By Lauren Reynolds, Rose Law Group attorney focusing her practice on Cyber Security and Dan Gauthier, law clerk
Congress in March voted to repeal Federal Communications Commission (FCC) privacy rules, which would have required Internet service providers (ISPs) to obtain consent before selling their customers’ personal information to third-parties. In this context, personal information includes browsing and app histories, location data, and other information gathered by ISPs from their customers. The FCC’s rules would not have affected edge providers (i.e. Facebook, Google, Amazon and other content providers), which are regulated by the Federal Trade Commission (FTC). Currently, neither ISPs nor edge providers require consumer and user permissions to sell their data to third-parties.
When news broke of the repeal of the rules, privacy advocates threw up their hands in frustration. In their view, the FCC privacy rules were not perfect, but at least they were a first step toward consumers having a say in how their data are used. Without any sort of rules in place, it is unclear to what extent the FCC can regulate ISPs or the FTC can regulate edge providers. But clarity may be on the horizon. Representative Marsha Blackburn last week, introduced the Browser Act (or the “Balancing the Rights of Web Surfers Equally and Responsibly Act of 2017”).
The Browser Act would require both ISPs and edge providers to obtain consumer consent before permitting use, disclosure, or access to consumer “sensitive user information.” The Browser Act defines “sensitive user information” to include financial and health information, information relating to children under 13, Social Security numbers, location data, content of communications, Web browsing history, and software or app usage history. This definition is equivalent to the FCC’s repealed rules, which would have applied only to ISPs, but broader than in the FTC’s current guidance, which covers edge providers. The Browser Act would also require ISPs and edge providers to afford consumers the option of preventing the use, disclosure, and access to non-sensitive information. The Browser Act would preempt state and local laws, as well as current or future FCC privacy rules.
Enforcement power would instead be given back to the FTC, which is important, Blackburn says, so “we have one regulator, one set of rules [and] everybody knows who’s in charge.” But the Browser Act has a long way to go before becoming law.
The Internet Association, a lobbying group representing companies such as Facebook, Google and Amazon, has already voiced its opposition. “This bill has the potential to upend the consumer experience online and stifle innovation,” a spokesman said in an official statement. That is possible, but the edge providers’ opposition to the bill is no surprise, since they arguably have the most to lose. The two biggest players in digital advertising – Google and Facebook – are slated to make a combined $106 billion from advertising in 2017, according to market research firm eMarketer. Targeted advertisements are highly dependent on user data. Requiring consumer opt-in consent to sell that data would undoubtedly affect the content providers’ bottom lines.
Consumers will also see drastic changes if the bill becomes law. For one, there is a benefit to targeted advertising. Targeted advertising often uses incentive-based initiatives, such as discounts and offerings to a limited population, which some would argue results in happier customers. More importantly, requiring consent to sell consumer data would cause a shift in the industry’s pricing model. For example, consumers “pay” for their Facebook memberships with their data. If Facebook cannot utilize consumer data, it will be forced to make money some other way. Facebook and other providers may choose to start charging a monthly fee for users who do not provide permission for the sale or use of user data.
It is not clear how much support the Browser Act has in Congress, and it is not certain the bill will come up for a vote. Even if there is a vote, the Browser Act would still require the president’s signature. With the Administration’s efforts to deregulate, it may be difficult to pass any legislation that proposes unprecedented restrictions. The Browser Act has been referred to the House Energy and Commerce Committee. No hearings have been scheduled as of this writing.
