If you think Facebook’s “Cambridge Analytica problem” is bad, just wait until Comcast and Verizon are able to do the same thing.
In response to the Cambridge Analytica data privacy scandal, Facebook took out full-page apology ads in several prominent British and US newspapers. While the company acknowledged a “breach of trust”, it also pointed out that third-party developers like Cambridge Analytica no longer get access to as much information about users under Facebook’s current terms of service.
But contractual tweaking does little to change the privacy risks that techno-sociologist Zeynep Tufekci calls “an all too natural consequence of Facebook’s business model, which involves having people go to the site for social interaction, only to be quietly subjected to an enormous level of surveillance”.
The thing is, Facebook isn’t the only company that amasses troves of data about people and leaves it vulnerable to exploitation and misuse. As of last year, Congress extended the same data-gathering practices of tech companies like Google and Facebook to internet providers like Comcast, AT&T and Verizon.
Because service providers serve as gatekeepers to the entire internet, they can collect far more information about us, and leave us with far less power to opt out of that process. This means that the risks of allowing our internet providers to collect and monetise the same type of user data that Facebook collects – and the potential that such data will therefore be misused – are much, much worse.
Your internet provider doesn’t just know what you do on Facebook – it sees all the sites you visit and how much time you spend there. Your provider can see where you shop, what you watch on TV, where you choose to eat dinner, what medical symptoms you search, where you apply for work, school, a mortgage. Everything that is unencrypted is fair game.
But internet providers don’t just pose a greater surveillance risk than Facebook –their surveillance is also far harder to avoid. “Choosing” not to use an internet provider to avoid surveillance is not really a choice at all. As of 2016, only about half of Americans have more than one option for broadband internet. In rural areas, this number drops to just 13%.
For these Americans, access to the internet means being subjected to whatever forms of surveillance their provider adopts. Even in places where users have more than one option, the decision to switch providers is much more costly and time-intensive than deleting an app. Many – though by no means all – of us are privileged enough to #DeleteFacebook, or at least reduce the time we spend there. But at a time when the internet is essential to completing schoolwork, finding and applying to jobs, running a business and maintaining community, very few of us are privileged enough to #DeleteTheInternet.
Among the Obama administration’s last major policy reforms was implementing Federal Communications Commission rules limiting how internet providers use and sell customer data, and giving customers more control over how personal information like browsing habits, app usage history, location data and social security numbers may be used by service providers. These rules would have prevented ISPs from carelessly exposing data to third parties, as Facebook did with Cambridge Analytica.
Last March, Republicans and President Trump overturned these rules, allowing providers like Verizon and Comcast to monitor their customers’ behaviour online and, without their permission, sell that data for targeted ads. In other words, instead of restricting the dangerous and exploitative market of consumer data, Congress has expanded that market to include internet service providers.
Several states, including Massachusetts, have introduced legislation to reinstate – and in some cases, extend – the Obama-era privacy protections. And, unlike in the case of state efforts to restore net neutrality, privacy protections like Massachusetts’ senate bill 2062 are far more likely to withstand federal preemption challenges and provide enforceable state protections for internet users’ data.
The past few weeks have shown us that the stakes for establishing meaningful limits to corporate surveillance couldn’t be higher. By encouraging state lawmakers to step in to protect internet privacy and limit the use of our data by service providers, we can take a first step toward an internet where users aren’t forced to choose between data exploitation and the ability to live their digital lives.
- Salome Viljoen is a fellow in the Privacy Initiatives Project at the Berkman Klein Center for Internet and Society