×

At least three states are trying to replace the online privacy rules nixed by Trump

Local lawmakers are exploring how to change the way internet providers collect and share users’ information.

hacking hacker computer security
David Woolfall | Getty Images

Now that President Donald Trump has scrapped online privacy rules imposed on the likes of AT&T, Comcast and Verizon, some advocates who seek greater protection of consumers' personal information are turning their attention to the states.

Lawmakers in at least three capitals — Maryland, Minnesota and Montana — are weighing new restrictions on the way internet providers and other companies can collect and share their customers' sensitive data, including their web-browsing histories, with advertisers.

Under President Barack Obama, the Democratic-led Federal Communications Commission in Washington last year advanced rules that would have required broadband providers to obtain customers' permission before selling their information. But Republicans in Congress voted this month to scrap the FCC's previous order, and Trump signed the measure on Monday.

That's a major victory for the telecom sector, which also opposed the privacy rules — but it has prompted privacy advocates to turn their attention to the states in the hope that local leaders can rein in the industry.

"Congress was doing this to add to the profit of the telecom industry, [and] I think it really rubbed people the wrong way," said Michelle de Mooy, the director of the Privacy and Data Project at the Center for Democracy and Technology, a D.C.-based consumer group.

For now, that's why she and others are trying to "focus on the states and [make] sure they are crafting good solid legislation that will survive a challenge," de Mooy said, should telecom companies later try to sue.

Some privacy advocates will take their case today to the Maryland General Assembly, where lawmakers are holding a hearing on a bill that would penalize internet providers that don't obtain "the consumer's express and affirmative permission" to sell or transfer personal data, particularly for advertising.

Making the case for reform is Laura Moy, the deputy director of the Center on Privacy and Technology at Georgetown University Law Center. In testimony, she said that consumers might share information with internet providers but "do not expect ISPs to collect, retain and use that information to make money off of them."

There and elsewhere, however, telecom giants don't favor state action. AT&T and Verizon also plan to testify in Maryland today, though they did not immediately respond to requests for comment. Yet one of their leading trade associations, USTelecom, said in a statement to Recode that the FCC and its sister agency in Washington, the Federal Trade Commission, already are competent cops of the beat.

"Individual state efforts that deviate from a strong, consistent federal privacy framework do not fit with how consumers traverse the global internet and are more likely to harm consumers and internet innovation than help," a spokeswoman said.

In Montana, meanwhile, local lawmakers inserted into their 2018-2019 budget a rule that blocks internet providers from winning state contracts if they don't obtain customers' consent before selling their information.

Minnesota lawmakers took action at the end of March: Their draft law, too, takes aim at local providers that aren't seeking consumers' affirmative consent. Citing the effort to overturn the FCC's rules in Washington, one local pol said his colleagues should be "outraged at the invasion that's being allowed on our most intimate means of communication."

Maryland, Montana and Minnesota are not alone in pursuing online privacy legislation: Other states, like Illinois, have taken aim in recent months at other potential threats to consumers' information, such as the way companies collect data about a smartphone owner's location. In the nation's capital, meanwhile, lawmakers including Massachusetts Democratic Sen. Ed Markey, who unveiled his own reform bill Thursday.

"Americans should not have to forgo their fundamental right to privacy just because their homes and phones are connected to the internet," Markey said in a statement.

By Tony Romm, Recode.net.

CNBC's parent NBCUniversal is an investor in Recode's parent Vox, and the companies have a content-sharing arrangement. Comcast is the owner of NBCUniversal, the parent company of CNBC and CNBC.com.