These comments are submitted in response to the Commission's Notice proposing new regulations for protecting the privacy of customers of broadband services. The Commission proposes new privacy regulations without identifying any apparent problem significant enough to require such regulations and without reliable evidence that those regulations will significantly improve protections for personal information.

 

The proposed regulations, which clearly will reduce consumer welfare, also pose significant legal and policy shortcomings. Foremost among all the shortcomings is the fact that the FCC's proposed regulations would create disparate privacy regulatory regimes for broadband Internet service providers ("ISP") and "edge providers" like Google and Amazon. This will lead to immense consumer confusion as to the relevant applicable privacy policies because consumers, unsurprisingly, don't distinguish between the two different categories of providers based on regulatory classifications, especially newly-adopted ones. But, worse still, the FCC's proposal would impose more stringent regulations, including the more ubiquitous "opt-in" mandate, on ISPs than those that apply to edge providers - even though websites and services like Google indisputably collect, retain, and utilize far more personal information than do the ISPs. Indeed, Google alone (with all its various data-grabbing applications) most likely collects, stores, and utilizes far more personal information than all the ISPs combined.

 

The Commission's jurisdiction over privacy is narrowly circumscribed. Its Section 222 jurisdiction is limited to the privacy of phone call length, numbers called, voice billing and like information "made available to the carrier by the customer solely by virtue of the carrier-customer relationship." Section 222 does not contain any latent power for the Commission to regulate "any information that is linked or linkable to an individual" via the Internet. The Commission's proposed regulations are an improper overextension of its Section 222 authority.

 

The Commission mistakenly relies on a factually unsupportable "gatekeeper theory" of competition and incentives in the broadband market as a basis for its proposed privacy regulations. The Commission now apparently relies on a "gatekeeper" claim as a regulatory prop of last resort when traditional market power analysis fails to support its expansive regulatory designs. The switching costs rationale upon which the Commission bases its proposed regulations is undermined by data demonstrating pro-competitive, pro-choice marketplace trends - documented in the Eighteenth Wireless Competition Report - favoring easier ability and incentives to switch providers.

 

By proposing to subject only broadband ISPs to its new privacy regulations, the Commission's rules ignore the numerous other IP-enabled services and providers that collect personal information from consumers using the Internet. Online video distributors (OVDs), social media platforms, along with other web-based apps and online services routinely collect personal information from consumers. The disparate regulatory treatment between commercial market participants that is not justified on any policy grounds.

 

The Commission proposed regulations would also reduce consumer choice. If imposed, the nearly ubiquitous "opt-in" requirements regarding PII risk would discourage ISPs from offering consumers targeted marketing deals, selling advertisements to personally design consumer experiences, or offering sponsored data as well as free data or zero-rated plans - all of which potentially could benefit them. The Commission's contemplation of a ban on certain "financial inducement practices," such as offering discounts for use of PII, would deprive consumers of their choice to enjoy free or inexpensive services. Consumers are competent to decide for themselves what form of "payment" - whether in the form of the exchange of personal information or money - that they are willing to make for services.

 

There is no evidentiary basis for assuming consumers want different sets of basic data privacy protections to apply depending upon whether they are doing business with an ISP or an edge provider - or certainly that they prefer more stringent requirements for ISPs than firms like Google, Amazon, and others that they know are data-grabbers. Nor is there any basis for thinking consumers want different sets of data privacy protections from a single provider depending on the particular service being used at one time or another. Instead of imposing uneven, sector-specific, choice-limiting regulations, the better policy approach to protecting consumer privacy on the Internet is to establish common standards under the jurisdiction of a common enforcer.

 

The digital privacy framework proposed by the White House in 2012 offers a realistic means of establishing a set of common rules with a common enforcer. Under this approach, privacy codes of conduct are to be established through a voluntary multi-stakeholder process. The Federal Trade Commission (FTC) would have authority to enforce those codes against providers who agree to abide by them but fail to do so in practice. Significant efforts have already been expended in that process. Obviously, the proposed regulations effectively would doom the prospects of the multi-stakeholder process for establishing consumer privacy protections for ISP subscribers. The far better approach for protecting consumer privacy is to refocus resources and attention on the multi-stakeholder process in order to forge a common set of rules and a common enforcer to protect consumer privacy on the Internet.