On October 27, 2016, the FCC adopted a new set of privacy and data security regulations applicable to “broadband service providers and other telecommunications carriers.”
The rules place new restrictions on internet service providers’ (“ISPs”) ability to use and share their customers’ data. The Commission established two data classifications: (1) sensitive information, and (2) non-sensitive information. Most notably, the rules classify a customer’s web browsing history, geo-location information, and app usage history as “sensitive information.” Other information in the sensitive information category includes children’s information, health information, and financial information. The non-sensitive classification includes information such as a customer’s email address and service tier. The new rules do not prohibit ISPs from the collection or storage of either class of information. Rather, when the rules go into effect, ISPs will be required to obtain prior consent from the customer before using or sharing either class of information for marketing purposes. For sensitive information, “opt-in” consent is required, and for non-sensitive information, “opt-out” consent is required.
In addition to the data usage restrictions, the Commission has adopted new requirements regarding notice and transparency, customer authentication, data breach notification and reporting, and privacy plan offers, such as “pay for privacy” plans and “take-it-or-leave-it” offers.
As anticipated, the Commission’s new rules do not apply to internet “edge providers” that remain under the jurisdiction of the FTC. They also do not apply to non-telecommunications services offered by ISPs, such as operation of websites.
According to the Commission’s published Fact Sheet, these new rules will apply to both ISPs and voice service providers. Therefore, some of the Commission’s existing privacy rules for voice providers will be revised by the Commission’s rulemaking in this proceeding.
The Commission order implementing these rules is expected to be published in the Federal Register in coming weeks.