Newsroom

11 organizations write a letter urging Chairman Wheeler and Commissioners to vote next week to pass strong broadband privacy rules and not to yield to industry calls to weaken the current privacy proposal. --- October 20, 2016 Re: WC Docket No. 16-106, Protecting the Privacy of Customers of Broadband and Other Telecommunications Services Dear Chairman Wheeler and Commissioners: As you approach the date to vote on a final order in the above-referenced proceeding, American Civil Liberties Union, Benton Foundation, Center for Democracy & Technology, Center for Digital Democracy, Color Of Change, Consumer Action, Consumer Federation of America, Electronic Frontier Foundation, Free Press, New America’s Open Technology Institute, and Public Knowledge urge you to take a strong stance on broadband privacy and to improve the current proposal in modest ways. In particular, the Commission must not to yield to calls from CTIA, TechFreedom, T-Mobile, AT&T, and others to severely limit the scope of covered “sensitive” information, nor otherwise weaken the privacy proposal as outlined in the fact sheet. With respect to this sensitive information determination, there are clear statutory requirements and policy rationales for setting the privacy obligations of telecommunications providers apart from and above the privacy obligations of other kinds of companies across the economy. The FCC has a mandate to protect the privacy of broadband ISP customers, and to comply with that mandate it should adopt rules that require opt-in consent to share all web-browsing history, app usage, IP addresses, and MAC addresses. Telecommunications Privacy Is Important As Title II of the Communications Act recognizes, network access providers have a heightened obligation to protect consumer privacy. The higher standard for telecommunications carriers derives from the special role of network access. Broadband access in particular is increasingly necessary for finding gainful employment, education, access to housing, and full participation in economic and civic life. It is in society’s best interest for people to use network access not only for these vitally important activities, but also as a trustworthy platform for free and unfettered First Amendment activities, including association, political speech, reading and learning, and the expression of all viewpoints, including those that are unpopular, dissenting, or held by a minority of people. Protecting the privacy, openness, and security of broadband is also of central importance to democracy and social movements. Hundreds of years ago, geography strictly limited the development and expansion of communities. Friendships, coalitions, and associations rose up and grew on a local basis—as many do today. But today, thanks to the power of the internet, not only do we build communities in cities and neighborhoods; we also build communities that leap across deserts and oceans, that cross borders and aren’t defeated by time zone shifts and language barriers. It is difficult to imagine Occupy Wall Street, Black Lives Matter, or the Arab Spring without the power of the internet. To protect and uphold the internet as this crucially important platform for both expression, association, and economic activities, we must minimize privacy concerns by ensuring that network access providers are subject to the highest privacy obligations, as the law requires. Privacy concerns can chill both adoption and use of the internet. As a 2010 FCC survey found, 57% of Internet non- adopters felt online activities made it too easy for theft of personal information. The FCC concluded in the National Broadband Plan that concerns about online privacy and security “may limit [consumers’] adoption or use of broadband.” More recently, NTIA reported that 45% of households limited their online activities because of privacy and security concerns. And in January, focus groups examining adoption challenges in Portland, Oregon universally raised privacy concerns. We want people to get connected, and we want them to use the internet without fear that the things they do and say online will be shared, sold, and exploited without their knowledge or otherwise used against them. In no event should people have to choose between protecting privacy and getting online. Telecommunications Providers Have Special Insight into Our Private Lives Broadband privacy is also of particular importance because, as gatekeepers to the network, telecommunications providers are uniquely positioned to gain insight into the private lives and communications of their customers. In the words of former FCC Commissioner Michael Copps, ISPs “collect extensive information about all of their customers, including location, web browsing and app use history, when and with whom they communicate, and even the content of those communications.”10 He noted, “In short, nearly everything a consumer does online is visible to his or her ISP.” Indeed, consumers have no choice but to share intimate details about their most private activities with their ISP. Just as we have to tell the postal service who we write to, when, and how often—just as we have to tell phone companies similar details about our calls—we have to tell ISPs where we go, what we say, and what we read online so they know how to direct Internet traffic. This is of particular concern as the Internet of Things expands, and data regarding network use may reveal information about the types of connected devices consumers have in their homes, and when, how often, and how much those devices are used. Nor does the growth of encryption protect consumers’ online activities from their ISPs. Truly pervasive encryption may never happen, and even if it does, it is still a long way off. Moreover, as privacy law expert Paul Ohm recently testified before Congress: "Even for user visits to websites that deploy encryption, a BIAS provider retains a significant ability to observe. When you visit a website protected by the most widespread form of encryption in use, https or http over TLS, even though your BIAS provider cannot tell which individual page you are visiting on the website, it still can tell the domain name of the website you are communicating with, how often you return, roughly how much data you send and receive, and for how long each visit lasts." Despite ISPs downplaying the window they have into their customers’ online activities, there is no question that they are well-positioned to learn a great deal about their customers’ lives. The FCC Should Not Replicate the FTC’s Approach The heightened privacy obligations set forth by Congress in Title II of the Communications Act establish the legal basis, just as the importance of network access and unique nature of network providers’ insight into private lives establish the policy basis, for the FCC to promulgate strong privacy rules for broadband providers. In recent weeks, however, a number of industry commenters appear to have fundamentally misunderstood or underestimated the justifications for strong broadband privacy rules. Several do not seem to understand that these justifications mandate a stronger broadband privacy framework than the general privacy protections enforced by the FTC for the rest of the online ecosystem. For example, TechFreedom suggests that “the FCC follow the FTC’s substantive approach” and interpret the FCC’s various authorities under the Communications Act similarly to how the FTC has interpreted its § 5 authority. The Future of Privacy Forum asserts, “the FCC has an opportunity to make distinctions that reinforce the FTC’s standards.” But the Communications Act and the FTC Act protect privacy in different ways and for different reasons. As privacy advocates have previously written, quite obviously the FCC is not the FTC, the Communications Act is not the FTC Act, and § 222 of the Communications Act is not § 5 of the FTCA. In contrast to the heightened and specific privacy protections set forth in § 222, the FTC’s privacy approach stems from its broad consumer protection authority and its general mandate. In the FTC’s own words, “no other federal agency has the FTC’s breadth of authority to protect consumers from many unfair or deceptive practices across the economy and to obtain redress for consumer harm.” In contrast, the task before the FCC is not to set a baseline for all consumer privacy across the entire information ecosystem, but to enact strong and specific privacy protections for telecommunications customers. Therefore the idea that the FCC should “follow” or “reinforce” the FTC’s privacy approach makes no sense, and the FCC should not do so. Conclusion The below-signed organizations appreciate the hard work this Commission has done and is doing to protect consumer privacy. We urge you to vote next week to pass strong broadband privacy rules, and not to yield to industry calls to weaken the proposal. The legal and policy reasons for heightened consumer privacy protections for telecommunications customers are clear. Sincerely, American Civil Liberties Union Benton Foundation Center for Democracy & Technology Center for Digital Democracy Color Of Change Consumer Action Consumer Federation of America Electronic Frontier Foundation Free Press New America’s Open Technology Institute Public Knowledge --- See full letter attached.

Washington, DC: Federal Communications Commission Chairman Tom Wheeler announced today (link is external) that he is circulating a broadband ISP privacy proposal to the other four FCC Commissioners detailing a plan that would provide individuals with key safeguards regarding their data. The proposal is designed to help implement the FCC “Open Internet” order to ensure that ISPs respect the privacy of communications over broadband and mobile networks. The following can be attributed to Katharina Kopp, Deputy Director, Center for Digital Democracy: We laud the timely development of a rule that would require ISP customer permission before much of their personal information may be used or shared. This proposal offers consumers the much needed safeguards and desired control over their own personal information. For the first time, ISPs would have to obtain customer consent for the use of web browsing and app usage history for advertising purposes. Given the unique position of ISPs as gatekeepers to vast amounts of customer data, the FCC’s proposed broadband privacy rule is a critical step in preserving a free and open Internet into the 21st century. Because we know that ISPs’ big data analytical capabilities can turn seemingly non-sensitive information into highly private information about our lives, and because all our browsing data and the content of our communications is incredibly sensitive to begin with, we had asked the FCC to avoid drawing distinctions between “sensitive” and “non-sensitive” categories of information. Still, we believe that the proposal’s framework can work for consumer privacy provided the FCC’s definition of “sensitive” is robust and meaningful. We will work to ensure this proposal is effectively implemented and that ISP broadband consumers receive the privacy protections they deserve. The Center for Digital Democracy is a leading nonprofit organization focused on empowering and protecting the rights of the public in the digital era.

Washington, DC (August 29, 2016) – The Electronic Privacy Information Center (EPIC) and the Center for Digital Democracy (CDD) today filed a complaint with the Federal Trade Commission, stating that the WhatsApp plan to transfer user data to Facebook is unlawful and that the FTC is obligated to block the proposed change in business practices.The EPIC-CDD complaint responds to a recent announcement from WhatsApp that the company plans to disclose the verified telephone numbers of WhatsApp users to Facebook for user profiling and targeted advertising.“When Facebook acquired WhatsApp, WhatsApp made a commitment to its users, to the Federal Trade Commission, and to privacy authorities around the world not to disclose user data to Facebook. Now they have broken that commitment,” said Marc Rotenberg, President of EPIC. “Clearly, the Federal Trade Commission must act. The edifice of Internet privacy is built on the FTC’s authority to go after companies that break their privacy promises.” Facebook and WhatsApp are the two largest social network services in the world. According to Wikipedia, WhatsApp has over one billion users. Facebook purchased the company in February 2014 for 19.3 billion dollars.EPIC Consumer Protection Counsel Claire Gartland explained, “In 2014, the FTC said that WhatsApp had to obtain affirmative consent to transfer user data to Facebook. There was an opt-out provision but that only applied to new information. Since WhatsApp intends to transfer user telephone numbers, which is not new data, it must obtain opt-in consent.”Gartland continued, “The phone number may also be the single most valuable piece of personal data obtained by WhatsApp. WhatsApp users are required to provide a verified phone number to use the service. And the phone number provides a link to a vast amount of personal information.”“The proposed change – an opt-out for data previously obtained – is exactly what the FTC said WhatsApp could not do,” said Gartland. “The transfer is only allowed if the consent is opt-in.”“The FTC has an obligation to protect WhatsApp users. Their personal information should not be incorporated into Facebook’s sophisticated data driven marketing business,” said Katharina Kopp, Ph.D., and CDD’s Director of Policy. “Data that was collected under clear rules should not be used in violation of the privacy promises that WhatsApp made. That is a significant change that requires an opt-in, according to the terms the FTC set out. It’s not complicated. If WhatsApp wants to transfer user data to Facebook, it has to obtain the user’s affirmative consent.”In 2011, EPIC, CDD and more than a dozen consumer privacy organizations pursued a successful complaint at the FTC that led to a twenty-year consent order after Facebook changed user privacy settings in a way that made users' personal information, such as Friend lists and application usage data, more widely available to the public and to Facebook’s business partners.Former FTC Chair John Liebowitz said at the time, “Facebook is obligated to keep the promises about privacy that it makes to its hundreds of millions of users. Facebook's innovation does not have to come at the expense of consumer privacy. The FTC action will ensure it will not."When Facebook proposed to acquire WhatsApp in 2014, EPIC and CDD said the FTC must protect the privacy of WhatsApp users. The FTC said that WhatsApp must continue to honor its privacy promises to consumers.The FTC warned, “If the acquisition is completed and WhatsApp fails to honor these promises, both companies could be in violation of Section 5 of the Federal Trade Commission (FTC) Act and, potentially, the FTC's order against Facebook.”The Federal Trade Commission has previously undertaken investigations against many firms that have engaged in unfair or deceptive trade practices.The Electronic Privacy Information Center (EPIC) (link is external) is a public interest research center in Washington, DC. EPIC was established in 1994 to focus public attention on emerging privacy and civil liberties issues and to protect privacy, freedom of expression, and democratic values in the information age. EPIC maintains one of the most popular privacy web sites in the world - epic.org (link is external) - and pursues a wide range of program activities including policy research, public education, litigation, publications, and advocacy. The Center for Digital Democracy (CDD) is recognized as one of the leading consumer protection and privacy organizations in the United States. Since its founding in 2001 (and prior to that through its predecessor organization, the Center for Media Education), CDD has been at the forefront of research, public education, and advocacy protecting consumers in the digital age.REFERENCESEPIC/CDD, In the Matter of WhatsApp: Complaint, Request for Investigation, Injunction, and Other Relief (Aug. 29, 2016),https://epic.org/privacy/ftc/whatsapp/EPIC-CDD-FTC-WhatsApp-Complaint-20... (link is external)FTC, “Enforcing Privacy Promises” (2016),https://www.ftc.gov/news-events/media-resources/protecting-consumer-priv... (link is external)FTC Press Release, “FTC Notifies Facebook, WhatsApp of Privacy Obligations in Light of Proposed Acquisition” (Apr. 10, 2014),https://www.ftc.gov/news-events/press-releases/2014/04/ftc-notifies-face... (link is external)FTC Letter to FB and WhatsApp, "Letter From Jessica L. Rich, Director of the Federal Trade Commission Bureau of Consumer Protection, to Erin Egan, Chief Privacy Officer, Facebook, and to Anne Hoge, General Counsel, WhatsApp Inc.” (Apr. 10, 2014),https://www.ftc.gov/news-events/press-releases/2014/04/ftc-notifies-face... (link is external)FTC, "Facebook Settles FTC Charges That It Deceived Consumers By Failing To Keep Privacy Promises” (2011),https://www.ftc.gov/news-events/press-releases/2011/11/facebook-settles-... (link is external)FTC Consent Order with FB (2011),https://www.ftc.gov/news-events/press-releases/2012/08/ftc-approves-fina... (link is external)EPIC, In re WhatsApp,https://epic.org/privacy/internet/ftc/whatsapp/ (link is external)EPIC, In re Facebook,https://epic.org/privacy/inrefacebook/ (link is external)###

Americans face growing new threats to their personal privacy as phone and cable Internet service providers (ISPs), along with leading Internet companies, expand their ability to capture details about what we do online in order to target us with data-driven personalized advertising. This report examines AT&T, Comcast, Cablevision, Charter, Cox, Verizon, Dish, Time Warner Cable, Viacom, Google, News Corp. (Fox), Turner Broadcasting (Time Warner), and Disney, focusing on some of their recent data- and video-related advertising practices. ISPs have formed partnerships with powerful data brokers (including Acxiom, Krux, and Oracle Marketing Cloud), gaining new insights into our online and offline behaviors. They are incorporating state-of-the-art “Big Data” practices, such as “programmatic advertising” that instantaneously buys and sells individual consumers—to financial marketers, fast-food companies, and health advertisers, for example—all without the consumer’s knowledge. In the process, ISPs have transformed TV and digital video into a vast new source of personal information, analyzing set-top box and streaming-video data for our viewing habits, and combining that information with sensitive online and offline data (including financial, health, racial, ethnic, and location) to compile detailed “digital dossiers” on millions of Americans. The ability of an ISP and others to identify and target us regardless of what digital device we use, moreover, has effectively erased any privacy safeguards we may have enjoyed in the past when we switched between devices. The report provides more evidence of the “digital data arms race” that is further eroding consumer privacy: AT&T, through its AdWorks division, has developed a “cross-screen system to match users’ mobile, online and television devices together based on identifiers and systems” that the company has “access to.” It operates a “consumer insights platform” that uses “Big-Data” techniques to advance AT&T’s targeted-marketing objectives. Comcast is using Rubicon’s Advertising Automation Cloud, “one of the largest cloud and Big Data computing systems in the world, [which] leverages over 50,000 algorithms and analyzes billions of data points in real time” to buy and sell individuals to marketers. Verizon, by acquiring mobile-marketing-data company Millennial Media, gained access to customer data gathered by more than 60,000 apps, including “location, social, interest, and contextual” information. Millennial has “developed more than 700 million active server-side unique user profiles, over 60 million of which link multiple mobile devices and PCs to a single specific user ... ,” with some 175 million monthly unique users in the “United States alone.” The Federal Communications Commission’s pending proceeding on privacy should examine all the ways that broadband networks operated by Internet service providers gather and use consumer information today. The review and policy proposals need to address the data-targeting relationships that ISPs have with leading digital marketing companies, including ad exchanges, data brokers, and advertisers. The FCC should enact privacy and consumer protection rules that provide individuals with rights over their data—including a set of Fair Information Practices that address the current data practices of ISPs. These companies should not be allowed to share data with affiliates or to use information for marketing their services without the informed, prior consent of the customer. Policies for privacy are essential as well for a competitive digital video market. Otherwise powerful ISPs and other gatekeepers will control the key way programming is financially supported and distributed. --- Full report attached.