The U.S. House of Representatives voted last week to block the Federal Communications Commission from moving forward with rules meant to safeguard internet users' browsing history from exploitation by Internet Service Providers, as well as to prevent the federal agency from creating similar rules in the future.
President Donald Trump signed the legislation earlier this week.
Privacy advocates say the action, taken under the Congressional Review Act, will make it easier for these ISPs—telecom companies that provide Americans with the basic ability to use the Internet—to sell your browsing history to third parties and even the government without your permission or knowledge.
"If I were at Comcast, AT&T or Verizon, what I would do now is use people's browser information, their application use, the geolocation information that the rule would have prevented me from using without permission," says Ernesto Falcon, an attorney with the Electronic Frontier Foundation, an internet security nonprofit based in San Francisco. "And I'll do it without consent, because if the FCC tried to push back, what I would say if this goes to court, 'Well, Congress said you can't interpret the law in that fashion.'"
Falcon's concerns were echoed by an American Civil Liberties Union attorney.
"It is extremely disappointing that Congress is sacrificing the privacy rights of Americans in the interest of protecting the profits of major internet companies including Comcast, AT&T, and Verizon," ACLU Legislative Counsel Neema Singh Guliani said in a prepared statement.
The legislation was sponsored by U.S. Sen. Jeff Flake, an Arizona Republican who told the Arizona Republic that blocking the FCC's efforts to regulate privacy on the internet was a "good thing" because those regulations should instead be under the purview of the Federal Trade Commission.
All of the Republican members of the Arizona House of Representatives voted in favor of the legislation, including Southern Arizona Rep. Martha McSally (R-AZ02). McSally echoed Flake's suggestion that the FTC should have the responsibility to safeguard consumer privacy rather than the FCC.
McSally spokesperson Kelly Schibi said that McSally "cares deeply about internet privacy. She understands why her constituents are concerned about it, and she is as well. That's why she thinks we need an entirely new privacy framework protecting consumers. The FTC is better equipped than the FCC to protect consumers because they already have decades of experience in doing so. Rep. McSally is already engaged in dialogue with the Commerce Department and is writing a letter to the FTC urging them to work with Congress to create this new framework that would enhance consumer privacy on the internet."
But Falcon said the central flaw with that argument is that the FTC does not have authority to regulate ISPs, because the FCC determined in 2015 that ISPs were to be considered "common carriers" under the 1996 Telecommunications Act. The FCC took that step so it could create and enforce "net neutrality" laws that would prevent an Internet provider from providing favored access to some websites while choking off access to others. Advocates of a free and open internet say that net neutrality is vital because without it, cable companies could slow down web services owned by their competitors or require them to pay special fees. Imagine, for instance, if AT&T, which owns Time Warner, decided to slow down a Netflix data stream unless Netflix agreed to pay an additional fee for the telecom to carry its data. Congressional Republicans, including McSally, voted last year in favor of the No Rate Regulation of Broadbrand Internet Access Act, which would have prevented the FCC from being able to regulate the rates that broadband companies can charge. Critics of the legislation said the bill's broad scope would also have potentially prevented the FCC from enforcing net neutrality rules. The legislation, which was pushed by telecoms, died the Senate.
Once the FCC made the determination that ISPs were common carriers for the purposes of regulation, it then had to create new rules about protecting data because the FTC can't regulate common carriers. Those regulations—including requirements that ISPs could not share your browsing data without your written permission and had to safeguard your data from hackers—were finally established just before last year's presidential election, over the objections of telecoms, which see mining their customers' data as a potential revenue stream.
McSally spokesperson Schibi pointed out that the congressional action to block the FCC rule doesn't change the status quo because the rule had not yet taken effect.
Falcon countered that even though the rule had yet to kick in, ISP providers still had to be cautious about selling or otherwise exploiting browser history and other customer data because they didn't know exactly how the FCC would respond.
"The cable companies knew they were under the obligation to keep people's information safe," Falcon said. "They knew they had a duty to keep confidential information secured. What they weren't sure of was how far the law stretched. So they kind of operated in a gray area."
McSally's political opponents are already working to inform voters that she voted alongside her fellow Republicans to undermine the FCC's privacy rules. The Democratic Congressional Campaign Committee last week targeted McSally with a robocall campaign in her swing district.
"Rep. McSally just voted to allow internet providers, like Comcast and Verizon, to sell your sensitive personal information to other companies—all without your consent," the call's script read. "Thanks to House Republicans, your internet browsing history, personal health and financial information and even location, can be sold to the highest bidder. Call Representative McSally to ask why she cares more about corporations than your personal privacy."
DCCC spokesman Tyler Law said in a prepared statement that McSally "put corporate interests over the private, personal interests of Arizonans, and families in her district should be deeply troubled."
Southern Arizona Democrats in the House of Representatives opposed the move to block the FCC.
"Allowing Internet Service Providers to collect and sell consumer data without permission is unreasonable," said Rep. Tom O'Halleran (D-AZ01). "Consumers deserve a basic level of privacy, and Congress must work in a bipartisan way to craft rules and regulations that protect the rights of the American people."
Congressman Raul Grijalva (D-AZ03) said the decision "leaves the user with no real say in how their broadband service providers use their personal information. That is a fundamental violation of privacy with no guarantee, by the way, that their data will be kept reasonable secure."
Correction: This story originally misidentified the Electronic Frontier Foundation.
