The Federal Trade Commission today announced a broad inquiry into the privacy practices of internet service providers requesting large companies like AT&T, Verizon, and T-Mobile to hand over nonpublic information describing how they handle consumer data. It’s a major step toward monitoring and regulating how much data ISPs are allowed to collect on their customers, and how widely that data can be shared.
FTC Chairman Joe Simons hinted that he would be conducting this study last week, telling lawmakers that the FTC was “developing plans to issue 6(b) orders in the technology area.” It was assumed that the study would dive into the data practices of Big Tech, but today’s announcement instead surprisingly applies to ISPs.
“The FTC is initiating this study to better understand Internet service providers’ privacy practices in light of the evolution of telecommunications companies into vertically integrated platforms that also provide advertising-supported content,” the press release read. “Under current law, the FTC has the ability to enforce against unfair and deceptive practices involving Internet service providers.”
In the wake of major content acquisitions by Verizon and AT&T, many raised concerns that ISPs might use provider-level data to power a new kind of targeted ad business that would compete with Facebook and Google. In 2015, Verizon was caught tracking subscribers on Verizon-owned AOL sites using an unblockable “supercookie,” a practice that ultimately resulted in an FCC fine.
In 2016, the FCC approved new rules that would required ISPs to obtain explicit permission from subscribers in order to share their “sensitive” information. This included data like a subscriber’s financial, location, or app usage information along with the contents of their emails and other communications. However, under Chairman Ajit Pai the following year, the FCC blocked these new rules from going into effect, leaving it up to the FTC to determine how to regulate ISPs and their behavior as it pertains to data privacy.
In the FTC’s press release today, the regulator called on some of the largest ISPs like AT&T, Verizon, T-Mobile, Xfinity, and Google Fiber to provide information into what kind of data is collected, why it’s collected, whether this data is shared with third parties, de-identified, and the procedures allowing consumers to make changes or delete their personal information.
The FTC has given the companies up to 45 days to hand over the requested information.