5 ms·

The common response to this is that ISPs have access to everything you do (which is true), and that they could sell that (which is false). The regulations bein

The common response to this is that ISPs have access to everything you do (which is true), and that they could sell that (which is false). The regulations being overturned here are ones that have only recently taken effect, and non-anonymized, non-aggregate selling of ISP data is still outlawed by the Cable Communications Act of 1984, which protects subscriber privacy is 47USC § 551[1]. Put simply, neither the most recent executive order, nor a reversal on Net Neutrality overturns that law on the federal register. Of course, if Congress were to draft a bill that does so, the current fears would be well justified. https://www.law.cornell.edu/uscode/text/47/551 https://www.law.cornell.edu/uscode/text/47/551

Rebelgecko 9y ago
Legally, is there a minimum requirement for what it takes for data to be considered "anonymized"? Just because the customers' billing info isn't included doesn't mean you can't figure out who is responsible for traffic.
- bmelton 9y ago
  There might be multiple options that the federal government would respect: * https://www.gpo.gov/fdsys/pkg/USCODE-2010-title5/html/USCODE-2010-title5-partI-chap5-subchapII-sec552a.htm https://www.gpo.gov/fdsys/pkg/USCODE-2010-title5/html/USCODE... * http://ws680.nist.gov/publication/get_pdf.cfm?pub_id=904990 http://ws680.nist.gov/publication/get_pdf.cfm?pub_id=904990 Legally, I can't think of a case where it's been tested that didn't lean the government's way, so who knows?
guelo 9y ago
So you're saying this most recent regulation does absolutely nothing, even though it was the highest priority for the incoming industry friendly regulator. Seems doubtful that some 1984 law is going to protect our browsing data.
- bmelton 9y ago
  I'm not saying it does nothing. I'm saying it doesn't do what people think it does. Repealing the Obama rule does mean that you can't opt out of data collection or sale. It does not mean that your individual browsing records are available to anyone with enough cash. Moreover, much of the rules Trump's executive order overturn had either very recently taken effect, or not yet taken effect. There may be much theoretical damage from overturning the regulations, but the practical effect here will be minimal, and limited because of the other laws that already exist to prevent exactly the doomsday scenario many are predicting. I'm not saying that Trump isn't after your privacy rights, but the surest test of that will be whether or not he goes after or seeks to circumvent the 1984 protections I referenced earlier.
- chiefalchemist 9y ago
  You're correct. But only because - per Chaos Monkeys, Dragnet Nation, and the like - your data is already being captured, aggregated, and sold. If that's your concern, you're too late. On the other hand if your concern is specify to ISPs (as opposed to other entities you don't even know) then sure worry and complain. But at least your ISP has an incentive to not go too crazy, as the data they sell could be used to market to you to leave that ISP ;)
  - stolsvik 9y ago
    You can turn cookies off or similar, or you can choose to not use or employ such services. That the ISP can do this, without your consent - each DNS lookup, each TCP connection you're making - is a whole different thing. I think it is truly insane.
    - chiefalchemist 9y ago
      Fyi...They can, with reasonable accuracy, track you across multiple devices. And that was 3+ years ago. I'm sure it's only gotten better since. I do agree. There are somethings you can do to mitigate things. But at some point you have to be you (e.g., FB, etc.) and as small and minor as such digital breadcrumbs might seem, they add up.
lightbyte 9y ago
"Anonymized" aggregate data is not as anonymous as you might think. This study [1] was able to accurately de-anonymize users based on internet history and public social media 70% of the time. [1] http://randomwalker.info/publications/browsing-history-deanonymization.pdf http://randomwalker.info/publications/browsing-history-deano...
- deleted 9y ago
  [deleted]
guelo 9y ago
The law section you linked to is concerned with PII, personally identifiable information. But what ISPs are most likely to sell is anonymized browsing data, i.e. when an advertiser goes to display an ad the ISP will tell them what other URLs you've been to but they won't tell the advertiser your name, address, social, etc.
- bmelton 9y ago
  Agreed, with the caveat that there are also restrictions requiring aggregation as well.
  - guelo 9y ago
    The only thing your link says about aggregate data is that PII is not aggregate data, meaning that aggregate data is exempt from these restrictions.
    - bmelton 9y ago
      So, that's applicable to every instance except where being provided to the government (section h), and . It's somewhat circular in that regard. Combined with disclosure restrictions, specifically 2(c)(ii), the net result is that only aggregate disclosure is allowed unless specifically permitted by the end users.
      - guelo 9y ago
        My reading of it is that anonymized individual non-PII data, such as browsing history, is allowed to be sold.
        bmelton 9y ago
        You may be correct, now that I re-read it again. There may be something in a subsequent act that prevents non-aggregate data, but until/unless I find that, I'm working under the assumption that you are right and I am wrong, regarding aggregation.
dsp1234 9y ago
That section of law says they can sell your data with prior written or electronic permission. 47 U.S. Code § 551 (c)(1) Except as provided in paragraph (2), a cable operator shall not disclose personally identifiable information concerning any subscriber without the prior written or electronic consent of the subscriber concerned So this section of the law, though another might, does not support your statement that "that they could sell that (which is false)".
- bmelton 9y ago
  I think you're misreading it, unless you have reason to believe that you've already given your permission. Either way, the regulation that Trump's EO overturns also allowed you to opt in if you wanted to.
  - shkkmo 9y ago
    Wouldn't a privacy policy cover "the prior written or electronic consent of the subscriber concerned"
    - bmelton 9y ago
      If so, I don't know how the Obama regulation would have been any different.
  - PeterisP 9y ago
    I believe that pretty much every single customer has given their "permission" in that sense, the standard contract or terms&conditions would include language that says that you consent to such information "being processed by selected partners" or something like that.
  - dsp1234 9y ago
    non-anonymized, non-aggregate selling of ISP data is still outlawed by Your statement is too strong. It's not outlawed. There is a relatively easy avenue for ISPs to sell this type of data, and it's written into the law, and not some sort of weird loophole. It is voluntary that they have not pursued it on their part.
pseudalopex 9y ago
47 USC 551 only applies to cable operators, and the 6th Circuit ruled that it doesn't apply to Internet service.[1] [1] http://www.opn.ca6.uscourts.gov/opinions.pdf/06a0366p-06.pdf http://www.opn.ca6.uscourts.gov/opinions.pdf/06a0366p-06.pdf

Rebelgecko 9y ago

Legally, is there a minimum requirement for what it takes for data to be considered "anonymized"? Just because the customers' billing info isn't included doesn't mean you can't figure out who is responsible for traffic.

bmelton 9y ago
There might be multiple options that the federal government would respect: * https://www.gpo.gov/fdsys/pkg/USCODE-2010-title5/html/USCODE-2010-title5-partI-chap5-subchapII-sec552a.htm https://www.gpo.gov/fdsys/pkg/USCODE-2010-title5/html/USCODE... * http://ws680.nist.gov/publication/get_pdf.cfm?pub_id=904990 http://ws680.nist.gov/publication/get_pdf.cfm?pub_id=904990 Legally, I can't think of a case where it's been tested that didn't lean the government's way, so who knows?

guelo 9y ago

So you're saying this most recent regulation does absolutely nothing, even though it was the highest priority for the incoming industry friendly regulator. Seems doubtful that some 1984 law is going to protect our browsing data.

bmelton 9y ago
I'm not saying it does nothing. I'm saying it doesn't do what people think it does. Repealing the Obama rule does mean that you can't opt out of data collection or sale. It does not mean that your individual browsing records are available to anyone with enough cash. Moreover, much of the rules Trump's executive order overturn had either very recently taken effect, or not yet taken effect. There may be much theoretical damage from overturning the regulations, but the practical effect here will be minimal, and limited because of the other laws that already exist to prevent exactly the doomsday scenario many are predicting. I'm not saying that Trump isn't after your privacy rights, but the surest test of that will be whether or not he goes after or seeks to circumvent the 1984 protections I referenced earlier.
chiefalchemist 9y ago
You're correct. But only because - per Chaos Monkeys, Dragnet Nation, and the like - your data is already being captured, aggregated, and sold. If that's your concern, you're too late. On the other hand if your concern is specify to ISPs (as opposed to other entities you don't even know) then sure worry and complain. But at least your ISP has an incentive to not go too crazy, as the data they sell could be used to market to you to leave that ISP ;)
- stolsvik 9y ago
  You can turn cookies off or similar, or you can choose to not use or employ such services. That the ISP can do this, without your consent - each DNS lookup, each TCP connection you're making - is a whole different thing. I think it is truly insane.
  - chiefalchemist 9y ago
    Fyi...They can, with reasonable accuracy, track you across multiple devices. And that was 3+ years ago. I'm sure it's only gotten better since. I do agree. There are somethings you can do to mitigate things. But at some point you have to be you (e.g., FB, etc.) and as small and minor as such digital breadcrumbs might seem, they add up.

lightbyte 9y ago

"Anonymized" aggregate data is not as anonymous as you might think. This study [1] was able to accurately de-anonymize users based on internet history and public social media 70% of the time. [1] http://randomwalker.info/publications/browsing-history-deanonymization.pdf http://randomwalker.info/publications/browsing-history-deano...

deleted 9y ago
[deleted]

guelo 9y ago

The law section you linked to is concerned with PII, personally identifiable information. But what ISPs are most likely to sell is anonymized browsing data, i.e. when an advertiser goes to display an ad the ISP will tell them what other URLs you've been to but they won't tell the advertiser your name, address, social, etc.

bmelton 9y ago
Agreed, with the caveat that there are also restrictions requiring aggregation as well.
- guelo 9y ago
  The only thing your link says about aggregate data is that PII is not aggregate data, meaning that aggregate data is exempt from these restrictions.
  - bmelton 9y ago
    So, that's applicable to every instance except where being provided to the government (section h), and . It's somewhat circular in that regard. Combined with disclosure restrictions, specifically 2(c)(ii), the net result is that only aggregate disclosure is allowed unless specifically permitted by the end users.
    - guelo 9y ago
      My reading of it is that anonymized individual non-PII data, such as browsing history, is allowed to be sold.
      - bmelton 9y ago
        You may be correct, now that I re-read it again. There may be something in a subsequent act that prevents non-aggregate data, but until/unless I find that, I'm working under the assumption that you are right and I am wrong, regarding aggregation.

dsp1234 9y ago

That section of law says they can sell your data with prior written or electronic permission. 47 U.S. Code § 551 (c)(1) Except as provided in paragraph (2), a cable operator shall not disclose personally identifiable information concerning any subscriber without the prior written or electronic consent of the subscriber concerned So this section of the law, though another might, does not support your statement that "that they could sell that (which is false)".

bmelton 9y ago
I think you're misreading it, unless you have reason to believe that you've already given your permission. Either way, the regulation that Trump's EO overturns also allowed you to opt in if you wanted to.
- shkkmo 9y ago
  Wouldn't a privacy policy cover "the prior written or electronic consent of the subscriber concerned"
  - bmelton 9y ago
    If so, I don't know how the Obama regulation would have been any different.
- PeterisP 9y ago
  I believe that pretty much every single customer has given their "permission" in that sense, the standard contract or terms&conditions would include language that says that you consent to such information "being processed by selected partners" or something like that.
- dsp1234 9y ago
  non-anonymized, non-aggregate selling of ISP data is still outlawed by Your statement is too strong. It's not outlawed. There is a relatively easy avenue for ISPs to sell this type of data, and it's written into the law, and not some sort of weird loophole. It is voluntary that they have not pursued it on their part.

pseudalopex 9y ago

47 USC 551 only applies to cable operators, and the 6th Circuit ruled that it doesn't apply to Internet service.[1] [1] http://www.opn.ca6.uscourts.gov/opinions.pdf/06a0366p-06.pdf http://www.opn.ca6.uscourts.gov/opinions.pdf/06a0366p-06.pdf