The Washington PostDemocracy Dies in Darkness

Washington wants your cable company to become a whole new privacy cop

( <a href="">Mr. T in DC</a> )

As companies like Google become more interested in building their own cable box to compete with the one you rent from your TV provider, one big question is how they'll protect your privacy. Just like Netflix knows exactly when you tune in and tune out from a show, a set-top box made by a company outside of the cable industry would gain access to much of the same information.

Basically, could this data be used for targeted advertising?

Federal regulators say no. Their recent proposal to "unlock the box" and let non-cable firms design  alternatives to the traditional set-top box would require those companies to obey the same privacy rules that cable companies do. But what's interesting about this idea is how they propose to implement it: Give the cable companies responsibility for ensuring that cable boxes made by third parties don't abuse your personal data.

The proposal effectively contemplates a world where Comcast could be overseeing Google, for example.

If you think this sounds strange, keep reading.

Hang on, back up. What is this business about Google building a set-top box?

Google says it doesn't have any immediate plans to build a set-top box. But the company is looking into the idea, according to Milo Medin, an executive at Google Fiber. And in theory, a cable box from Google would be able to replace your existing box, plugging directly into your cable connection and giving you all the same channels and content, but with a different user interface. Maybe you'd want this, or maybe not. But speculation about third-party boxes is spiking as a result of the Federal Communications Commission's new proposal.

What proposal?

Regulators want to make it so that you have more choice in the kinds of set-top boxes you use to display cable programming on your TV. The FCC took steps Thursday to consider such a proposal, voting 3-2 to move ahead.

Cable companies: The FCC may force us to make your life more difficult

Okay, so what does this have to do with privacy?

Through your set-top box, cable companies have access to lots of data about what shows you watch, when, and how. They also know things like your name, home address and email address. Thing is, they're not allowed to sell or share that information unless you give them written or electronic permission. Those regulations were put in place by the FCC.

But the FCC doesn't have much jurisdiction in this area over companies like Google, because the relevant regulations here can only be legally applied to cable companies. So if Google were to build a competing set-top box that behaves exactly like a cable company's, it would get all the data, but would have to abide by none of the regulations.

Third-party cable boxes won't be allowed to spy on you (too much)

So unlike the cable industry, companies like Google could take my data and use it for advertising?

That's the theory. Now, the FCC thinks it actually can get third-party companies to comply with the privacy regulations. But it has to do this indirectly — by deputizing the cable companies.

Cable firms "would be required to provide [their content] only if the entity they're providing information to agrees to certain requirements," according to Bill Lake, an FCC official whose office helped draft the proposal. "One of those requirements is that they agree to Title VI standards."

What the heck are Title VI standards?

Title VI is the part of communications law that regulates the cable industry. It includes the privacy regulations we were talking about earlier for cable companies.

You're saying that the FCC wants to use cable companies to apply Title VI privacy rules on third-party cable-box providers?

Yes. Essentially, if a set-top box maker wanted to tap into your cable connection, it would first have to agree not to use the resulting viewing data for advertising.

We talk to FCC chairman Tom Wheeler re: cable companies and set-top boxes (Video: Jhaan Elker/The Washington Post)

How will this be enforced?

That's a great question.There's no hard-and-fast rule on this yet; the FCC's proposal mainly asks the public for feedback on how to make this work, without saying how it should work.

But here's how a cable industry official put it:

"[The] FCC doesn’t have any answers on how privacy certification would work. Basically it’s impossible to monitor and enforce."

Comcast took its own stab at the idea in a blog post Thursday, saying voluntary commitments won't be enough to solve the issue

So what happens now?

It's hard to say if the industry literally can't enforce the privacy rules, or if it simply won't. In some ways, it's in the cable companies' interest to watch set-top box makers like a hawk, because it's a chance to prevent them from eating away at their own position in cable boxes.

But politically, it's also in the industry's interest right now to say it won't work, because it puts pressure on the FCC to amend its proposal in ways that suit the cable companies better.

We won't be able to adjudicate the specifics of these claims until the proposed rules are finalized. But for now, it's clear the FCC envisions cable companies as a kind of privacy cop. That's interesting.