ISPs Can Now Sell Your Browser History: Here’s Why You Shouldn’t Panic

If you haven’t seen the frantic posts and articles you will. ‘Donald Trump and the evil Republicans are selling out your privacy to the greedy internet service providers’ or something to that effect.

It’s been surprising to see so many tech experts and media outlets buy into this narrative with such little balance. Granted the topic of internet privacy is ripe for scare tactics and click bait, facts still matter and writers should make an effort to present the whole story.

The other side to this bill is partially about politics and the age old debate over what role the government should have in regulating business, but it’s more about better understanding the $60 billion digital marketing industry that supports 10 million jobs.

Defending this bill requires getting into the weeds, and answering some key questions:

What exactly are we talking about here?

Last week, both houses of Congress passed a measure that rolls back regulations that were placed on internet service providers (ISPs) at the tail end of the Obama Administration. Congress used their power under the Congressional Review Act to do this. The vote was largely along party lines with most Republicans supporting the repeal and all Democrats opposing it. The bill was signed by President Trump today.

What regulations were repealed?

Last October, the The FCC passed a new rule which restricted ISPs ability to sell your personal data (most notably your browsing history).

Why would Republicans want to repeal that? I don’t want ISPs selling my browsing history

In order to answer this question, it’s important to understand a little about how digital marketing works.

Pretty much everything you do online generates data, whether you’re playing angry birds, shopping on Amazon, searching on Google, downloading an iTune, or liking your favorite band on Facebook. The sites you use capture this data to create a profile (sometimes called a digital footprint) of your online behavior. There are three basic ways companies use this data:

  1. To better market their products to you through targeted advertising
  2. Anonymizing and selling the data to other companies that help advertisers target potential customers
  3. Compiling the data in-house to build ad networks that can be sold to potential advertisers

The ISPs want to be in the business of number 3, some already are to a very limited extent, but they’re having a hard time competing with Google and Facebook because of the vast amount of personal data that is generated through search and social activity. The new regulations would have put the ISPs at an even bigger disadvantage since the new privacy rules would not have applied to search engines or social media sites.

Advocates for the regulations say that your browsing history is much more personal in nature then the information generated through searches and social media, and that many consumers don’t have many options for which internet service provider to use. The lack of competition among ISPs, along with the vital role that the internet now plays in our lives have led advocates to call for ISPs to be regulated as vital utilities in the same way gas, electric, water, phone, and cable companies are.

Opponents argue that the regulations will create a permanent duopoly for Facebook and Google that already control 65% of the digital ad market.

Why should any company be able to profit off of my personal data?

In some cases consenting to your data being marketed is the price you pay for using free sites and apps such as Angry Birds, Candy Crush or even flash light apps. In other cases, you agree to it through terms and service agreements (like the iTunes book that no one reads) and /or posted privacy policies. Some companies like Google allow you to opt-out of your data being used for targeted ads, but very few people go through the steps to do this.

It’s important to understand that ad networks aren’t actually selling your data on spreadsheets to the highest bidder, they’re allowing advertisers to bid on the right to serve ads to broad demographics. No outside advertiser is targeting you based on personally identifiable information , you’re most likely seeing an ad based your demographics and online behavior.

Whatever, I Still Don’t Like It

The digital aspect is relatively new, but companies monetizing your data isn’t. Think about the data that brick and mortar stores have on you from all the club cards on your key chain. You probably never gave a second thought to how that data is being used. That may be unsettling for a second, but chances are you’ll be ok with it when you get that coupon for allergy medication the first warm week of spring or when ShopRite gives you a coupon for Swiss Miss because snow is in the forecast and your purchases indicate that you have school aged kids.

Now try to think of online advertising the same way. Behavioral ads exist because they work and because they connect people with products they need or want. Studies have shown that consumers prefer to receive relevant advertising while online.

Shouldn’t Companies At Least Have to Get My Permission First Before Using My Data?

An extremely fair question, and one that gets to the heart of the debate. U.S. privacy laws for non-sensitive information have historically been on an opt-out basis, meaning the responsibility is on the consumer to request that their data not be used for marketing purposes (In a lot of instances, the opt-out is not legally binding but is respected by many companies as a way for the direct marketing industry to self-police itself and avoid consumer complaints).

In many other countries (including EU), privacy laws are on an opt-in basis, meaning that companies have to explicitly request permission from consumers in order to use their data for marketing purposes. Many privacy advocates argue that the United States should follow the EU model to put the burden on advertisers to request permission from consumers.

While that may seem like a fair idea, the trade off is the United States’ robust digital marketing industry, the millions of jobs it supports, and an improved online experience.

How Can Advertising Possibly Make My Online Experience Better?

Digital Marketing innovations have made experiences like Google and Facebook possible where ads are organic and relevant to the online experience. Gone are the days of random pop-up ads and pages where advertising takes up more room then content.

You Mentioned the Regulations Creating a Double Standard For ISPs. Companies like Verizon and Comcast Are Already Worth Billions, Why Should I Care if They’re Not Able to Make More Money?

It’s true, Comcast grossed $80 billion in revenue in 2016, still short of Verizon’s $120 billion. It may seem obscene that these companies want to make more money off your personal information, but the future is less rosy for cable providers. Programming costs for highly rated programs are escalating as TV ratings decline due to the DVR effect, and the wide range of programming available to consumers with a 300 channel line up. As cable costs go up, an increasing number of consumers are disconnecting from cable altogether which drives up the cost for remaining subscribers (If this sounds similar to the Obamacare death spiral, it’s because it is). The cable companies may not seem like they care what you think when you call but they know their existing business model is a bubble, so they’re looking to develop new revenue streams. As with any business, government regulation and restrictions on revenue will end up being passed on to the consumer.

Given that most people don’t get to chose who their cable provider is (another product of government regulation), this may seem like corporate blackmail but there is a potential reason for consumers to be excited.

As ISPs develop their own ad networks, they will gradually transition from hardware providers to data brokers. When the business is scaled, your activity on the internet will be worth more to the ISPs then your monthly broadband bill. It’s not impossible that in 5 years, broadband will be a low cost monthly add on (similar to how most Triple Play packages now add in phone service for $10/month) in an effort to compile as much data as possible for their networks. In the case of companies that also provide cable service, getting bodies in the door will be that much more valuable since companies will be able to offer multi-channel targeted advertising on a household level. A lot of this is dependent on the ISPs ability to successfully develop and monetize their ad networks, but transferring to a data based business model should ultimately result in lower price options for consumers.

While risks to internet privacy will always ring alarm bells, data companies have a vested interest in security with billions of dollars at stake. Recent events tell us there is a much bigger risk of having your data compromised shopping at Target, buying an Obamacare policy online, or even filing your taxes then there is from an ISP compiling your digital footprint.

With the proliferation of big data, it’s reasonable to have a debate about what the expectations, responsibilities, and requirements are for how companies handle that information. While protecting sensitive data may involve a combination of industry self-policing and regulations, government should not be in the business of creating winners and losers in the name of privacy.