FCC Internet Privacy Rules: Panic Justified?

The short answer: the panic over the FCC’s 2017 repeal of its 2016 internet privacy rules was largely overblown, but the underlying concerns about ISP data collection are real. The rules that were rolled back would have required broadband providers to get opt-in consent before sharing sensitive data, but they never actually took effect, and the FTC already had authority over ISP privacy practices, which it continues to exercise.

Background: What Were the 2016 FCC Privacy Rules?

In October 2016, the Federal Communications Commission (FCC) adopted privacy rules specifically for broadband internet service providers (ISPs) under Title II of the Communications Act. These rules, which were scheduled to take effect in early 2017, would have required ISPs to obtain opt-in consent before using or sharing sensitive customer information—such as browsing history, app usage, geo-location, and health or financial data. Non-sensitive data could be used unless customers opted out. The rules also mandated data breach notification and reasonable security practices.

The rules were a direct result of the FCC’s 2015 Open Internet Order, which reclassified broadband as a telecommunications service, giving the FCC authority over ISPs. Prior to that, the FTC had handled ISP privacy, but the reclassification stripped the FTC of its jurisdiction over common carriers, creating a regulatory gap that the FCC’s rules were meant to fill.

The Repeal: What Actually Happened in 2017?

In March 2017, Congress used the Congressional Review Act (CRA) to pass a resolution disapproving the FCC’s privacy rules, and President Trump signed it into law in April 2017. This not only nullified the rules but also prohibited the FCC from issuing “substantially similar” rules in the future without new legislation. The CRA is a blunt instrument—it doesn’t just delay rules; it kills them permanently.

Critics of the rules argued they were unnecessary, inconsistent with FTC standards, and would have created confusion by applying different privacy requirements to ISPs versus other online companies like Google and Facebook. Supporters called the repeal a giveaway to ISPs, predicting they would immediately sell browsing histories and other sensitive data.

How ISP Data Collection Actually Works

To understand the panic, you need to know what ISPs can see. Unlike websites, ISPs sit at the gateway of your internet connection, meaning they can see:

• Every website you visit (domain names, not necessarily full URLs if HTTPS is used)
• When you’re online and for how long
• Your approximate location (based on IP address)
• App usage patterns (via DNS queries and traffic metadata)
• Device types and operating systems

However, the reality is more nuanced. HTTPS encryption now covers the majority of web traffic, so ISPs can see the domain (e.g., youtube.com) but not the specific pages or content. They can also see the amount of data transferred, which can reveal patterns like streaming vs. browsing. ISPs have long collected this data for network management, billing, and troubleshooting. The controversy is about using it for advertising or selling it to third parties.

What the Repeal Actually Changed

Here’s the key fact that many people missed: the FCC’s privacy rules never went into effect. They were adopted in October 2016, but the effective date was delayed until early 2017, and then the CRA killed them before they ever applied. So the repeal didn’t “roll back” a working regulation; it prevented a future one from starting.

After the repeal, the FTC regained jurisdiction over ISPs (because the FCC’s 2015 Title II classification was also reversed in 2018). The FTC enforces privacy via Section 5 of the FTC Act, which prohibits unfair or deceptive practices. This means ISPs must honor their own privacy policies, but they are not required to obtain opt-in consent for sensitive data. In practice, major ISPs like Comcast and AT&T have stated they do not sell individual browsing data, and they offer opt-out choices for some advertising, but these are voluntary commitments, not legal mandates.

Common Misconceptions and Real Risks

One common misconception is that the repeal means ISPs can now sell your browsing history without any restrictions. That’s not quite true—the FTC can still act if an ISP’s practices are deceptive or unfair. However, the FTC’s approach is reactive and case-by-case, not proactive like the FCC’s rules would have been.

Another misconception is that the repeal affects only ISPs, but it also removed the FCC’s ability to enforce data breach notifications. The FTC still requires breach notification for certain entities, but the specific ISP requirements under the FCC rules are gone.

Real risks remain: ISPs can still use your data for their own advertising purposes (e.g., targeted ads) without opt-in consent, and they can share non-sensitive data unless you opt out. The lack of a uniform federal privacy law means your protection depends on your state and the ISP’s goodwill.

How to Protect Your Privacy Today

Regardless of the regulatory landscape, you can take practical steps to limit what your ISP can see and use:

• Use a VPN: A VPN encrypts all your traffic, so your ISP only sees that you’re connected to the VPN server, not which sites you visit.
• Use DNS over HTTPS (DoH): This encrypts your DNS queries, preventing your ISP from seeing the domain names you resolve.
• Check your ISP’s privacy policy: Look for opt-out options for advertising and data sharing. Many ISPs have a “privacy choices” page.
• Use HTTPS everywhere: Most sites use HTTPS, but you can install browser extensions to force it.
• Support state-level privacy laws: Some states, like California and Virginia, have enacted their own privacy laws that apply to ISPs and other companies.

Frequently Asked Questions

Did the FCC repeal allow ISPs to sell my browsing history?

Not directly. The repeal removed the opt-in requirement, but ISPs still have to follow their own privacy policies and are subject to FTC enforcement for deceptive practices. Most major ISPs have stated they do not sell individual browsing data, but they can use it for their own advertising. Always read your ISP’s privacy policy.

Are ISPs more dangerous than websites like Google or Facebook?

ISPs have a broader view of your activity across all sites, but they typically lack the personal details (like your name, interests, and social connections) that platforms collect. Both have privacy risks, but the type of data differs. The 2016 rules only applied to ISPs, not to websites, which is why some argued it was unfair.

Can the FCC re-adopt similar rules in the future?

Under the Congressional Review Act, the FCC cannot issue “substantially similar” rules without new legislation from Congress. That means a future FCC could try, but it would need a new law to override the CRA prohibition. This is why the 2017 repeal was seen as a major setback for privacy advocates.

What is the difference between opt-in and opt-out consent?

Opt-in means the ISP must get your explicit permission before using your data (e.g., a pop-up asking for consent). Opt-out means the ISP can use your data by default, and you must actively decline if you don’t want it. The 2016 rules required opt-in for sensitive data; the current FTC approach is generally opt-out.

Does the repeal affect my data security?

The 2016 rules included data security requirements, but those were also nullified. However, ISPs are still required to take reasonable security measures under the FTC Act, and many have their own security practices. The lack of a specific ISP security rule means there’s less regulatory oversight, but it doesn’t mean ISPs are ignoring security entirely.

Related

• Disable Annoying Notification Balloons
• Brutal vs Godot: Which Game Framework Wins?
• GraphQL vs REST: Key Differences Explained