The U.S. Federal Communications Commission has finalized groundbreaking new rules that force all internet providers, like Verizon, Comcast and AT&T, to obtain explicit consent from subscribers before selling data about online behavior to third-party marketers.
That includes information about what websites you visit, mobile location information, app usage and other potentially sensitive details inadvertently collected in the course of using the internet at home or on a smartphone.
The FCC rules don't affect the way platforms like Google and Facebook use personal data for targeted advertising. Rather, companies that provide internet access are treated different from websites, in that they are providing a utility as defined by the network neutrality rules passed last year.
While the new ISP privacy rules are viewed by public interest advocates as a win for consumers, it's still not clear how effective the regulations will be.
That's largely because the current way online businesses notify and gain consent to collect user data is via privacy policies or license agreements that usually amount to long, arduous blocks of text on which everyone routinely clicks "Agree" in order to get past and then ignores.
If ISPs are able to fulfill the consent requirement this way, people may very well agree to data collection about their internet behavior without fully realizing what they're agreeing to.
Still, broadband providers aren't happy and would rather collect and use customer data without restriction.
There is no sound reason to subject broadband providers to a different set of rules than other Internet companies," said AT&T in a comment sent to the FCC, claiming broadband providers will be prevented from engaging in the lucrative digital advertising game.
AT&T announced plans to merge with Time Warner last weekend with the hope of expanding its online advertising operations, which could be affected by the new FCC rules.
Yet Google, which is scaling back its fiber program and totally dominates the online ad industry, also opposed the rules. In its comments to the FCC, Google said data ISPs collect about browsing history shouldn't require opt-in consent from subscribers; the company doesn't believe web browsing data contains sensitive information.
Still, the FCC rules are final. And if internet providers want to oppose them, they'll have to take the agency to court.
Here are the basics of the new rules:
- ISPs need to get consent, somehow, from subscribers before using or selling their sensitive data — browsing history, app usage, location information, financial data — to third parties, like online advertisers.
- ISPs do not need permission from subscribers to share non-sensitive information, which includes IP addresses, email addresses, service tiers or bandwidth usage. But internet providers must create a way for subscribers to opt out of sharing that information if they so chose.
- The new rules don't require internet companies to gain consent to advertise other communications services they provide. So if Verizon wanted to market its home broadband service to a current mobile user, that would be fine. If Verizon wanted to share browsing data with other parts of the company that do not provide communications services, like Yahoo, it would have to get consent. And there's no requirement to provide a way to opt out of internal marketing.
—By April Glaser, Recode.net.
CNBC's parent NBCUniversal is an investor in Recode's parent Vox, and the companies have a content-sharing arrangement. Comcast is parent of NBCUniversal and CNBC.