Does the FCC Protect Internet Privacy?

No, the FCC does not currently protect internet privacy in the sense of regulating how ISPs collect and use your data. The agency’s authority over broadband privacy was effectively removed in 2018, and since then, no federal agency has had clear, enforceable rules specifically governing ISP data practices. This article explains the FCC’s role, what happened to its privacy rules, and what protections—if any—exist today.

Background: The FCC’s Shifting Role

The Federal Communications Commission (FCC) is the U.S. agency that regulates interstate and international communications by radio, television, wire, satellite, and cable. For decades, its jurisdiction over broadband internet was a subject of legal and political debate. The key question was whether ISPs like Comcast, AT&T, and Verizon were “telecommunications services” (like phone lines) or “information services” (like websites). That classification determined whether the FCC could apply common-carrier rules—including privacy protections—to them.

In 2015, under the Obama administration, the FCC reclassified broadband as a telecommunications service under Title II of the Communications Act. That move gave the agency broad authority to regulate ISPs, including the power to issue privacy rules. In 2016, the FCC adopted its first comprehensive broadband privacy order, which required ISPs to get opt-in consent before sharing sensitive data (like browsing history, app usage, and location) and opt-out consent for non-sensitive data. The rules also mandated data breach notifications and transparency about data collection.

However, those rules never fully took effect. In 2017, Congress used the Congressional Review Act (CRA) to repeal them, and in 2018 the FCC—now under Republican leadership—reclassified broadband as an information service, stripping away its own authority to enforce ISP privacy. Since then, the FCC has not issued new privacy rules for ISPs, and the Federal Trade Commission (FTC) has stepped in as the primary federal privacy enforcer for most companies, but with significant limitations regarding ISPs.

How the FCC’s Privacy Authority Was Removed

The 2017 CRA repeal was a landmark event. The CRA allows Congress to overturn recently issued federal regulations with a simple majority vote. The FCC’s 2016 privacy rules were finalized in late 2016, and the CRA’s 60-legislative-day window extended into 2017. A Republican-controlled Congress voted to repeal them, and President Trump signed the repeal in April 2017. That action not only killed the rules but also barred the FCC from issuing “substantially similar” rules in the future without new legislation.

Then, in 2018, the FCC voted along party lines to reclassify broadband as an information service under Title I. That classification meant ISPs were no longer subject to common-carrier obligations, including the privacy provisions that had existed under Title II. The FCC’s authority to regulate ISP privacy essentially evaporated. The agency retained some oversight of network security and 911 services, but not data privacy.

Today, the FCC’s role in privacy is mostly limited to specific areas like telephone consumer protection (e.g., robocalls) and data breach reporting for telecommunications carriers, but not for broadband ISPs. The agency has acknowledged this gap but has not taken significant action to fill it.

What Protects Your Privacy Today?

With the FCC out of the picture, the FTC is the main federal agency that polices unfair or deceptive practices related to data privacy. The FTC can take action against companies that violate their own privacy policies or engage in deceptive data practices. However, the FTC’s authority over common carriers—which includes ISPs—is limited. In 2015, the FTC lost a court case (FTC v. AT&T) that clarified the FTC could not regulate common carriers, and after the 2018 reclassification, ISPs are no longer common carriers, so the FTC can now oversee them—but only for unfair or deceptive acts, not for privacy violations per se.

State laws also play a role. Several states, including California, Virginia, and Colorado, have enacted comprehensive privacy laws (e.g., CCPA, CPRA) that apply to businesses, including ISPs, operating within their borders. These laws give residents rights to access, delete, and opt out of the sale of their personal data. However, they vary by state, and not all states have such protections.

Additionally, the FCC does have some indirect influence through its authority over network neutrality (which it also repealed in 2018) and through its role in overseeing the Lifeline program, but neither addresses privacy directly.

Common Misconceptions

One common misconception is that the FCC still protects your internet privacy because it regulates the internet in general. In reality, the FCC’s authority is limited to technical aspects like spectrum allocation, not data privacy. Another misconception is that the FTC fully covers ISPs. While the FTC can act on deceptive practices, it has no rulemaking authority to set privacy standards for ISPs—it can only bring enforcement actions after the fact. Also, many people assume that if they use a VPN, their ISP cannot see their activity, but VPNs only hide traffic from the ISP; they do not prevent the ISP from collecting metadata like connection times and data volumes, which can still be shared unless the ISP’s privacy policy says otherwise.

How to Protect Your Own Privacy

Given the lack of federal rules, individuals must take proactive steps to protect their data from ISPs:

• Use HTTPS everywhere: Most websites use HTTPS, which encrypts the content of your traffic, but the ISP can still see the domain names you visit (via DNS). Using a DNS-over-HTTPS (DoH) service can hide that.
• Use a VPN: A VPN encrypts all traffic between your device and the VPN server, hiding your browsing activity from the ISP. However, choose a reputable VPN that does not log your data.
• Read your ISP’s privacy policy: ISPs often have policies that allow them to share aggregated or de-identified data, but some share more. Opt out of any data sharing if possible.
• Use encrypted DNS: Configure your router or device to use DoH or DNS-over-TLS to prevent the ISP from seeing your DNS queries.
• Consider a different ISP: Some ISPs have better privacy reputations than others, though options are often limited by location.

Future Prospects

There have been attempts to restore FCC privacy authority. In 2022, the FCC under Democratic leadership voted to restore net neutrality, but that effort was stalled in court and ultimately not completed. As of 2025, the FCC has not reclassified broadband again, and no new privacy rules have been adopted. Some lawmakers have proposed federal privacy legislation that would give the FTC or a new agency authority over ISP data practices, but none has passed. The future of ISP privacy regulation remains uncertain and depends on political shifts and legal challenges.

Frequently Asked Questions

Does the FCC have any privacy rules for ISPs right now?

No. The FCC’s 2016 privacy rules were repealed in 2017, and the agency’s authority to issue new ones was removed when broadband was reclassified as an information service in 2018. The FCC has not since adopted any privacy rules for broadband ISPs.

Can the FTC protect my privacy from my ISP?

Partially. The FTC can take action against ISPs for unfair or deceptive practices, such as lying in their privacy policies. However, the FTC cannot issue prospective rules that set privacy standards for ISPs, and its enforcement is reactive rather than preventive.

What happened to the 2016 FCC privacy rules?

They were repealed by Congress in 2017 under the Congressional Review Act. The repeal also prohibited the FCC from issuing similar rules in the future without new legislation.

Do state laws like the CCPA apply to ISPs?

Yes, state privacy laws can apply to ISPs operating in those states. For example, California’s CCPA/CPRA gives residents rights to access, delete, and opt out of the sale of their personal information, which includes data collected by ISPs. However, these laws vary by state and do not cover all Americans.

Is using a VPN enough to protect my privacy from my ISP?

A VPN hides your browsing activity from your ISP, but the ISP can still see that you are using a VPN and may collect connection metadata like timestamps and data volumes. Also, if the VPN provider logs your activity, your privacy depends on their policies.

Related

• DayZ Server Tools Every Admin Needs
• Tower Defense Simulator Event Schedule & Dates
• Best M4 Mac Settings for Zelda: Tears of the Kingdom