Hugh Bannister
Information Policy
Professor Rubinstein
February 14, 2017
The FCC’s recent privacy order – an unconstitutional burden of free commercial speech?
Several lobby groups representing the online advertising industry recently objected to the Federal Communications Commission’s (FCC) adoption of the October 27, 2016 privacy report and order. The privacy order set out a number of privacy regulations applying to wireline and wireless broadband internet service providers (ISPs). The advertisers’ objections were contained in a formal petition for reconsideration of the privacy order filed with the FCC on January 3, 2017 and centered around two key restrictions on ISPs’ ability to use and disclose their customer’s personal information to third parties, including to online advertisers which need information about customers’ internet activity to target advertising based on browsing behavior (behavioral advertising). These objections have been based, in part, on legal and policy arguments grounded in commercial free speech protected under the First Amendment to the Constitution.
The FCC’s privacy order stems from its February 2015 open internet order, which introduced rules supporting the principle of net neutrality (the notion that ISPs should serve and handle all data, content and applications on the internet equally, without either favor or restriction). One of the effects of the open internet order was to re-classify ISPs under the Communications Act to be types of telecommunications services provided by ‘common carriers’. That re-classification means that broadband ISPs are no longer subject to scrutiny by the Federal Trade Commission (FTC) for the purposes of some unfair and deceptive acts and practices under section 5 of the Federal Trade Commission Act, which includes the FTC’s regulatory power over many privacy matters.
To fill this gap, the FCC adopted its privacy order, which comes into force in stages throughout 2017. Unlike the FTC’s organization-specific, enforcement-based approach to privacy, the FCC’s privacy order sets regulations upfront and applies them to all telecommunications service providers, including ISPs. Under the FCC’s privacy order, ISPs have a number of relatively standard obligations to protect and handle customer personal information responsibly. However, the privacy order also creates a sub-class of ‘sensitive’ customer personal information which includes not just the usual health, financial and other intuitively ‘sensitive’ information, but also unusually extends to a customer’s web browsing history and application usage history. ISPs must obtain customer consent to the use and disclose this ‘sensitive’ customer personal information and must obtain that consent on an opt-in basis only. For non-sensitive personal information, ISPs may obtain customer consent on an opt-out basis.
The broader treatment of web and app usage history as ‘sensitive’ customer personal information and the opt-in consent requirement in the privacy order are the two restrictions that provoked the online advertisers’ objections and petition for reconsideration to the FCC. These steps will make it harder for ISPs to provide online advertisers with the information they need about ISP customers’ internet activity to be able to target behavioral advertising online. Although the advertisers have also warned about customers being constantly bombarded with opt-in consent requests, this is probably a more far-fetched complaint considering the FCC’s privacy order contemplates that an ISP may seek blanket opt-in consent from its customers at the point of sale of the ISP’s services and each time the ISP changes its privacy policy, rather than before each transaction online.
The advertisers’ legal basis for their objections rest in part on claims that the FCC has exceeded the jurisdiction granted to it under statute by regulating privacy in the broadband industry (which is unlikely to get much traction because the FCC has been regulating privacy for other common carriers in the telecommunications industry since 1996) and that the FCC failed to follow due process in making the privacy order. The more-plausible legal basis for the advertisers’ objections rests on their claims that the FCC privacy order may be an unconstitutional burden on free commercial speech under the First Amendment.
The ‘speech’ of the ISPs is the collection and disclosure of personal information of ISP customers directed to the ‘audience’ of online advertisers – a standard scenario for commercial speech. While commercial speech is afforded a lower level of Constitutional protection, the advertisers may have point about the FCC’s privacy order overstepping the bounds of permissible regulation under the First Amendment. The advertisers rely on First Amendment case law involving a previous FCC attempt to regulate customer personal information for marketing purposes by telecommunications service providers, which has close parallels to the present FCC privacy order (U.S. West, Inc. v. Federal Communications Commission, 182 F.3d 1224 (10th Cir. 1999)). Based on this precedent, the advertisers’ argument is that the FCC’s privacy order is not narrowly tailored enough to survive scrutiny by a court under the First Amendment. In large part this is alleged to be because of the unusually broad category of ‘sensitive’ customer personal information and the supposedly onerous opt-in consent that the ISPs need to obtain from their customers to be able to use and disclose such information, including disclosure to online advertisers. A more narrowly tailored alternative offered by the advertisers is an opt-out consent approach and a reduction in the scope of ‘sensitive’ information back to more traditional notions of highly confidential personal information, like health and financial information.
Despite the legal posturing in the advertiser’s petition for reconsideration to the FCC, the advertisers’ objections may not need to be carried through to a full court challenge to the validity of the FCC’s privacy order. The recent change in government in Washington has also brought changes to the make-up of the commissioners at the FCC. A new FCC chair has been appointed, Ajit Pai, who has been a consistent and forceful critic of the FCC’s open internet order as well as the privacy order flowing from it. The new Administration must also appoint two new FCC commissioners to fill currently-vacant positions within the FCC’s leadership. These changes will shift power within the FCC, as well as its regulatory course generally. It seems likely that the FCC will narrow or even revoke the privacy order and open internet order in the near future. Should that occur, there would also likely be a revival of the FTC’s privacy oversight of the broadband industry.
References:
October 26, 2016 FCC privacy report and order:
https://www.fcc.gov/document/fcc-releases-rules-protect-broadband-consumer-privacy
January 3, 2017 petition for reconsideration submitted to the FCC by the Association of National Advertisers, the American Association of Advertising Agencies, the American Advertising Federation, the Data & Marketing Association, the Interactive Advertising Bureau and the Network Advertising Initiative: