Q&A: How Comcast May Still Sell Your Online Data Even Though It’s Promised Not To

Kevin Werbach. Image courtesy of the Wharton School.

Last month, Congress voted to repeal landmark online privacy rules written by the Obama administration. The rules, which were scheduled to take effect this year, required Internet service providers (ISPs) like Comcast, AT&T and Verizon to get permission before collecting and sharing customers’ online information.

The repeal sent consumers into frenzy — is Comcast telling advertisers what I searched for on Internet last night and making a profit off of it? What protections do I actually have? And though Comcast, AT&T and other ISPs have released statements saying they won’t sell people’s information, how long will these pledges endure?

Now that we’re somewhat removed from the immediate outcry over the repeal, Biz Philly sat down with Wharton legal studies and business ethics professor Kevin Werbach for his take on the state of online privacy. Werbach weighs in on what the repeal means for everyday Philadelphians and what Internet privacy might look like a few years from now. He also tells us why the repeal puts Comcast in the best position compared to all of the other telecom giants. 

What does the repeal of the FCC’s privacy protections mean?
The repeal has made it so that the FCC doesn’t have any consumer privacy rules for what broadband service providers can do with people’s data, and that’s a problem.

So are Internet service providers like Comcast and Verizon selling our web browsing history at this very moment or are there other protections in place that prevent them from doing so?
Yes, there are a number of other limitations that might restrict what providers like Comcast do. Providers do have their own privacy policies, for example. Just because it’s legal for them to sell your web browsing history, doesn’t mean they always will. And this might be specified in their privacy policy, which is a kind of contract with users to let them know that they won’t engage in a certain practice, and it also provides consumers some protection if they violate it.

Generally speaking, their privacy policies have limitations, but the issue is the privacy policies can first of all be changed at any time. And secondly, the policies tend to be fairly vague about what kinds of practices they limit.

Then some have argued that there are other laws like the Wiretap Act, laws dealing with privacy of communications that typically apply in a criminal law case. For example, I can’t record this conversation without consent of one of the parties. There are some arguments that those might come into play if an ISP is trying to sell browser history. But that’s an area of law that hasn’t been tested.

Why are commentators and experts so torn about what can actually happen? Some have claimed that ISPs won’t ever be able to sell people’s web browsing histories, while others like former FCC Chair Tom Wheeler in a recent op-ed have said that it’s absolutely possible. It seems like there’s so much misinformation, and this debate has been ongoing for years.
I don’t know if it’s misinformation or not. Right now, everything’s just speculation. There’s been a great deal of uncertainty about these rules because the challenge of the Federal Trade Commission not having any jurisdiction came out of the FCC’s decision about net neutrality. We’ve had several years of debates and legal challenges about that proceeding and then the Federal Communications Commission just adopted these privacy rules, finally, last year. During all this process, there hasn’t really been an opportunity for the ISPs to engage in any of these practices.

Right now, everyone is describing what they think will happen on both sides. No one can say definitively we’re sure this is what will happen. And the other challenge is what we’ve seen time and time again with technology and privacy, is that companies keep coming up with new business models and new practices that weren’t anticipated before. People tend to go to saying, oh, they’re going to just have a site that’s going to sell anyone’s browser history. But the fact is there are many different kinds of business practices one could imagine ISPs might engage in. No one really knows what they’re thinking, and who they’re talking to and what they might have in the works.

Can you say more about the FTC’s framework? ISPs say they support the FTC’s framework and they’ve also made arguments about consistency and fairness. Facebook and Google are regulated under the FTC, so telecommunications companies should be as well.
The Federal Trade Commission regulates unfair and deceptive practices. It’s an enforcement agency rather than a law-making agency. What that means is they have various kinds of guidelines and they also now have case law, but they don’t typically say, this kind of practice is required ahead of time. In particular, they have generally not required companies to get opt-in consent before they collect information. Their framework is mostly about clear disclosure to companies of what policies are, following the policy, and giving customers the opportunity to opt out. Whereas the FCC rules for ISPs require affirmative consent before collecting information.

Why are Facebook and Google regulated are under the FTC and ISPs under the FCC?
The FCC has narrower jurisdiction. It regulates communications providers. Whereas the Federal Trade Commission can deal with any company in the economy except where its governing statute has an exclusion. And traditionally, telecommunications carriers were the small number of regulated phone companies that have historically had all kinds of FCC rules about their prices and their practices. And a Federal Trade Commission law said that should all be left to the FCC.

All of these laws are outdated. The broader point is that what’s taking place is a process of convergence and companies like Google and Facebook, which started off in a very different set of markets from companies like Comcast and AT&T, are now in some areas competing. That’s an evolution that everyone can see, but Congress hasn’t been willing to actually adapt the laws to reflect that change in the industry.

ISPs have said that the repeal won’t change much for consumers and that things are going back to the way they were especially because the FCC regulations hadn’t gone into effect yet. What is your response to that?
There are a number of things in play here. No one knows exactly what’s going to happen. The level of outrage about this decision is really a good indication that people across the political spectrum care a great deal about privacy. And they’re not eager for companies to engage in more invasive practices.

These companies like Comcast, Verizon, and AT&T are honorable companies, and I don’t think they’re thinking about, how can we abuse our customers? The question is where should the lines be drawn? Should we be moving in the direction of greater protection of privacy or moving in the direction where we basically say, we’ll just have to trust that the companies will do the right thing. It’s a problem that we have this imbalance in terms of how different companies are treated, but the answer is not just take one set of the companies out of the rules entirely.

And if the repeal won’t change much as the ISPs have said, why would companies like Comcast pour so much money into lobbying to get protections rolled back?
I think these companies pushed on this because this is the one piece of those net neutrality rules that they can be easily reverse because it just requires a Congressional resolution. Actually reversing the net neutrality rules is going to be considerably harder.

And they are very concerned with the Googles of the world. They do feel, from my conversations with people at those companies, that it’s unfair that they are limited in their ability to engage in certain business practices they think these other companies can do.

Some ISPs like AT&T have made the argument that the repeal opens up pathways for innovation. What kind of innovation do you see coming out of this for ISPs?
I’m not sure I see that much. They’ve argued that when there are fewer regulations there will be more innovation, which is not necessarily true. Interestingly, in a lot of these areas, innovation actually comes from regulation because companies have to think about, how do I achieve my business goals while still protecting consumers? Then they often come up with very creative solutions that they wouldn’t have come up with otherwise. ISPs also know that the advertising business is potentially quite lucrative and quite valuable, and they’re well behind the Facebooks of the world. So the presumption is they’re going to need to kick that into high gear, somehow.

What does this mean for the everyday Philadelphian? With the headlines that were coming out over the last few weeks, it felt like a “Big Brother is watching you” kind of situation. Are consumers affected immediately and daily or will the situation get more alarming over time?
I’d be alarmed now that the message that Congress and the President sent is that rolling back privacy protection is one of the priorities of the government, at the beginning of the administration’s term. What that signifies is alarming, of all the different things that could be done to promote growth and innovations and jobs. That’s troublesome.

In terms of how this will affect Philadelphians day-to-day, we don’t know yet. It’s not that suddenly information is being collected that wasn’t being collected yesterday. It’s a question of, what kinds of practices these companies will engage in, which is partly going to be in response to how much consumer outrage there is. I think a lot of the industry was taken aback, frankly. The level of mobilization and outcry over the repeal of these rules was greater than when the rules were originally passed.

How exactly will we even know what they start doing and when?
Same way we can ask, how do we know what sorts of information Google is collecting and how do Facebook’s algorithms give you certain targeted information? We have some idea, but we don’t entirely know.

Do you have any specific comments on Comcast?
They’ve obviously been supportive of this change. I guess the one issue is Comcast, because they own NBCUniversal, is the company that has most successfully integrated the broadband network platform with a content platform, and Verizon has bought AOL and Yahoo and AT&T is trying to buy TimeWarner, but Comcast is already there. I think, in some ways, Comcast is in the best position to leverage the information that it has by virtue of being an ISP into advertising and content businesses. Beyond that, I don’t know what exactly they have in mind.

So with this melding of cable and media and telecom giants, and with these restrictions now gone, what’s the future of online privacy? And where are we going when it comes to keeping these massive conglomerates in check?
When you look at Congress and the FCC, the inclination is that we’re moving into an area where there’s less protection of consumers and less cognition. In privacy, there’s going to be a really interesting challenge, because clearly the people are increasingly up in arms about it and that there’s a number of these issues that come up and spark outrage.

And there also are European rules that go into effect next year, there’s this thing called the GDPR that is significantly more protective than the rules in the U.S. historically, we’ve been able to come up with a set of procedures so that information can still flow between the U.S. and Europe, despite having different views about privacy, but that’s becoming increasingly difficult. Europe is becoming more protective and the U.S. is becoming less so and less interested in cooperating with other countries. That’s going to be a great challenge, because the European rules don’t just apply in Europe, they apply to anything that touches European data which is all the major U.S. companies.

What do you think is the worst that can happen and also maybe, what are some benefits you see coming out of this, if any?
The worst that can happen is the possibility that companies will, in a very secretive way, be making use of people’s data in ways they wouldn’t approve of. My guess is the four major companies now have large legal staffs and large compliance staffs and are sensitive about public opinion. I don’t think they’re going to intentionally do something really problematic, but they could inadvertently and there are others who could as well.

In terms of what’s the positive, if anything, is that the degree of reaction has opened a lot of eyes about how much people actually do care about privacy. And this has hopefully accelerated the conversation about how to address this strange imbalance in the law between the FCC and the FTC, which we all knew about but hasn’t seemed to be the number one priority to address.

Follow @fabiolacineas on Twitter.