California Moves Ahead on Closely Watched Internet Privacy Bill

Consumer Reports has no relationship with any advertisers on this website.

California's legislature moved closer this week to approving internet privacy protections that could set the standard for other states to follow.

The privacy bill, which would restore many protections that Congress removed at the federal level earlier this year, cleared several procedural hurdles, setting the stage for a final vote by California lawmakers later this summer.

The state measure is being watched closely by both sides of the internet privacy issue. Consumer advocates and some small internet service providers, or ISPs, have lined up in favor of the new regulations, while larger ISPs oppose them.

What’s at stake for consumers? The bedrock question of whether the company you pay for internet service can boost its revenues by selling or otherwise sharing information on what you do online.

This privacy battle is likely to affect consumers across the country, regardless of whether they live in California or one of the 20 or so other states considering expanded data privacy protections.

If enough states were to pass legislation regulating ISPs, privacy advocates believe that the companies might start supporting federal regulations to supersede an emerging patchwork of state laws. Such companies lobbied for the rollback of federal regulations earlier this year.

The bill would prohibit an ISP “from using, disclosing, selling, or permitting access to customer personal information” except when the consumer has given explicit “opt-in” consent, “which may be revoked by the customer at any time.”

Under the law, ISPs would also be prohibited from refusing service to customers who don’t provide consent.

Those protections mirror the key provisions in federal rules that were set up by the Federal Communications Commission in the final months of the Obama administration in late 2016, and rolled back by Congress and the Trump administration in April before they could go into effect.

The proposed California legislation takes the federal rules a step further, prohibiting ISPs from offering discounts or other incentives to entice customers to opt into data collection.

Are ISPs Utilities?

Consumers Union, the policy and mobilization arm of Consumer Reports, is supporting the California legislation and encouraging state residents to contact their legislators and urge them to vote in favor of the measure.

“With the repeal of the FCC's broadband privacy rule, consumers have very few privacy protections for their activities online,” says Jessica Rich, vice president of consumer policy and mobilization for Consumer Reports. “Internet service providers play a unique gatekeeper role in connecting consumers to the internet, and they have unique access to consumers' personal data. For consumers in California, this bill restores many of the privacy protections that they lost when the FCC rule was repealed."

About one in eight Americans lives in the state.

Opposition to the bill comes from several of the biggest ISPs, including Comcast, Verizon, and AT&T, which are best positioned to profit from aggregating and selling data.

“This is absolutely well intentioned, but it doesn’t protect privacy in the way that the sponsors want,” says former Federal Trade Commission chair Jon Leibowitz, who now works for the Washington-based law firm Davis, Polk & Wardell LLC and has become a major player in the opposition to the California bill.

"We believe it will lead to consumer confusion, diminish the internet experience, and result in a hodgepodge of state-by-state regulations," adds Steven Mavilglio, a spokesman for AT&T in California.

The internet service providers often maintain that it’s both confusing and unfair for them to face stricter privacy rules than so-called “edge providers,” which include Google, Amazon, Facebook, and other web companies.

Advocates of the California bill argue that ISPs are essentially utilities and should be regulated as such. Consumers can make an effort to avoid Google, the argument goes, but there’s no way to circumvent a broadband provider.

“Your phone provider can’t keep a record of your phone calls and use that to market to you or to share with third parties,” says Samantha Corbin, a Sacramento attorney who’s spearheading the efforts to move the California legislation forward.

Corbin says that ISPs are poised to use privacy itself as a revenue stream. In 2016, AT&T dropped a controversial program, rolled out in Austin, Texas, that charged consumers as much as $800 a year for the right to opt out of data collection.

In an interview last month on C-Span, AT&T senior vice president Robert Quinn suggested that a pay-for-privacy pricing structure might be the wave of the future. “As the privacy revolution evolves, I think people are going to want more control and maybe that’s the pricing model that ultimately is what consumers want.”

Privacy supporters say such a model would effectively penalize those who want more privacy, and hurt lower-income consumers.

Some ISPs Backing the Calif. Proposal

Support for the California bill is coming from one surprising quarter: A number of smaller ISPs are in favor of stronger privacy protections.

“It’s great to see the California State Legislature taking this on,” says Dane Jasper, CEO of Sonic, a California-based digital provider. Sonic has 100,000 subscribers in 125 communities throughout the state. “We feel there’s a substantial chilling effect if consumers feel like there's someone looking over their shoulder.”

“We’re 100 percent for it,” James Persky, CEO of Pacific Internet, says. “Consumer privacy is a right and the default should be that no information is shared.”

Jasper says there's also a strong business incentive for smaller ISPs to support the law: Allowing larger carriers to use consumer data as a revenue source gives big companies an additional edge in the marketplace.

“I don’t think we have the practical ability to monetize ad tailoring the way large carriers do,” Jasper says. “This will create a fundamentally unlevel playing field.”

Wide Support for ISP Privacy

The California bill had faced an uphill battle because of a series of procedural hurdles put in its way by Kevin De Leon, president pro tempore of the California State Senate. DeLeon initially tried to table the bill to keep it from a vote during this session, and while he ultimately relented, he forwarded the bill to three separate committees. The move was seen by the bill's advocates as a way to make passage less likely.

“Opponents of the bill get three bites at the apple,” Ernesto Falcon, legislative counsel with the Electronic Frontier Foundation, said before the committee votes. EFF has been one of the main proponents of the bill.

DeLeon’s office did not respond to a request for comment.

This week, one of the Senate committees waived its vote, and the other two committees passed the bill after getting a promise that some revisions would be made over the next month.

The bill would have to pass both the Senate and Assembly by September 15 to be eligible for Governor Jerry Brown's signature before the end of the session. Proponents of the bill say it has a good chance of becoming law, because the protection of data privacy is one of the rare issues that enjoys robust support from both ends of the political spectrum.

A nationally representative survey of 1,007 adults conducted by Consumer Reports in April reveals that 92 percent of consumers think internet service providers, such as Comcast and Verizon, should be required to get permission from users before selling or sharing their data.

In a separate nationally representative CR survey of 1,008 adults in May, 85 percent of consumers say that they—and not the ISP—are the rightful owners of any data collected about their internet use.

“It’s super rare to have something with such wide condemnation,” Falcon says about the rollback of the federal privacy regulations. Trump voters, he says, are just as likely as Democrats to support ISP privacy protections.

Editor's Note: This article has been updated to reflect the result of California State Senate committee votes.