The Affordable Care Act is far from the only Obama-era policy Republicans want to take down now that they control the government. A set of internet privacy rules passed by the Federal Communications Commission last year has also become a target. Though it's received far less attention than healthcare or immigration, the rollback would affect millions of consumers and bring basic changes to how they use the internet—though they might not ever know it.
Companies like Google and Facebook can learn an awful lot about you based on what you search for, what pages you "like," and who your friends are. But your wireless company and in-home broadband provider could learn much more. Although Google uses encryption to protect your searches from prying eyes, these companies can potentially see what sites you actually end up visiting and when you visit them. Mobile carriers track your location and could keep tabs on how much time you spend using different apps. And they can sell that information to the highest bidder.
The current FCC rules, which have yet to go into effect, ban internet service providers and wireless carriers from selling many types of customer data—including web browsing history, location, and health information—unless you explicitly opt in. The rules do allow providers to sell certain types of less sensitive data, such as what type of data plan subscribers have, on an opt-out basis. But these gatekeepers to the internet have long envied internet giants like Google and Facebook. These massively wealthy companies couldn't exist without internet infrastructure to deliver their services. But they face fewer restrictions on data collection.
Now Senator Jeff Flake of Arizona plans to introduce a resolution to overturn the FCC rules, enabling internet providers and wireless companies to sell your data unless you explicitly opt out. "The FCC’s midnight regulation does nothing to protect consumer privacy," Senator Flake said in a statement to WIRED. "It is unnecessary, confusing and adds yet another innovation-stifling regulation to the internet."
Until last year, the broadband providers had to comply with a set of less stringent privacy rules imposed by the Federal Trade Commission, which allowed the companies to sell your browsing data. That changed in September when a federal court decided that because the FCC had reclassified broadband providers as utility-like "common carriers" in 2015, the FTC no longer had the authority to regulate them. The FCC quickly passed a new set of stricter privacy rules in October. The biggest changes won't go into effect until the end of the year, at the soonest1.
The broadband industry, unsurprisingly, never liked the new restrictions. Access providers have watched jealously as companies like Amazon, Google, and Facebook used their pipes to reap enormous revenues and become some of the most valuable companies on the planet. Now the broadband industry is working to become a bit more Google-like. Comcast bought NBC Universal. Verizon bought AOL and will soon own Yahoo as well. AT&T is trying to buy Time-Warner. All of these new consumer-facing acquisitions could benefit from the god's-eye view the broadband industry has into their customers' browsing habits. Verizon did exactly that with its controversial "supercookies" in 2012. These trackers collected all unencrypted web traffic on customers' devices and used that data to target ads.
Verizon eventually pared back the practice to collecting only data on Verizon-owned sites. But the industry clearly wants to have the option of turning "supercookies" on by default in the future. Earlier this year several industry groups sent a letter to Congress arguing that the FCC's broadband privacy rules confuse consumers because they only apply to access providers and not the Googles of the world.
Flake appears to be taking the letter to heart. His plan, first reported by Politico, is to use a seldom used law called the Congressional Review Act that allows Congress to overturn federal regulations within 60 days of when they take effect. It would also effectively ban the FCC from passing similar rules in the future, meaning that even if the Democrats retake the Presidency in 2021, the FCC still wouldn't be able to reinstate the privacy restrictions.
Flake describes his plan as the first step towards returning control of broadband privacy rules to the FTC. The catch is that as long as broadband providers are considered common carriers, the FTC has no authority to regulate them. But there are some older FCC privacy protections that will remain in place. "If Congress enacts a resolution disapproving of the FCC's broadband privacy rules, no enforcement 'gap' will be created," says former FTC chairman Jon Leibowitz. As long as the FCC has authority, he argues that a rollback wouldn't leave consumers entirely without privacy protections. That's because federal law allows the agency to fine companies that don't tell customers they're being tracked.
Even the new GOP-led FCC would presumably work quickly to pass a new set of privacy rules to avoid privacy anarchy. These would probably be more in line with the FTC's less restrictive rules. But courts may interpret "similar" rules as too close to those that Congress plans to roll back and prevent from being re-implemented says Lee Tien, a senior staff attorney at the Electronic Frontier Foundation. In that case, the FCC may not be able to implement any new privacy rules at all, and it will be up to Congress to pass privacy protections. "The Republicans have all the options," says Tien. "The question is what they want. Just as with health care, it becomes incumbent on them to decide."
Either way, the FCC would not be able to re-introduce the stricter rules if Flake's rollback succeeds. Barring a major public backlash, internet providers could soon start selling your browsing data to advertisers without your express permission. With all that data-envy, we have little doubt that they will.
1Correction 2/24/2017 at 2:00 PM ET: A previous version of this article said the FCC rules passed in October went into effect last month. The new, more strict rules won't go into effect until the end of the year at the soonest.
