The Washington PostDemocracy Dies in Darkness

The FCC’s net neutrality decision could mean stronger privacy rules for Internet service providers

FCC Chairman Tom Wheeler, center, joins hands with Commissioners Mignon Clyburn, left, and Jessica Rosenworcel before the start of their open hearing in Washington on Thursday.  (AP Photo/Pablo Martinez Monsivais)

The Federal Communications Commission made history on Thursday, classifying Internet providers as public utilities for the first time. The landmark vote was aimed at ensuring "net neutrality" -- the principle that all online traffic be treated the same. While the actual regulations have yet to be released, the reclassification could also bring more privacy protections to Internet users -- assuming the change survives the legal challenges that are sure to follow.

Right now, enforcing privacy restrictions on Internet service providers is up to the Federal Trade Commission -- the government's de facto privacy watchdog. But as so-called common carriers, Internet providers now fall under the jurisdiction of the FCC.

The FTC declined to comment. But Republican FTC Commissioner Maureen Ohlhausen said as much during an interview on "The Communicators" last year: "If an entity is a common carrier providing common carrier services, we can't bring actions against them," she said. "If broadband service is reclassified as a common carrier service under Title II, I think that would seriously call into question the ability of the FTC to bring those kinds of actions."

FCC spokesperson Mark Wigfield confirmed that the agency's vote will give it more oversight over the privacy practices of Internet service providers. Privacy advocates say this is probably a win for consumers, because for the first time ISPs will have to abide by a specific set of rules designed to protect the privacy of communications.

The Communications Act, which governs the FCC, includes "one of the strongest federal privacy laws currently on the books," according to Laura Moy, senior counsel at New America's Open Technology Institute. "One reason is because the scope of information that is covered is broad," she said, including pretty much all of the information collected by a carrier in order to deliver communications services to their consumers. The law also requires customers be notified if their data will be used for marketing and other purposes, Moy said, although the FCC will ultimately decide what that looks like for Internet providers.

Wigfield said the FCC will not apply existing rules designed for telephone service directly to Internet service providers, but that it will apply a key part of Title II that confers privacy powers, Section 222. It will take further actions to define how those protections apply to broadband if necessary, he said.

Structurally, the FCC's approach to enforcement might also benefit consumers, privacy advocates said.

The Trade Commission's enforcement is primarily reactive; while they also issue guidance to tell people what actions are likely to trigger enforcement, they often have to wait for someone to do something the agency considers unfair or deceptive. And for privacy, that often means holding companies to the broadly defined privacy policies they advertise.

But the FCC is different. "The FCC has broad rule-making authority," said Moy. "They can set standards that companies will have to abide by before the troubling practices have even taken place."

And privacy advocates say the agency is pretty aggressive at enforcing their current privacy rules on telephone providers. "The FCC's privacy regulations have worked very well, which is why so many people are unaware of them  -- because they are so rigid about enforcing them, people don't even have to think about it," said Feld. "It's an area they've always taken things very seriously."

And that could rein in some controversial online tracking practices, like "supercookies," unique identifiers that some mobile broadband providers have been inserting into their customers' traffic, according to Feld, or at least require more robust consent mechanisms.

"A lot of the practices we see on the broadband side are unthinkable on the telephone side because no one would even think of trying them," he said.

The FTC won't be entirely out of regulating online privacy: It will still be the watchdog for the troublesome privacy practices of many services and Web sites, a huge chunk of the equation. "The FTC can go after telemarketers even though they use phone lines as their medium for communications," Moy explained. The same principle will apply to the Internet: The FCC will oversee the pipes, while the FTC will be able to wield their enforcement tools against those who operate services that use the pipes.

Going after those services, rather than carriers themselves, has been the bulk of the FTC's online enforcement actions, anyhow. But the agency has significant expertise in broadly thinking about consumer privacy -- and it appears to be interested in working with the FCC when it comes to enforcing privacy on common carriers down the line: The agency has for years supported rolling back the exemption that blocks it from taking action against common carriers, which would allow it join the FCC in enforcing privacy protections against that group of companies.