Newsroom

Americans face new privacy threats from the use of their facial and other biometric information, as personal details of our physical selves are captured, analyzed and used for commercial purposes. Facial recognition (link is external)technologies are part of the ever-growing (link is external)data collection and profiling (link is external) being conduced daily on Americans today—whether we are online and offline. Companies want to be able to use the power (link is external) of facial recognition to make (link is external) decisions about us—including how we are to be treated in stores and on websites. Consumer groups have called on industry to support pro-consumer and pro-rights policies that would ensure an individual can decide whether facial and other personal physical information can be collected in the first place. Last June, however, the industry dominated process led by the Department of Commerce refused to support respecting a persons’ right to control how their biometric data can be gathered and used. As a result, consumer and privacy groups withdrew (link is external) from the Commerce Department “stakeholder” convening on facial recognition. These meetings—primarily dominated by industry lobbyists—are part of a White House initiated effort to design “codes of conduct” to ensure American’s have greater privacy rights. But instead of trying to address the concerns of the consumer and privacy community about meaningful safeguards for facial recognition when used for commercial purposes, the Commerce Department merely continued the process without their participation. For the Commerce Department, its priority is to help grow the consumer data profiling industry—regardless of whether Americans face a serious threat to their privacy and the consequences of potential discriminatory and unfair practices. Today, the Commerce Department is considering industry proposals (link is external) on facial recognition that fail to ensure the American public is protected by the growing use of facial data collection for commercial use. The drafts allow unlimited use of our most personal data without effective safeguards. Instead of ensuring basic rights—such as giving people the right to make informed decisions prior to the collection of their facial data—the industry proposes a scheme that would allow it to harvest our faces, skin color, age, race/ethnicity and more without any limit. By allowing such a clearly inadequate and self-serving industry proposal to be considered at all, the Department of Commerce (and its NTIA division) demonstrates it cannot be trusted to protect consumers. It is putting the commercial interests of the data industry ahead of its responsibilities to the American public. The process and the proposals are not reflective of America today. We cannot believe that President Obama (link is external) endorses how his Commerce Department has transformed the idea of a “Consumer Privacy Bill of Rights” into one that really gives carte blanche to the unfettered use of our faces and other highly personal biometric information.

Americans face growing new threats to their personal privacy as phone and cable Internet service providers (ISPs), along with leading Internet companies, expand their ability to capture details about what we do online in order to target us with data-driven personalized advertising. This report examines AT&T, Comcast, Cablevision, Charter, Cox, Verizon, Dish, Time Warner Cable, Viacom, Google, News Corp. (Fox), Turner Broadcasting (Time Warner), and Disney, focusing on some of their recent data- and video-related advertising practices. ISPs have formed partnerships with powerful data brokers (including Acxiom, Krux, and Oracle Marketing Cloud), gaining new insights into our online and offline behaviors. They are incorporating state-of-the-art “Big Data” practices, such as “programmatic advertising” that instantaneously buys and sells individual consumers—to financial marketers, fast-food companies, and health advertisers, for example—all without the consumer’s knowledge. In the process, ISPs have transformed TV and digital video into a vast new source of personal information, analyzing set-top box and streaming-video data for our viewing habits, and combining that information with sensitive online and offline data (including financial, health, racial, ethnic, and location) to compile detailed “digital dossiers” on millions of Americans. The ability of an ISP and others to identify and target us regardless of what digital device we use, moreover, has effectively erased any privacy safeguards we may have enjoyed in the past when we switched between devices. The report provides more evidence of the “digital data arms race” that is further eroding consumer privacy: AT&T, through its AdWorks division, has developed a “cross-screen system to match users’ mobile, online and television devices together based on identifiers and systems” that the company has “access to.” It operates a “consumer insights platform” that uses “Big-Data” techniques to advance AT&T’s targeted-marketing objectives. Comcast is using Rubicon’s Advertising Automation Cloud, “one of the largest cloud and Big Data computing systems in the world, [which] leverages over 50,000 algorithms and analyzes billions of data points in real time” to buy and sell individuals to marketers. Verizon, by acquiring mobile-marketing-data company Millennial Media, gained access to customer data gathered by more than 60,000 apps, including “location, social, interest, and contextual” information. Millennial has “developed more than 700 million active server-side unique user profiles, over 60 million of which link multiple mobile devices and PCs to a single specific user ... ,” with some 175 million monthly unique users in the “United States alone.” The Federal Communications Commission’s pending proceeding on privacy should examine all the ways that broadband networks operated by Internet service providers gather and use consumer information today. The review and policy proposals need to address the data-targeting relationships that ISPs have with leading digital marketing companies, including ad exchanges, data brokers, and advertisers. The FCC should enact privacy and consumer protection rules that provide individuals with rights over their data—including a set of Fair Information Practices that address the current data practices of ISPs. These companies should not be allowed to share data with affiliates or to use information for marketing their services without the informed, prior consent of the customer. Policies for privacy are essential as well for a competitive digital video market. Otherwise powerful ISPs and other gatekeepers will control the key way programming is financially supported and distributed. --- Full report attached.

Today, Americans have really no privacy when they go online, use mobile phones, or stream videos. They face a growing threat to their privacy as cable and phone company broadband ISPs construct a powerful and pervasive data gathering apparatus. Phone and cable companies are taking advantage of their special status as providers of our Internet, mobile phone and TV services. They are mounting campaigns that use all their data power to track us across our devices, using personal information such as our location, financial behavior, race/ethnicity and if we have children. The proposed FCC opt-in for most consumer transactions can provide a foundation where data is under a person’s control—not a broadband company or some unknown third party. It’s a major step forward for the U.S., which has lagged behind other countries when it comes to protecting consumer privacy rights. As Americans learn more about the actual privacy-threatening practices of ISPs, we expect them to support speedy approval of new privacy safeguards by the FCC. For more information visit, https://www.fcc.gov/document/broadband-consumer-privacy-proposal-fact-sheet (link is external)

On March 1, 2016, five large trade associations for broadband Internet service providers (“ISPs”) proposed a framework for the Federal Communication Commission’s (“FCC”) forthcoming rulemaking on broadband privacy. While it is encouraging that ISPs now appear willing to engage on this issue and to recognize the importance of FCC data security and data breach regulations, the proposed framework fails to provide consumers with the robust protections needed in light of ongoing ISP information collection practices. We therefore submit this letter reviewing the collection practices of ISPs across multiple platforms (including their video offerings), and urging the FCC to adopt rules that will provide meaningful protections for broadband consumers. ISPs currently play a leading role in the complex ecosystem of online behavioral advertising and related forms of data-driven, targeted marketing. These companies are showing an increased interest in monetizing the data they collect about their customers, and they are leveraging their position as gatekeepers to the Internet to harness this data in powerful and invasive ways. Verizon, for example, has in place powerful data-driven tracking and targeting infrastructure for multiple platforms and devices, including mobile phones. Verizon’s acquisition of both AOL and Millennial Media in 2015, as well as its advertising partnership with Microsoft, provide the company with extraordinary capabilities for data gathering, analysis, and monetization of subscriber information. Last year, Comcast announced it would share viewer data collected by its cable set-top boxes with its NBCUniversal media division. As a result, Comcast is now actively involved in the race to build advanced data collection technologies into broadband networks and multi-screen video systems. Through its “Spotlight” advertising service, Comcast provides “multi-screen” targeting, including on mobile devices. In addition to its own intensive research and development efforts, Comcast has also acquired a number of leading advanced advertising and data-targeting companies. Comcast is able to harvest “terabytes of unstructured data” from the set-top boxes it controls, which it then enriches with demographic information to provide data “more meaningful to advertisers,” including those targeted via “Comcast’s IP-based systems.” Cox Communications offers data-driven, cross-device targeting on television, Internet, and mobile devices. Its targeting capabilities “[l]everage household demographics, like income, ethnicity and home ownership.” And through “data partnerships” and related online targeting techniques, Cox gathers additional information about consumers to create highly detailed behavioral profiles. These consumer tracking and targeted advertising practices are exacerbated by the position of ISPs as gatekeepers to the Internet, which can provide them with a highly detailed and comprehensive view of their subscribers’ online communications, personal habits, and daily lives. Moreover, ISPs have access to additional information by virtue of their business relationship with subscribers, such as home addresses, financial information, and credit ratings. As of April 2015, sixty-five percent of Internet traffic in North America was unencrypted, thereby allowing ISPs expansive access to the content of subscribers’ online communications. However, even as websites increasingly adopt encryption to protect privacy, this measure does not eliminate ISP data collection capabilities. Most forms of encryption obscure the content of communications, but the packet headers remain visible. Thus, ISPs would still have access to this metadata, which includes information regarding the time, size, origin, and destination of the communication. HTTPS also does not prevent ISPs from seeing the websites to which a user navigates. Such information can reveal intimate details of the user’s lifestyle. Moreover, communications via devices connected to the Internet of Things are largely unencrypted, allowing ISPs access to the information these devices are reporting on their users. Regardless of encryption, ISPs still receive data related to the frequency, timing, location, and volume of a user’s Internet access. This information can reveal intimate details about the subscriber, such as when a user has recently become employed or given birth to a child. While use of a “virtual private network” (“VPN”) also provides additional privacy protections, Americans who utilize free broadband access cannot rely on VPNs to protect their privacy. This is particularly true with respect to low-income Americans and children who use access points maintained by E-Rate recipients, since E-Rate recipients are required to filter for adult content. Moreover, many Internet users do not even know what VPNs are, much less how to use them. Consumers should not be forced to pay for extra precautions to protect their privacy. Privacy should not be reserved for the privileged, and no American should have to choose between Internet access and their privacy. The invasive and ubiquitous tracking practices of ISPs underscore the imperative for the FCC to exercise the full extent of its rulemaking authority to protect consumer privacy. As it stands, the Federal Trade Commission is simply not equipped to provide meaningful protections for consumer privacy for numerous reasons. The FTC’s emphasis on the “notice and choice” approach to privacy protections fails to effectively protect consumer privacy. Research shows that consumers rarely read privacy policies; when they do, these complex legal documents are difficult to understand. Moreover, emphasizing notice or disclosure favors the interests of businesses over consumers and fails to establish meaningful privacy safeguards. Nor can industry self-regulatory programs provide meaningful privacy protections when they are not supported by enforceable legal standards. Even when the FTC reaches a consent agreement with a privacy-violating company, the Commission rarely enforces the Consent Order terms. Moreover, the Commission rarely incorporates public comments into its proposed settlements, which is contrary to public policy and the interest of American consumers. Fundamentally, the FTC is not a data protection agency. Without regulatory authority, the FTC is limited to reactive, after-the-fact enforcement actions that largely focus on whether companies honored their own privacy promises. Because the United States currently lacks comprehensive privacy legislation or an agency dedicated to privacy protection, there are very few legal constraints on business practices that impact the privacy of American consumers. The FCC has the opportunity to fill this void. In light of the increasingly pervasive tracking practices of ISPs, it is imperative that the FCC take this opportunity to exercise the full extent of its rulemaking authority to protect consumer privacy. Thank you for your continuing commitment to consumer privacy protection. We look forward to working with you to develop rules to provide meaningful and much-needed protections in this field. Sincerely, American Civil Liberties Union Center for Digital Democracy Common Sense Kids Action Consumer Action Consumer Federation of America Consumer Federation of California Consumer Watchdog Electronic Privacy Information Center Free Press New America’s Open Technology Institute Privacy Rights Clearinghouse Public Knowledge --- Full letter attached.