Rachel Glasser
Partner, Director of Privacy and Partner Activation, GroupM
This, coupled with FCC's informed consent model, could have a downstream effect on the advertising industry, setting a troubling precedent for the industry which may set back progress the industry and self-regulatory groups have come so far to make.
New Privacy Rules from the FCC now require broadband Internet Service Providers to gain opt-in consent from users for use of web viewing data.
What’s changed?
The Federal Communications Commission (FCC) recently voted to adopt a new set of Privacy Rules that will now require broadband Internet Service Providers (ISPs) to gain opt-in consent from their users for use of web viewing data.1 Further, the Rules expand on the definition of ‘sensitive data’ which already includes financial, health, and children’s data, to include web viewing, application usage, and location based data.2
These rules do not currently apply to the privacy practices of web sites and other edge services, over which the Federal Trade Commission (FTC) has authority. The scope of the rules do not include other services of ISPs like operation of a social media site, or issues like government surveillance.
What the change means?
Nearly eight years ago, privacy concerns sprung from the use of data for interest based advertising. In response, an industry privacy self-regulation coalition was formed with the cooperation of the FTC. Under this collaboration, the AdChoices program was created.
- The AdChoices program provides consumers with a heightened awareness of interest based advertising and an icon in each ad provides consumers with the ability to learn what data is collected and used at the moment of collection, and provides consumers with the ability to opt-out (of behavioral data collection). The AdChoices program has helped highlight the difference between how pseudonymous data is used versus how Personally Identifiable Information (PII) is used in marketing. The icon appears in over one trillion ads a month.
- Different standards will now apply to different players in the space, creating the potential for confusion and inconsistencies. For example, there is now an opt-in model specifically for AT&T/Comcast/Verizon, and other similarly situated ISPs, to use web history combined with subscriber information. And there is an opt-out model for Google/Facebook/Twitter to use personal subscription information combined with web history.
Implications for advertisers?
The ability to target users with interest based ads has made marketing more cost efficient, provided better user experiences, and less pass down cost to consumers. Being able to target users and serve ads through use of pseudonymous data and intention is one of the ways by which the internet continues to flourish and grow.
- The concern for the industry with respect to the new privacy rules is that the FCC has now empowered the opt-in model. Whereas the digital ecosystem has operated successfully under the AdChoices opt-out regime, there is a worry that this ruling kindles strong concerns about web viewing data as sensitive information.
- This, coupled with FCC’s informed consent model, could have a downstream effect on the advertising industry, setting a troubling precedent for the industry which may set back progress the industry and self-regulatory groups have come so far to make.
- The re-definition of web viewing data as ‘sensitive’ is a further concern, should this ruling embolden the FTC. If there should be a challenge to the rules by the ISPs as unfair, we may expect to see the rest of the industry get drawn into the opt-in consent model.
What’s next?
Of course, these concerns are hypothetical, however, the industry will need to make a strong representation to the legislative powers to minimize any trickle down impact from the FCC ruling.
Note that the full text of the rules has not yet been published by the FCC. The Notice and Transparency portions of the rules will go into effect 12 months after the summary of the rules is published in the Order in the Federal Register, which means ISPs will have to implement the changes 12 months after the Rules are published. For more information please contact [email protected].
1 The FCC has changed the privacy requirements of Section 222 of the Communications Act for broadband ISPs.
2 http://transition.fcc.gov/Daily_Releases/Daily_Business/2016/db1027/DOC-341937A1.pdf
