It's 'near-impossible To Escape Persistent Surveillance' By American ISPs, Says FTC

The US Federal Trade Commission on Thursday said many internet service providers are sharing data about their customers, in defiance of expectations, and are failing to give subscribers adequate choices about whether or how their data is shared.

The trade watchdog's findings arrived in the form of a report [PDF] undertaken in 2019 to examine the data and privacy practices of major US broadband providers, including AT&T Mobility, Charter Communications, Google Fiber, T-Mobile US, Verizon Wireless, and Comcast's Xfinity.

"[T]hese findings underscore deficiencies of the 'notice-and-consent' framework for privacy, especially in markets where users face highly limited choices among service providers," said FTC boss Lina Khan in a statement [PDF].

"The report found that even in instances where internet service providers purported to offer customers some choice with respect to how their data was collected or used, in practice users were thwarted by design decisions that made it complicated, difficult, or near-impossible to actually escape persistent surveillance."

The FTC study found that some ISPs combine data from their different products and services, some combine data from personal app usage and web browsing to target ads, some segment consumers into sensitive categories related to race and sexual orientation, and some share real-time location data with third-parties.

More specifically, the report notes that:

• ISPs often amass large pools of data through vertical integration of services, like "automation, video streaming, content creation, advertising, email, search, wearables, and connected cars."
• ISPs often collect data that consumers don't expect, such as "browsing data, television viewing history, contents of email and search, data from connected devices, location information, and race and ethnicity data."
• ISPs often claim to offer consumers choices about data gathering but also make those choices unclear or rely on dark patterns to encourage certain actions.
• A significant number of them share real-time location data with other firms.

The report's observations about ISP privacy practices are particularly damning, noting that ISPs say one thing and do another.

"While several ISPs in our study tell consumers they will not sell their data, they fail to reveal to consumers the myriad of ways that their data can be used, transferred, or monetized outside of selling it, often burying such disclosures in the fine print of their privacy policies," the report says.

What's more, ISPs will reserve the right to share data with their parent organization, making a mockery of commitments not to sell personal information. And when these companies offer consumers access to their information, they often provide inscrutable data that makes no sense out of context.

• US consumer watchdog starts sniffing around tech giants' use of your spending data
• US lawmakers give Amazon until November to prove it didn't lie to Congress
• FTC carpet bombs industry with letters warning that fake reviews will be punished
• Which? survey finds people would actually pay the online giants not to take their data

FTC commissioner Rebecca Kelly Slaughter in a statement [PDF] said the report is a repudiation of the FCC's revocation of Net Neutrality under the Trump administration, a call to action for the FTC, and a signal for Congress and other agencies to enact meaningful consumer protections.

"This report shows how, absent the FCC’s oversight, many ISPs participated in a race to the bottom to partake in the lucrative market of monetizing their customer’s personal information," said Slaughter.

Slaughter's callout to Congress did not go unheeded. Via Twitter, US Senator Richard Blumenthal (D-CT), echoed the call for privacy legislation and better oversight:

"Broadband firms monitoring our web browsing. Cell phone providers selling location data to advertisers. This new @FTC report is an urgent call for strict rules & strong enforcement to protect against broadband companies’ spying."

The report comes after the IS Consumer Financial Protection Bureau (CFPB) started similar investigations into how tech giants are using customers payment data. It may be that the current administration really is interested in competition reform.

All that's left is for the FTC and FCC to punish egregious data grabbers in a non-trivial way and for Congress to actually approve meaningful privacy legislation and send it to the White House. ®