight (ISPs). This doesn’t make sense… Nothing in these rules will stop edge providers from harvesting and monetizing your data, whether it’s the websites you visit or the YouTube videos you watch or the emails you send or the search terms you enter on any of your devices.”
The final lesson is that what you do on the internet is not private at all. It never was, so don’t act like it is. That’s part of the business model of the Internet we have, and part of the reason many of the apps you use — everything from the fitness tracker on your phone to the Google search service itself — exist in the first place. Without this model, an entirely different sort of Internet would have developed.
Perhaps new rules are needed that apply to everyone across the board. But the special rules for ISPs that were just struck down would have made very little difference to your privacy.
