Khan Wants Reassertion of FCC Authority on ISPs

The FCC has the “clearest legal authority and expertise” to “fully oversee” ISPs, Chair Lina Khan said during an FTC meeting Thursday. Trade commissioners voted unanimously to release a staff report on ISP privacy practices (see 2110180046), with all four agreeing it revealed important findings about data collection.

The FTC issued Section 6(b) orders in 2019 to AT&T, Verizon, Comcast, Google Fiber, T-Mobile, Charter Communications and advertising affiliates, limiting its study to July 2019 to July 2020. The report didn’t include recommendations for enforcement or legislation, but Democrats said it shows the need for congressional and agency action. The report shows many ISPs collect much consumer data that’s unnecessary for providing internet services and is on par with Big Tech, they said. Data was aggregated and anonymized, as required by confidentiality requirements in the FTC Act.

“Protecting consumer privacy is a key priority for the FCC," said acting FCC Chairwoman Jessica Rosenworcel in a statement. "I appreciate the FTC’s work to evaluate ISP privacy practices. We’re taking a close look.”

Khan supported efforts to reassert FCC authority and reinstate nondiscrimination rules, privacy protections and other basic requirements needed to create a “healthier market.” The report shows the FTC needs to consider in its transaction reviews how certain deals enable degradation of user privacy, said Khan. ISPs are surveilling consumers across the internet, which enables hyper-granular targeting, said Khan.

ISPs’ consumer surveillance is “truly staggering,” said Commissioner Rebecca Kelly Slaughter: There’s an urgent need for cross-agency and congressional action. The report highlights the “error” of the previous administration in rescinding the net neutrality order, she said, calling the FCC the expert telecom regulator. The report shows how absent FCC oversight, ISPs participated in a “race to the bottom” to partake in the “lucrative market of monetizing customers’ personal information,” she said: Slaughter hopes the FCC returns ISPs to their “proper classification” as telecom services under Communications Act Title II.

Given the FTC’s extensive portfolio of privacy and data security cases, her agency should retain authority over ISPs, said Commissioner Christine Wilson: “I am disappointed that some of my colleagues failed to appreciate the value that we add in this area and wish to give away our jurisdiction. I guess I shouldn’t be surprised given the disdain that current leadership has expressed, both for our staff and the important work of the agency. Moreover, I am disappointed by my colleagues’ choice to politicize the important findings of this study and thereby detract from the information.” She said such FTC studies are some of the agency's most important work, noting another study is underway on social media and video streaming services.

The report highlights the need for more transparency about ISP privacy practices and the choices they provide to customers, said Commissioner Noah Phillips. He didn’t “agree with everything in the report,” particularly the claim that targeted advertising is necessarily harmful to consumers. He raised concern about the study’s claims that privacy problems are the result and cause of market power. It’s theoretically plausible, but the findings go against some of these claims, he said. He highlighted the finding that ISPs can be “at least as privacy-intrusive” as Google, Facebook or Amazon. The document reflects “good work over a long period of time,” he said. Started by Republican Chairman Joe Simons and ended with Khan, it's a “good example of the bipartisan way in which the FTC functions when the policy process is allowed to work,” he said.

Many ISPs in the review amass large pools of sensitive consumer data, said Andrea Arias, Privacy and Identity Protection Division senior attorney, who presented some findings. Sensitive characteristics used for targeted ads included: race, ethnicity, sexual orientation, economic status, political affiliation and religious beliefs. That sensitive information raises civil rights issues, said Khan and Slaughter.

A “significant number” of ISPs share real-time location data with third parties, Arias said, which can be available to car salespeople, bounty hunters, bail bondsmen, property managers and others who may not have consumer interests’ in mind. Some ISPs combine data across product lines, she said. Some data collection is unnecessary for providing internet services, she said. A few ISPs use web browsing data to target ads, many profile consumers using sensitive characteristics, and at least three ISPs combine personal, app and web browsing activity for ad purposes, she said.

A USTelecom spokesperson emailed a statement: “As the FTC has called for numerous times, and as previously urged by USTelecom, Congress must enact a national, comprehensive federal privacy framework that puts consumers first and applies uniformly to all companies operating online.” The companies didn’t comment.

CTIA said in a statement: “Consumers’ online safety and privacy is a top priority for the wireless industry, and federal legislation that uniformly protects users across all platforms is the best way forward. We are looking forward to continuing to work with the FTC, lawmakers and companies across the ecosystem to ensure consumers are protected.”