This week, Congress voted to gut internet privacy regulations. The new legislation — which only needs President Trump’s signature to become law — would make it easier for internet providers like Comcast and Verizon to sell your browsing history and other information about your online habits to third parties. But just as giant carriers are seeing new avenues for data collection and ad revenue opening up, two California-based internet providers have pledged not to sell their customers’ browsing history, or any other data.
Sonic, a carrier with around 100,000 subscribers that offers service to most of California, and Monkeybrains, a San Francisco-based provider with around 9,000 subscribers, both promise to never sell your internet browsing history, subscriber information, or usage data.
“We're not in the business of selling data and we've never done so. We provide internet as a service and that’s it,” Alex Menendez, co-founder of Monkeybrains, told BuzzFeed News. “We have consistently had pro-consumer policies with regards to our privacy practices,” Dane Jasper, the CEO of Sonic, told BuzzFeed News. “We have a long history of differentiating ourselves that way.”
The Electronic Frontier Foundation consistently gives Sonic the highest marks on its annual scorecard “Who Has Your Back,” which evaluates the privacy and transparency practices of internet and technology companies. Monkeybrains counts the EFF as a client of its own. Both companies were among more than a dozen small-scale ISP and networking companies that publicly opposed the repeal of the internet privacy rules. But most Americans don’t have access to these services and have to rely on big ISPs for internet access.
Back in January, several major internet providers, including Comcast, Verizon, AT&T, Charter, and T-Mobile, voluntarily pledged to abide by a set of “ISP Privacy Principles” that rely on guidelines shaped by the Federal Trade Commission. However, there’s a crucial difference between these FTC guidelines and the more robust Obama-era rules that Congress just voted to overturn. The rules established that your browsing history is considered “sensitive” information, meaning that broadband providers first need to get permission before they can share it with third-party companies like advertisers.
The ISPs, in their privacy principles, made no such commitment. They favor the older FTC guidelines, where customers’ browsing history may be collected and shared by default, without your affirmative consent.
Now that a Republican-controlled Congress has voted to ensure these stronger rules won’t take effect, consumer advocates and former regulators have argued that key protections have been erased. Internet providers now have more freedom to make money off of your online activity.
"There is no reason to compete on privacy — that's the problem."
Under its privacy policy, AT&T, for example, states that it may collect: “IP addresses, URLs, data transmission rates and delays. We also learn about the pages you visit, the time you spend, the links or advertisements you see and follow, the search terms you enter, how often you open an application, how long you spend using the app and other similar information.”
“We or our advertising partners may use anonymous information gathered through cookies and similar technologies, as well as other anonymous and aggregate information that either of us may have to help us tailor the ads you see on non-AT&T sites,” the privacy policy states. “For example, if you see an ad from us on a non-AT&T sports-related website, you may later receive an ad for sporting equipment delivered by us on a different website. This is called Online Behavioral Advertising, which is a type of Relevant Advertising.”
When asked how they planned to use customers’ web histories if the rules were removed, AT&T, Verizon, and Sprint directed BuzzFeed News to their privacy policies. Comcast, Charter, and T-Mobile did not respond to queries about their use of browsing history. (Disclosure: Comcast Corp.'s NBCUniversal is an investor in BuzzFeed.)
On Friday, AT&T and Comcast both posted responses on their corporate websites pushing back against criticism that the repeal of the privacy rules would harm consumers.
"We had the same protections in place the day before the [repeal] was passed, and we will have the same protections the day after President Trump signs the [repeal] into law," said Bob Quinn, AT&T's senior executive vice president. "The Congressional action had zero effect on the privacy protections afforded to consumers."
Comcast's deputy general counsel and chief privacy officer, Gerard Lewis, said much of the debate onthe Congressional action on the privacy rules and customers' sensitive information was "misleading."
"In view of all the misinformation and inaccurate statements that have been made in the last week, we want to make sure that our customers understand how strong our privacy protections really are," Lewis wrote. "So we will revise our privacy policy to make more clear and prominent that, contrary to the many inaccurate statements and reports, we do not sell our customers’ individual web browsing information to third parties and that we do not share sensitive information unless our customers have affirmatively opted in to allow that to occur."
Telecom industry representatives and Republican lawmakers say they oppose the privacy rules because they unfairly target ISPs, while favoring web companies like Google and Facebook. Because the rules don’t apply to these companies, they can use their customers’ data to rake in ad dollars.
USTelecom told BuzzFeed News that the repeal opens up advertising opportunities for internet providers, which may be helpful to consumers. NCTA — The Internet & Television Association told BuzzFeed News that the repeal will allow internet providers to better compete in the advertising marketplace.
But privacy advocates and Democratic lawmakers have argued that internet subscribers need special protections for two main reasons. The first is that ISPs can monitor everything a person does online, so long as the traffic is unencrypted, which is something web services like Google and Facebook cannot do. Second, most Americans live in areas with only a single internet provider. That means they can’t switch to more privacy-friendly ISPs like Sonic or Monkeybrains; instead, they’re forced to accept the privacy practices of a single carrier if they want internet access.
“We don't believe that telephone companies should listen to our telephone calls,” Sonic’s Jasper said, using an analogy to describe how customers view their internet providers. “Carriers are in a different position, and that position is a trusted position in the minds of consumers.”
On platforms like YouTube and Gmail, for example, Jasper said there is a commonly understood relationship, where businesses provide a free service in exchange for advertising that’s shaped around tracking your behavior. This “implicit compact,” he argued, doesn’t exist between customers and their ISPs.
Jeff Chester, the executive director of the Center for Digital Democracy, told BuzzFeed News that he hopes consumer pressure might influence how internet providers modify their data collection, but absent strong regulations, he believes the economic incentives are too strong for the big ISPs to ignore. "There is no reason to compete on privacy — that's the problem,” he said.
“You could make the argument that it’s good business — and it is — but there are no regulations requiring any real privacy protections at all. If everybody is just buying and selling your data, then being the one that says 'No, I'll do better' does impact the bottom line."