Online in the US? Everything you do is for sale. On 28 March, the US passed in the late days of the Obama administration, which would have required internet service providers (ISPs) to they collect about their customers to third parties from the end of 2017. This isn’t just another small erosion of our dwindling privacy on the internet: it’s more fundamental, and worrying, than that.
The repeal eliminates any requirement by the Federal Communications Commission – which oversees internet regulations in the US – that ISPs get consent from their customers before collecting and selling sensitive data: not just your web browsing history, but also geolocation data, financial information – such as who you bank with – and metadata.
This sounds like ISPs are just getting the same deal as tech firms like Facebook and Google. When you use their services, they can use any data you may generate in the process as they wish, without having to seek your consent or tell you what they have shared. It’s the deal for using their services.
Advertisement
But the comparison doesn’t work. For one thing, Facebook and Google are free: you trade access to your data for their services. An ISP, by contrast, gets paid by people using their services and so cannot credibly use the same logic.
Data disclosure
More importantly, though, Facebook and Google are optional. You can avoid Google’s data hoover by choosing a more data-protection friendly search engine, for example. But ISPs operate at the infrastructure layer of the internet. In that sense, they aren’t “optional”. You can’t vote with your feet. “If all ISPs collect and sell your data, it is impossible to use the internet without giving up your privacy,” says Jeanette Hofmann, director of the Alexander von Humboldt Institute for Internet and Society, Berlin.
And because ISPs aren’t required to disclose what data they share about you, you will never know exactly what they are gathering or where that data goes.
So who can they sell it to? The Obama ruling explicitly mentioned advertisers, but not because ISPs are restricted to selling your data to them. It’s just that advertisers are currently the highest bidder, and it might be damaging to an individual ISP’s reputation if it got out that they were selling individual customers’ data to, say, a pharmaceutical company. The absence of a rule means that if an ISP puts something into their privacy policy, they can sell the data to whoever they wish.
However, it might now become more interesting for ISPs to analyse your email account in more detail, using a technique called to look for mentions of certain drugs, and then, for instance, bundling those users’ information to . It is likely that has already used this method in the past to target ads at customers.
For now, not much will change after the repeal, since the scrapped law wasn’t due to go into force until the end of 2017.
Precedent set
But what worries many is the precedent it sets for people in the US. In comparison with European Union directives like the right to explanation and the right to be forgotten, it’s hard not to see this as relegation of Americans to digital second-class citizenship, says John Havens, who runs the IEEE Ethics Initiative in New York City.
The coming internet of things will exacerbate the problem, as it will offer even more of your personal data to your ISP, thanks to connected thermostats, smart fridges, lightbulbs and the like. Again, it is easy to say these devices are optional. But how long before they become standard in housing?
The new ruling also bars the FCC from ever adopting any similar rules to govern ISP collection and behaviour in the future.
There are some small measures you can take to protect your data. Different ISPs let you opt out of different data collection: you can call each ISP and ask them what the opt in and opt out policy is, and to whom they sell data. One way to minimise what they see is to visit sites which use https.
Another possibility for protecting your data may arise. In 2013, AT&T began to charge about $29 extra per month to customers who didn’t want their traffic analysed using deep packet inspection. So take heart, Americans. You don’t have to be second-class citizens – if you’ve got the cash.
