ISPs could sell your Web history

March 27, 2017

US Senate voted to eliminate privacy rules that would have forced ISPs to get your consent before selling Web browsing history and app usage history to advertisers. Within a week, the House of Representatives could follow suit, and the rules approved by the Federal Communications Commission last year would be eliminated by Congress.

So what has changed for Internet users? In one sense, nothing changed this week, because the requirement to obtain customer consent before sharing or selling data is not scheduled to take effect until at least December 4, 2017. ISPs didn’t have to follow the rules yesterday or the day before, and they won’t ever have to follow them if the rules are eliminated.

Senate Democrats warned before yesterday’s vote that ISPs will be able to “draw a map” of where families shop and go to school, detect health information by seeing which illnesses they use the Internet to gather information on, and build profiles of customers’ listening and viewing history.

The Senate vote was 50-48, with every Republican senator voting to kill privacy rules and every Democratic senator voting to preserve them.

ISPs can’t see encrypted traffic, so if you visit an HTTPS site, ISPs will see only the domain rather than each page you visit. But that’s still plenty, said Dallas Harris, an attorney who specializes in broadband privacy and is a policy fellow at consumer advocacy group Public Knowledge.

Before the February 2015 reclassification, ISPs could have been punished by the FTC for violating customers’ privacy. But following the FTC rules wasn’t too onerous—the FTC recommends opt-in consent before selling or sharing the most sensitive information, like Social Security numbers, financial information, and information about children. But ISPs could use an opt-out system for everything else, including Web browsing history.