The Federal Trade Commission’s forthcoming report on internet service providers’ privacy practices is expected to bring scrutiny to whether the industry’s control over content production and distribution impacts targeted advertising.
The report, set to be released at a public meeting Thursday, is looking at the personal information that internet companies collect on consumers or their connected devices and if that information is shared with third parties such as advertisers.
“Your internet provider could know a lot about you,” said Samir Jain, policy director at the nonprofit Center for Democracy and Technology. Aside from seeing where consumers are going online, internet providers that are also cable television providers could have insight into what consumers watch, along with information on their location and personal account data like names, addresses, or payment methods, Jain said.
The FTC launched the internet provider study in 2019 under its consumer protection authority. Such studies allow the commission to demand data from companies and could reveal information that’s later used for enforcement actions against some or all of the companies involved.
Internet providers in the study include
One concern that led to the privacy study is whether the ownership structure of some providers allows for more targeted ads, Jain said. Comcast, for example, owns NBCUniversal, meaning it provides internet access while controlling TV content and delivery.
“Can they take information they learn about your browsing activity and use it to target ads on other related properties?” Jain asked. “That’s partly what this study is designed to explore.”
A spokesperson for Verizon declined to comment in advance of the report’s release. AT&T, Charter, and Google didn’t immediately respond to requests for comment.
A T-Mobile representative said “we look forward to the report,” and added that the company assisted the FTC in its efforts to study the industry. T-Mobile says on its website that it shares some information for advertising that doesn’t directly identify consumers. The company also gives consumers the ability to tell T-Mobile not to sell their data.
Comcast likewise says it doesn’t sell information that identifies its customers, and it doesn’t track the websites consumers visit or the apps they use through their internet connection.
The study highlights a policy divide between the FTC and the Federal Communications Commission, which regulates phone service providers as common carriers under telecommunications law.
Internet providers used to be considered common carriers, as part of the Obama administration’s approach to net neutrality rules.
In 2016, just before that year’s U.S. presidential election, the FCC issued internet privacy rules that gave consumers greater control over their service providers’ use and sharing of personal information. When
That left internet providers subject to the FTC’s oversight over unfair and deceptive business practices that impact consumers.
“The FCC had clearer rules and a cleaner legal authority,” said Justin Brookman, a former FTC official who directs consumer privacy and technology policy for Consumer Reports. “But the FTC’s authority is broader,” he said, potentially giving the agency room to argue that the data internet providers hold on consumers is so comprehensive that it should be protected as sensitive information.
The FTC’s report on privacy practices could signal upcoming enforcement actions as well as policy priorities, according to Mark Brennan, a partner at Hogan Lovells who leads the law firm’s technology and telecommunications practice.
“It will be important to see not only what the agency reports about the road it has traveled but what it signals about the road ahead,” Brennan said.
Though the FTC is limited in its policymaking abilities, one potential priority could be consumer consent. The FCC’s now-defunct internet privacy rules included a provision requiring that consumers opt in before their internet providers could use and share sensitive information about them.
Privacy advocates like the Electronic Frontier Foundation want the FTC to revisit that opt-in requirement, in part because of the way internet providers act as consumers’ so-called on-ramp to going online.
“They live in this bottleneck between the user and the internet itself,” said Adam Schwartz, a senior staff attorney at EFF. “They can watch everything customers are doing and use that information for their own ads or sell information or insights to advertisers.”
EFF isn’t proposing a ban on this practice, Schwartz said. Instead, the group is pushing for opt-in consent, as the FCC once required.
Some states, including Maine, have adopted their own privacy laws requiring internet service providers to get approval from customers before selling or using their personal information. ACA Connects and other industry groups are suing over the Maine law in a case that’s ongoing in the U.S. District Court for the District of Maine.