U.S. GOVERNMENT PUBLISHING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Publishing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

24–204 PDF 2017

S. HRG. 114–564 

HOW WILL THE FCC’S PROPOSED PRIVACY 

REGULATIONS AFFECT CONSUMERS 

AND COMPETITION? 

HEARING 

BEFORE THE

COMMITTEE ON COMMERCE, 

SCIENCE, AND TRANSPORTATION 

UNITED STATES SENATE 

ONE HUNDRED FOURTEENTH CONGRESS 

SECOND SESSION 

JULY 12, 2016 

Printed for the use of the Committee on Commerce, Science, and Transportation 

( 

(II) 

SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION 

ONE HUNDRED FOURTEENTH CONGRESS 

SECOND SESSION 

JOHN THUNE, South Dakota, Chairman 

ROGER F. WICKER, Mississippi 

ROY BLUNT, Missouri 

MARCO RUBIO, Florida 

KELLY AYOTTE, New Hampshire 

TED CRUZ, Texas 

DEB FISCHER, Nebraska 

JERRY MORAN, Kansas 

DAN SULLIVAN, Alaska 

RON JOHNSON, Wisconsin 

DEAN HELLER, Nevada 

CORY GARDNER, Colorado 

STEVE DAINES, Montana 

BILL NELSON, Florida, Ranking 

MARIA CANTWELL, Washington 

CLAIRE MCCASKILL, Missouri 

AMY KLOBUCHAR, Minnesota 

RICHARD BLUMENTHAL, Connecticut 

BRIAN SCHATZ, Hawaii 

EDWARD MARKEY, Massachusetts 

CORY BOOKER, New Jersey 

TOM UDALL, New Mexico 

JOE MANCHIN III, West Virginia 

GARY PETERS, Michigan 

NICK ROSSI, Staff Director 

ADRIAN ARNAKIS, Deputy Staff Director 

REBECCA SEIDEL, General Counsel 

JASON VAN BEEK, Deputy General Counsel 

KIM LIPSKY, Democratic Staff Director 

CHRIS DAY, Democratic Deputy Staff Director 

CLINT ODOM, Democratic General Counsel and Policy Director 

(III) 

C O N T E N T S 

Page 

Hearing held on July 12, 2016 ............................................................................... 1 

Statement of Senator Thune ................................................................................... 1 

Letter dated July 11, 2016 to Hon. John Thune, Hon. Bill Nelson, Hon. 

Fred Upton, Hon. Frank Pallone, Hon. Greg Walden and Hon. Anna 

Eshoo from Laurence H. Tribe, Carl M. Loeb Universty Professor and 

Professor of Constitutional Law, Harvard Law School; Richard A. Epstein, Laurence A. Tisch Professor of Law, The New York University 

of Law, The Peter and Kirsten Bedford Senior Fellow, The Hoover 

Institution, The James Parker Hall Distinguished Service Professor 

of Law Emeritus and Senior Lecturer, The University of Chicago; Robert Corn-Revere, Partner, Davis Wright Tremaine LLP; Robert D. Atkinson, President, Information Technology and Innovation Foundation; 

Jane Bambauer, Associate Professor of Law, University of Arizona, 

James E. Rogers College of Law; Babette Boliek, Associate Professor 

of Law, Pepperdine University School of Law; Fred H. Cate, Distinguished Professor and C. Ben Dutton Professor of Law, Indiana University Maurer School of Law; James C. Cooper, Associate Professor of 

Law and Director, Program on Economics and Privacy, Scalia Law 

School, George Mason University; Justin (Gus) Hurwitz, Assistant Professor of Law, Nebraska College of Law; Mark A. Jamison, Director 

and Gunter Professor, Public Utility Research Center, University of 

Florida; Daniel A. Lyons, Associate Professor of Law, Boston College 

Law School; Geoffrey A. Manne, Executive Director, International Center for Law and Economics; David W. Opderbeck, Professor of Law, 

Seton Hall University Law School and Director, Gibbons Institute of 

Law, Science and Technology; and Paul H. Rubin, Samuel Candler 

Dobbs Professor of Economics, Emory University ...................................... 62 

Letter dated July 11, 2016 to Hon. John Thune and Hon. Bill Nelson 

from Gary Shapiro, President and CEO, Consumer Technology Association; Jim Halpert, President and CEO, Internet Commerce Coalition; 

Jonathan Spalter, Chair, Mobile Future; Scott Belcher, CEO, Telecommunications Industry Association; Meredith Attwell Baker, President and CEO, CTIA®; Genevieve Morelli, President, ITTA; Michael 

Powell, President and CEO, National Cable and Telecommunications 

Association; and Walter B. McCormick, Jr., President and CEO, 

USTelecom ..................................................................................................... 64 

Paper entitled ‘‘The Curious Absence of Economic Analysis at the Federal 

Communications Commission: An Agency in Search of a Mission’’ by 

Gerard R. Faulhaber and Hal J. Singer ...................................................... 67 

Statement of Senator Nelson .................................................................................. 3 

Statement of Senator Blunt .................................................................................... 131 

Statement of Senator Schatz .................................................................................. 132 

Statement of Senator Markey ................................................................................. 134 

Statement of Senator Moran .................................................................................. 137 

Statement of Senator Klobuchar ............................................................................ 139 

Statement of Senator Daines .................................................................................. 141 

Statement of Senator Gardner ............................................................................... 143 

Statement of Senator Heller ................................................................................... 145 

Statement of Senator Blumenthal .......................................................................... 147 

WITNESSES

Hon. Jon Leibowitz, Partner, Davis, Polk & Wardwell and Co-Chairman, 

21st Century Privacy Coalition ........................................................................... 4 

Prepared statement .......................................................................................... 6 

Page

IV 

Dean C. Garfield, President and CEO, Information Technology Industry 

Council (ITI) ......................................................................................................... 14 

Prepared statement .......................................................................................... 15 

Paul Ohm, Professor, Georgetown University Law Center and Faculty Director, Georgetown Center on Privacy and Technology ......................................... 20 

Prepared statement .......................................................................................... 22 

Matthew M. Polka, President And CEO, American Cable Association ............... 28 

Prepared statement .......................................................................................... 29 

Peter Swire, Huang Professor of Law and Ethics, Scheller College of Business, 

Georgia Institute of Technology .......................................................................... 35 

Prepared statement .......................................................................................... 37 

Article dated May 2016 entitled ‘‘Online Privacy and ISPS: ISP Access 

to Consumer Data is Limited and Often Less than Access by Others’’ 

by Peter Swire ............................................................................................... 48 

APPENDIX

Response to written questions submitted by Hon. Deb Fischer to: 

Paul Ohm .......................................................................................................... 155 

Dean C. Garfield ............................................................................................... 155 

Matthew M. Polka ............................................................................................ 156 

(1) 

HOW WILL THE FCC’S PROPOSED PRIVACY 

REGULATIONS AFFECT CONSUMERS 

AND COMPETITION? 

TUESDAY, JULY 12, 2016 

U.S. SENATE, 

COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION, 

Washington, DC. 

The Committee met, pursuant to notice, at 10:04 a.m. in room 

SR–253, Russell Senate Office Building, Hon. John Thune, Chairman of the Committee, presiding. 

Present: Senators Thune [presiding], Nelson, Cantwell, Blunt, 

Rubio, Klobuchar, Ayotte, Blumenthal, Heller, Schatz, Markey, 

Fischer, Sullivan, Moran, Manchin, Johnson, Peters, Gardner, and 

Daines. 

OPENING STATEMENT OF HON. JOHN THUNE, 

U.S. SENATOR FROM SOUTH DAKOTA 

The CHAIRMAN. Good morning. This hearing will come to order. 

The protection of privacy on the Internet is vital. Protection from 

identity theft, protection from deeply private information: this is 

important to us as citizens and as consumers, and it’s fundamental 

for allowing the Internet and the information economy to thrive, 

and thrive they have. 

Internet usage has increased 900,000 percent since the Telecom 

Act of 1996, and to meet that demand, the broadband industry has 

invested $1.4 trillion. This growth occurred under the Federal Communications Commission’s light regulatory treatment of the Internet as an information service, and under the careful eye of the Federal Trade Commission, which, with limited exceptions, was responsible for protecting consumer privacy on the Internet. The FTC 

has brought over 500 cases protecting the privacy and security of 

consumer information, including cases where companies were alleged to have deceptively tracked consumers online or to have 

shared privacy consumer data with unauthorized third parties. 

The FTC has been the leader in protecting consumer privacy, but 

with the FCC’s 2015 Open Internet Order, all of that changed. 

Broadband Internet Access Service, or BIAS, was reclassified as a 

telecommunications service, which, in turn, meant the FTC lost its 

jurisdiction over the privacy policies of BIAS providers. 

So now, after having forced the FTC off the field for broadband 

providers, the FCC has proposed a novel regulatory scheme for the 

newly reclassified providers. But the FCC’s rules would apply only 

to certain parts of the Internet, and that is a source of significant 

2 

concern. Both the Obama administration and the FTC have endorsed a consistent privacy regime across the digital landscape. Indeed, the FTC staff filed comments with the Commission stating, 

‘‘The FCC’s proposed rules, if implemented, would impose a number of specific requirements on the provision of BIAS services that 

would not generally apply to other services that collect and use significant amounts of consumer data. This outcome is not optimal.’’ 

For those of you not familiar with bureaucrat-speak, let me tell 

you this, when they say, ‘‘this outcome is not optimal,’’ it’s pretty 

strong stuff for one agency to say about another. 

I share the FTC’s concern, and by overwhelming majority, so do 

the American people. Progressive Policy Institute polling shows 

that 94 percent of Internet users believe that all companies collecting data online should follow the same consumer privacy rules 

so that consumers can be assured that their personal data is protected regardless of the company that collects or uses it. 

I am concerned that at any particular time consumers will not 

have reasonable certainty of what the rules are and how their privacy decisions apply. At home on Wi-Fi? At home on a smartphone? 

Using your smartphone on a friend’s Wi-Fi? Using the Internet at 

a library? Each of these could have very different privacy implications for a consumer because of the FCC’s proposed piecemeal approach to privacy. 

There are other problems for consumers as well. Will the Commission’s proposed rules make it more or less likely that BIAS providers will be able to provide better and more innovative services 

that could benefit consumers? And of particular importance to our 

rural communities, how are small BIAS providers going to be able 

to comply with the Commission’s proposed regulations? Most of the 

rural carriers in South Dakota have between 2,000 and 5,000 

broadband subscribers. How are they supposed to pay for the additional staff, software licenses, training, and other expenses that 

would be required to comply with the Commission’s proposed rules? 

The FCC’s push for a separate regulatory scheme for BIAS providers is based in significant part on their claim that ISPs are the 

most important and extensive conduits of consumer information, 

and thus have access to very sensitive and very personal information. I am not so sure about that. It appears that many companies 

that are not broadband providers have access to information about 

consumers that is more personal and more sensitive than much of 

what ISPs can access, yet those entities are not covered by the 

Commission’s proposal. 

Is the FCC, which is a novice when it comes to regulating Internet privacy, the right agency to protect us from identity theft and 

to protect our private information? Do we want to have inconsistent 

privacy protection for consumers, with distinctions based upon how 

the Commission chooses to classify services under the Communications Act, an act that never envisioned the FCC dealing with online 

privacy or cybersecurity? Would consumers and companies be better off with the FCC’s proposal? 

The witnesses we have before us today represent a broad variety 

of backgrounds and are true experts on these issues. And I look forward to your answers to these and other questions that you are 

asked here today. 

3 

With that, I would yield to our distinguished Ranking Member, 

the Senator from Florida, Senator Nelson, for an opening statement. 

STATEMENT OF HON. BILL NELSON, 

U.S. SENATOR FROM FLORIDA 

Senator NELSON. Thank you, Mr. Chairman. 

If we all share the same goal of how to best protect consumer online privacy, then it seems that we are bifurcated in our approach 

to this because in looking at the FCC’s proposed privacy rules, both 

sides of the debate come at these questions with preconceived notions about how best to achieve this goal. On the one side, we are 

told that the FCC should not be adopting any rules for broadband 

providers because we are not also applying those same rules to 

every online player. On the other side, we’re told that the FCC 

should adopt the most stringent rules possible in order to prohibit 

broadband providers from using any consumer data. 

Well, it seems to me that the question is ultimately how to preserve the benefits of online commerce, but in a way that takes into 

account consumers’ right to know about and, when appropriate, 

control the collection and use of their personal information. So putting aside the claims of regulatory overreach or power grabs, isn’t 

it clear the FCC is the expert agency for regulating communications networks, including broadband networks? It is an expert oversight agency with flexible forward-looking authority to protect consumers. 

If the content is governed by the FTC under the fair and deceptive practices standard, isn’t it right for the FCC, as it has over the 

past several years and as I have pushed, to also use its authority 

to protect privacy? We need regulators who are not afraid to use 

their authority when necessary, to protect consumer privacy, but 

also we need the regulators to know when to exercise that authority in a restrained manner. 

Now, this is a difficult balance, but that doesn’t mean that an 

agency should defer or otherwise be reluctant to do what it believes 

is in the best interest of protecting consumers. The FCC is still in 

the middle of a rulemaking to sort all of this out. 

Thank you, Mr. Chairman, for calling this hearing so that we can 

hear all the attitudes about the FCC’s proposals and alternative 

approaches, but at the end of the day, I can tell you this Senator 

is going to side with the consumers in whichever approach that I 

can conclude best protects the privacy of broadband subscribers. 

Thank you, Mr. Chairman. 

The CHAIRMAN. Thank you, Senator Nelson. 

We’ve got a great panel today to hopefully shed some light on 

this subject. And on my left and your right is Mr. Jon Leibowitz, 

a Partner at Davis, Polk & Wardwell, and a Co-Chair of the 21st 

Century Privacy Coalition. He is also a former Chairman of the 

Federal Trade Commission. 

Next to him is Mr. Dean Garfield, who is the President and CEO 

of the Information Technology Industry Council. 

Professor Paul Ohm of Georgetown University Law Center. 

And Mr. Matthew Polka. He is the President and CEO of the 

American Cable Association. 

4 

And Professor Peter Swine [sic], the Huang Professor of Law and 

Ethics for the Scheller College of Business at the Georgia Institute 

of Technology. 

We’re delighted to have all of you with us today. Thank you for 

being here. We look forward to hearing from you and asking you 

some questions. And we’ll start, as I said, on my left, and your 

right, with Mr. Leibowitz. So please proceed with your remarks. 

And if you could all confine it as close to possible with 5 minutes, 

we would very much appreciate it. 

Thank you. 

STATEMENT OF HON. JON LEIBOWITZ, PARTNER, DAVIS, POLK 

& WARDWELL AND CO-CHAIRMAN, 21ST CENTURY PRIVACY 

COALITION 

Mr. LEIBOWITZ. Thank you, Chairman Thune, Senator Nelson, 

other distinguished members of the Committee. I appreciate you inviting me to testify today on behalf of the 21st Century Privacy Coalition, which I chair with former Representative Mary Bono. 

Our Coalition is comprised of the Nation’s leading communications companies, which have a strong interest in bolstering consumers’ trust in online services. We believe the best way to ensure 

protection of consumer privacy is through a comprehensive and 

technology-neutral framework based on the type of data being collected and how it is used rather than on the type of entity collecting the data. And that is exactly the approach that the Obama 

administration has endorsed and the FTC has taken in decades, as 

you know, of robust privacy enforcement. 

The FTC has held hundreds of companies, large and small, accountable for breaking their privacy commitments to consumers, 

and by taking a largely enforcement-based approach rather than 

setting out prescriptive rules, the FTC has powerfully protected 

privacy while permitting the type of high-tech innovation that has 

yielded huge benefits to all Americans. And when the FTC has 

done a rulemaking—so think about Do Not Call or the Children’s 

Online Privacy Protection Act, as Senator Klobuchar and Senator 

Markey know, they have been successful. Indeed, the FTC approach has been so successful that in 2012 the White House called 

on the FTC to be solely responsible for protecting the privacy of 

every American across every industry, and that, of course, includes 

ISPs. 

As we know, last year the FTC’s sister agency, the FCC, reclassified Internet service providers as common carriers, as part of the 

Open Internet Order. That decision removed ISPs from the FTC’s 

jurisdiction. Having assumed sole jurisdiction to protect privacy 

among broadband users, the FCC is reasonably engaged in rulemaking. After all, we want to have a cop on the beat. And our Coalition was initially encouraged by Chairman Wheeler’s stated aim 

to craft the proposed privacy rules in a manner, and I quote, consistent with the FTC’s thoughtful, rational approach, and with the 

core principles of the FTC’s 2012 private report in mind. 

But the FCC’s proposed rules, as currently drafted, are very different from FTC practice and policy. Instead, the proposed rules 

impose a restrictive set of requirements on broadband providers 

that don’t apply to other entities that collect much or more conVerDate Nov 24 2008 10:44 Feb 21, 2017 Jkt 075679 PO 00000 Frm 00008 Fmt 6633 Sfmt 6633 S:\GPO\DOCS\24204.TXT JACKIE
5 

sumer online data. The ISP’s specific rules don’t provide clear benefits to consumers, they don’t protect privacy in the way that they 

should, they may themselves be unconstitutional, and more troubling, or at least as troubling, these restrictive requirements represent a fundamental change in the U.S. approach to privacy, a 

change that should not be made lightly or without the input of all 

stakeholders. Indeed, the FCC has not identified any consumer 

harms that warrant a vast departure from the FTC’s successful approach. 

So the goals may be laudable, I have no doubt they are, but the 

draft rules betray a fundamental lack of understanding regarding 

how the Internet ecosystem works. Indeed, the FCC’s proposed 

rules may well discourage the very broadband innovation that the 

FCC is statutorily obligated to promote, thereby harming the very 

consumers it’s supposed to benefit. 

Let me highlight four salient flaws in the FCC’s proposal. 

First, it is not technology-neutral. It would impose prescriptive 

rules on only a subset of the Internet ecosystem, and by doing so, 

diminish broadband providers as a potential competitive force to 

benefit consumers. 

Second, the FCC’s proposal would impose opt-in consent requirements for non-sensitive data and basic everyday business practices, 

like first-party marketing. For example, an ISP, absent an opt-in 

consent, would be prohibited from marketing its own home security, music streaming, or energy management services to its own 

customers using its own customer lists, that makes no sense at all, 

nor would prohibiting a typical working-class family of four from 

accepting a discount in exchange for an ISP using customer information, even if that information isn’t shared with anybody else. 

Consumers should be able to make their own choices as long as 

they are informed choices. Choice is really supposed to be what the 

Internet is about. 

Third, the NPRM, as drafted, would miss the opportunity to create consumer benefits from de-identified data. 

And, fourth, the proposal would impose an unrealistic timeline 

for breach notification and mandate massive overnotification that 

could cause consumers to ignore truly important messages from 

their ISP or from others. 

And don’t take my word for it, as you pointed out, Senator 

Thune, my former agency, the FTC, has referred to aspects of the 

NPRM as, ‘‘not optimal.’’ In the FTC’s comments on the FCC proposal, comment to the FCC, there are 28 separate instances where 

the FTC raises concerns about the FCC’s approach. 

If I could make one suggestion to the FCC, it would be this: listen to the FTC and consider whether the FCC proposal is in tension with the U.S. successful NIST cybersecurity framework or 

could undermine the EU-U.S. Privacy Shield as it works its way 

through the European Parliament. 

Mr. Chairman, I ask for an additional 30 seconds and then I will 

end. Thank you. 

But with that said, let me make one last point: Final rules are 

often more balanced than proposed ones. I think you made this 

point, Senator Nelson. We may see a lot of improvement when the 

NPRM moves to completion. But even if you don’t believe the 

6 

FCC’s current proposal is a solution in search of a problem, it 

would nevertheless create inconsistent standards across the Internet, confuse consumers, and undermine innovation that benefits 

consumers as well. And there are serious questions about whether 

it would withstand constitutional scrutiny. 

For all these reasons, the 21st Century Privacy Coalition’s view 

is that the FCC should adopt the FTC’s time-tested and proven approach, a privacy framework that has largely been embraced by the 

Obama administration. 

Thank you. I’m happy to answer questions. 

[The prepared statement of Mr. Leibowitz follows:] 

PREPARED STATEMENT OF HON. JON LEIBOWITZ, PARTNER, DAVIS, POLK & 

WARDWELL AND CO-CHAIRMAN, 21ST CENTURY PRIVACY COALITION

Chairman Thune, Ranking Member Nelson, other distinguished Members of the 

Committee, thank you for inviting me to testify at this important hearing. My name 

is Jon Leibowitz and, along with former Representative Mary Bono, I serve as CoChair of the 21st Century Privacy Coalition. 

Our group is comprised of the Nation’s leading communications companies, which 

have a strong interest in bolstering consumers’ trust in online services and confidence in the privacy and security of their personal information. We believe that 

consumers should enjoy the same robust protections throughout the Internet ecosystem. I offer testimony today regarding the FCC’s ongoing broadband privacy rulemaking on behalf of our group. 

As consumers’ online activity grows in size and scope, it is more important than 

ever that consumers have a clear notion of how their data is being used and shared, 

and what is being done to protect their data from hackers and other bad actors. 

Since the Internet’s inception, the Federal Trade Commission (‘‘FTC’’) has been the 

main privacy cop enforcing these essential consumer protections. But last year, the 

FTC’s sister agency—the Federal Communications Commission (‘‘FCC’’)—reclassified Internet Service Providers (‘‘ISPs’’) as common carriers subject to Title II of the 

Communications Act, removing ISPs from the FTC’s jurisdiction. Having assumed 

sole jurisdiction over the privacy practices of ISPs, the FCC is currently engaged 

in a rulemaking to set out a privacy framework for ISPs. 

The 21st Century Privacy Coalition was encouraged by FCC Chairman Wheeler’s 

stated aim to craft the proposed broadband privacy rules in a manner ‘‘consistent 

with [the] FTC’s thoughtful, rational approach,’’ and with the core principles of the 

2012 FTC Privacy Report, ‘‘Protecting Consumer Privacy in an Era of Rapid 

Change:’’ privacy-by-design; choice; and transparency. Our group believes that an 

FCC rulemaking consistent with the FTC’s privacy framework would ensure that 

privacy enforcement remains both robust and technology neutral—that is, based on 

the sensitivity of data collected and how that data is used, rather than on the type 

of entity collecting the data. This would protect consumers while continuing to facilitate and encourage innovation and competition on the Internet. 

Such an approach also would better reflect the privacy and data security principles promoted by the Obama Administration after extensive research and outreach 

to stakeholders. In its 2012 Report ‘‘Consumer Data Privacy In a Networked World: 

A Framework for Protecting Privacy and Promoting Innovation in the Global Digital 

Economy,’’ the Administration advocated for ‘‘a level playing field for companies, a 

consistent set of expectations for consumers, and greater clarity and transparency.’’ 

Moreover, the Report also recognizes that most first-party marketing is consistent 

with the context of the provider-consumer relationship, and that ‘‘[c]ompanies 

should be able to infer consumer consent to collect personal data for these limited 

purposes.’’ And the Report encourages companies to develop privacy protections 

based upon the ‘‘sensitivity of the personal data that they collect, use, or disclose.’’ 

In addition, the National Institute of Standards and Technology (‘‘NIST’’) 

Cybersecurity Framework has been highly lauded as an effective means of fostering 

increased security across a multiplicity of industries by placing a priority on risk 

management and flexible standards, rather than prescriptive and inflexible a priori 

rules. 

Unfortunately, while some parts of the FCC’s proposed rules are consistent with 

the Obama Administration and FTC approach, in many important areas the rules 

deviate sharply from that approach, demonstrating both the FCC’s lack of experience in the privacy area, and its failure to fully consider and test the likely impact 

7 

of its proposed rule on consumers and ISPs alike during the course of its drafting 

process. Thus, we agree that, as the FTC noted, the FCC’s approach is ‘‘not optimal.’’ 

The FCC has proposed regulations for ISPs that go well beyond those imposed 

upon the rest of the Internet economy, and which, if adopted, would undercut benefits to the very consumers such rules seek to protect. Yet the FCC has failed to identify any harms or particular problems posed by ISPs that necessitate a divergence 

from the effective privacy framework that has applied to ISPs for years. 

The FCC’s proposed rules do not reflect the economic and technological realities 

of the Internet ecosystem, which bears little to no resemblance to the traditional 

voice services market that the FCC has regulated under its Title II authority. In 

addition, it is inapposite to attempt to analogize the ISP industry to banks or 

health-care companies to which sector-specific laws apply. Online data is collected 

and exchanged by many entities other than ISPs. 

In the Internet ecosystem, myriad entities have access to and use consumers’ online information to provide customers free, advertising-supported content and services, and a wide array of customized capabilities and offerings. Data-driven insights 

and offerings are a key driver of the growth of the Internet economy and the source 

of considerable innovation and benefits for consumers. Unfortunately, the FCC’s 

proposed rules will make it much harder for ISPs to deliver these benefits, particularly compared to other online entities. For example, the NPRM would restrict consumer choice by prohibiting efforts by ISPs to promote broadband access by offering 

discounted service in exchange for targeted marketing. Thus, if enacted in its current form, the NPRM would harm, rather than benefit, consumers. 

In fact, ISPs are new entrants in the online advertising market, where ten companies, none of which are ISPs, hold over seventy percent of the market. The proposed 

rules would curtail ISPs’ ability to enter that market and provide sorely needed 

competition. Under a reasonable reading of proposed rules set forth in the NPRM, 

ISPs would not be able to market their own non-communication-related products— 

like cloud services, music streaming, or a home security system—to their own customers without such customers’ prior opt-in consent. The FCC must avoid an outcome in which ISP marketing practices that are clearly consistent with consumer 

expectations are restricted in a way that undermines consumer choice and eliminates opportunities for consumers to save money on products offered by an existing 

service provider. These marketing restrictions are also inconsistent with marketing 

laws already on the books—including CAN–SPAM and Do-Not-Call—in which Congress struck a balance between privacy and the dissemination of information to consumers by setting up opt-out regimes. 

Moreover, the proposed rules threaten to create not only consumer confusion, but 

also frustration and disruption of their online experiences. In a recent survey published by the Progressive Policy Institute, 94 percent of consumers agreed that ‘‘[a]ll 

companies collecting data online should follow the same consumer privacy rules so 

that consumers can be assured that their personal data is protected regardless of 

the company that collects or uses it.’’ In addition, because the United States has 

highlighted the FTC’s approach to privacy in its negotiations with the European 

Union regarding cross-border data transfers, including the so-called Privacy Shield, 

there are concerns on both sides of the Atlantic that FCC divergence from the FTC 

privacy framework could undermine the Privacy Shield in the European Court of 

Justice as well as other U.S. international privacy negotiations. As the Obama Administration and FTC have long recognized, a truly consistent approach is critical 

to the continued growth of the Internet, to avoiding consumer confusion and misunderstanding regarding the uses of their data, as well as to permitting online innovation and competition to continue to flourish. The FCC’s approach, as currently 

drafted, fails to achieve these important goals. This is an outcome that the FCC 

should abandon before adopting final rules. 

Further, the FCC’s approach suffers from multiple constitutional infirmities and 

is unlikely to withstand court scrutiny. Rather than embark on such an approach 

just to be rebuked by the courts, the FCC should redraft its proposal to take into 

consideration the FTC’s successful approach to privacy and to respect the constitutional boundaries of the FCC’s authority. 

The FTC Approach 

Privacy has long been a cornerstone of the FTC’s consumer protection mission, 

and all of us who worked at the FTC are proud of the work we did to both protect 

consumer privacy and to ensure that consumers continue to benefit from the hightech innovation and competition that has revolutionized modern life. As consumers 

migrate more and more of their lives online, the FTC has worked to ensure both 

8 

that consumer privacy is safeguarded while providing companies with the flexibility 

to use data in ways that benefit consumers and foster competition and innovation. 

The FTC has a proven track record of success, built on robust enforcement, including over 500 successful privacy enforcement actions; occasional regulation such 

as the initial 1999 and subsequent 2010 rulemakings on the Children’s Online Privacy Protection Act; and thoughtful policy initiatives like the 2012 Privacy Report, 

a multi-year endeavor that incorporated the findings of iterative policy workshops 

beginning in 2006, a draft Privacy Report in 2010, and over 450 comments from consumer and industry advocates, technology and policy experts, and the public. Indeed, when the FTC published its comprehensive Privacy Report in 2012, its approach received praise from many consumer and privacy groups, and some criticism 

from businesses. For example, the privacy organization Electronic Frontier Foundation praised the FTC for ‘‘creat[ing] strong guidelines for protecting consumer privacy choices,’’ while the Information Technology and Innovation Foundation criticized the FTC, raising concern about ‘‘important trade-offs and costs’’ associated 

with the FTC framework. 

In the four years since the publication of the FTC’s Privacy Report, in which there 

have been continued developments in the way consumers access and use the Internet itself, the FTC has held more workshops and issued additional reports and guidance tailored to specific sectors, technologies, and practices to account for changes 

in the services offered over the Internet, and in the data collection and tracking 

technologies used by various entities within the Internet ecosystem. Despite these 

changes, the framework established in 2012 and the principles within the framework not only remain the same, but are even more resonant. 

The 2012 Privacy Report presents a single, comprehensive framework that companies should consider and implement when collecting, using, and maintaining consumer data. These principles are: 

(1) Privacy by Design: calling on companies to provide reasonable security for consumer data, to limit the collection of consumer data to what is consistent in 

a context of a particular transaction, to implement reasonable data retention 

and disposal policies, and to maintain reasonable accuracy of consumer data; 

(2) Consumer Choice: encouraging companies to offer consumers the ability to 

make decisions about the collection and use of their personal data in a timely 

and contextual manner; and 

(3) Transparency: encouraging companies to increase the transparency of their information collection and use practices through easily-readable privacy statements and consumer education. 

The FTC furthers these principles through robust enforcement rather than prescriptive regulation. It goes after companies when they break their privacy commitments to consumers or take actions that cause consumers real harm. This approach 

is flexible and promotes high-tech innovation, and it has held hundreds of companies, large and small, accountable when they cause real harm to consumers without 

countervailing benefits to consumers or competition. 

Importantly, in addition to creating a comprehensive framework for both online 

and offline data collection and use, the FTC Report highlighted the importance of 

a technology-neutral approach to privacy: Even after thoroughly studying the data 

collection and use practices of ISPs and other large platform providers, the FTC concluded that ‘‘[a]ny privacy framework should be technology neutral.’’ In other words, 

privacy enforcement should not depend upon the type of company using or collecting 

consumer data or the particular technology being used to do so. Indeed, the FTC 

specifically examined the question of whether large platform providers—a category 

that includes ISPs, but also social networks, operating systems, browsers, and advertising platforms—should be subject to more stringent privacy obligations and, 

after a comprehensive inquiry, declined to take such a step. Instead, the FTC framework focuses on the sensitivity of the data collected and how those data are used. 

Consistent application of the principles is designed to provide consumers with clear 

and uniform privacy and data security protections, regardless of the particular product or service being used. The Administration has supported the FTC’s policy of 

technology neutrality for privacy and the goal of a harmonized privacy framework 

for the entire Internet ecosystem. 

Finally, it is worth noting that the comments the FTC filed in the FCC’s privacy 

proceeding, based largely on its 2012 Privacy Report, were unanimously supported 

by all three sitting commissioners. There is more enduring impact, and often more 

legitimacy, from bipartisan regulatory action. 

9 

The FCC’s Proposed Rules 

The FCC’s stated principles of transparency, consumer choice, and data security 

are framed as matching the principles at the heart of the FTC’s framework and 

other privacy regimes in the United States and globally. And certain specific proposals in the NPRM are also consistent with the FTC approach. For example, the 

FCC’s call for notice and consent to consumers of retroactive material changes to 

data collection and use is consistent with the FTC’s framework and enforcement. 

But, as the FTC staff noted in its comments on the FCC’s proposal, ‘‘the FCC’s 

proposed rules, if implemented, would impose a number of specific requirements on 

the provision of [broadband] services that would not generally apply to other services that collect and use significant amounts of consumer data. This is not optimal.’’ 

In effect, the FCC proposal amounts to a de facto rejection of the FTC’s technology 

neutral treatment of ISPs under the same set of standards applicable throughout 

the Internet ecosystem. Instead, the FCC’s proposed rules require a broad default 

opt-in requirement for the use and sharing of customer data, with limited exceptions, rather than narrowly tailoring its opt-in to the collection and use of sensitive 

customer data. The FCC is also much more restrictive with regard to first-party 

uses of information, which enable companies to improve their service and apprise 

their customers of offers and products of interest to them. The FCC should recognize 

the FTC’s experience and heed the latter’s concerns with the NPRM. 

The breadth of data covered by the proposal, and the highly restrictive nature of 

the permissions regime employed by the FCC, creates a serious risk of unforeseen 

consequences that could adversely affect Internet capabilities and operations as well 

as disrupt consumer expectations. During the development of the 2012 Privacy Report, FTC staff addressed the potential impact of various proposals and ideas 

through extensive ‘‘stress testing,’’ whereby staff held scores of meetings with industry and consumer groups alike to test particular components in order to determine 

whether the desired outcome would be achieved. The FCC should conduct similar 

meetings to fully understand the effects of its proposed requirements, which have 

the potential to disrupt not only the broadband industry, but the entire Internet ecosystem, including competition in the online advertising market. What follows is a 

discussion of specific differences between the FCC proposed rules and the FTC approach. 

Scope 

The FCC’s Notice of Proposed Rulemaking (‘‘NPRM’’) applies onerous privacy and 

security requirements to a sweeping range of information that is not sensitive, such 

as IP and MAC addresses, as well as any other information that is ‘‘linked or 

linkable to’’ a user or device. This differs from the FTC approach, which sought to 

calibrate the framework’s obligations to incentivize the strongest protections for the 

most sensitive data. 

The FCC’s treatment of de-identified data is particularly problematic. Because deidentified data does not present a risk to consumer privacy or security, the FTC 

framework does not govern the notice, use, disclosure, security, or notification of 

breach of anonymized or de-identified individual data, as long as such data cannot 

be reasonably linked to a particular consumer, computer, or device. The FCC’s proposal appears to confuse the FTC’s guidance on the ‘‘reasonable linkability’’ standard and the appropriate steps companies can take to minimize such linkability with 

a standard for aggregation, which is but one way to de-identify data. The NPRM 

would limit the exception for de-identified data only to data that is both aggregated 

and de-identified. 

By discouraging companies from investing in resources and tools to de-identify 

data, the FCC’s proposal actually exacerbates—rather than mitigates—risks to consumer privacy. For example, as discussed below the proposed breach notification 

rules would require ISPs to notify consumers if there is an incident in which IP addresses are compromised. Because IP addresses on their own cannot be used to 

identify, let alone contact, an individual, the proposed rule would force ISPs to associate IP addresses with appropriate customer contact information to comply, increasing the likelihood that any incident results in the release of information that could 

be used to harm consumers. But both the Administration and FTC policies encourage providers to dissociate such data to minimize the potentially harmful effects of 

any security incident. 

Finally, by including broad categories of non-sensitive data within the scope of the 

NPRM’s definition of customer proprietary information, the FCC invites irrational 

outcomes by placing burdensome requirements on ISPs that serve no discernible 

consumer privacy interest. For example, under a reasonable reading of the rule, 

ISPs must provide notice of data breaches to law enforcement and customers even 

under circumstances where there is no risk of harm to consumers. ISPs would also 

10 

be prohibited from using their own customer lists to e-mail consumers about their 

own non-communications-related products and services. 

Application 

As noted above, in the 2012 Report, the FTC stated: ‘‘[A]ny privacy framework 

should be technologically neutral.’’ There is widespread agreement on this point 

among consumer and industry advocates alike. At the FTC’s December 2012 workshop, ‘‘The Big Picture: Comprehensive Online Data Collection,’’ Maneesha Mithal, 

Associate Director of the Privacy Division at the FTC noted this consensus in her 

closing remarks, describing ‘‘the need for tech neutrality’’ as an area of consensus 

and emphasizing that ‘‘[w]e can’t be picking winners and losers in this space.’’ 

Moreover, since 2012, the precipitous rise of encryption and the proliferation of 

networks and devices have limited the scope of customer data available to ISPs, 

while other companies operating online have gained broader access to consumer 

data across multiple contexts and platforms. For example, today, nearly half of 

Internet traffic is encrypted, dramatically limiting the information visible to ISPs, 

and an estimated 70 percent will be encrypted by the end of this year. This sea 

change in only four years drives home the importance of technology neutral privacy 

frameworks. Because the FCC is not in a position to dictate privacy rules for the 

entire Internet ecosystem, it should strive to harmonize its proposed rules with the 

FTC framework, and carefully consider the consequences of failing to do so. Unfortunately, the NPRM seems to be unaware of marketplace developments in the last 

several years as well as the harms caused by a bi-furcated privacy framework. 

Choice and Context 

In its comments, FTC staff leveled criticism at the FCC’s proposed consumer 

choice rules and recommended ‘‘that the FCC consider the FTC’s longstanding approach, which calls for the level of choice to be tied to the sensitivity of data and 

the highly personalized nature of consumers’ communications in determining the 

best way to protect consumers.’’ In particular, the FTC has never considered all web 

address information to be sensitive. Such a conclusion would have major implications for the entire Internet ecosystem. 

The FCC’s proposed restrictive choice mandates that selectively target ISPs prevent consumers from accessing new products and services and potentially confuse 

them, but provide no benefits to consumers. They also constrain ISPs’ ability to compete with edge providers, and likely will discourage broadband investment in a manner contrary to the FCC’s mandate to promote such investment. 

Under the FTC framework, when a consumer does business with a company, 

there are certain uses of the consumer’s information by the company for which consumer choice is implied because such use is consistent with ‘‘the context of interaction between a business and the consumer.’’ This implied consent covers uses and 

disclosures for product or service fulfillment, internal operations, most first-party 

marketing, and more. As the FTC commented ‘‘[o]pt-in consent should be required 

for use and sharing of contents of consumer communications and sensitive data for 

purposes other than those for which consent is implied.’’ The Administration’s 2012 

report, also recognizes that ‘‘companies may infer consent to use personal data to 

conduct marketing in the context of most first-party relationships.’’ Opt-in consent 

is limited to truly ‘‘sensitive data’’ and technologies that use ‘‘all or substantially all’’ 

customer data. 

The FTC framework calls for a consumer opt-out for almost all online tracking, 

not an opt-in. According to the FTC, ‘‘[o]pt-out is sufficient for use and sharing of 

non-sensitive data.’’ The FCC proposal is a vast departure from this guidance. 

Rather than narrowly tailoring a requirement for opt-in consent to truly ‘‘sensitive 

data,’’ the proposed rules would impose a broad opt-in requirement upon ISPs for 

the use or disclosure of a wide swath of consumer data for an extensive range of 

practices—including practices for which the FTC requires no choice at all because 

consent is implied. The notion that a bright-line opt-in requirement should apply to 

the collection of online information would represent a wholesale revision of U.S. privacy laws and would risk harm to the overall health of the Internet by constraining 

the beneficial use of data. 

The FCC’s proposed rules disregard the context of the interaction between the 

consumer and the service provider. In today’s economy, a company’s relationship 

with its customers involves more than just providing service. It also requires understanding the ways in which services are used, identifying areas for improvement, 

and making consumers aware of product offers and enhancements that may interest 

them. By ignoring the balance between privacy and data-driven insights and innovation, the FCC’s approach actually makes consumers worse off. 

11 

The FTC does not require companies to provide any choice to present advertising 

to their own customers, except where that advertising was presented by tracking a 

user’s online activity across other companies’ websites or intentionally using sensitive information collected from its customers. Under the FCC’s proposal, however, 

any use of customer information that is not relevant to marketing a communications-related service would require opt-in consent from the customer. Indeed, under 

the proposed rules, an ISP would likely not be able to market its own non-communication-related products—like a home security system, cloud services, or music 

streaming—to its own customers without their prior opt-in consent, regardless of the 

marketing channel used and despite the fact that this type of first-party marketing 

is certainly consistent with consumer expectations, and, indeed, with the significant 

benefits consumers have received from lower bundled prices and innovative new offerings for many years. 

The FCC’s overbroad opt-in proposal has the potential to stifle innovation and 

competition in the online advertising marketplace and undermine benefits to consumers. As the FTC has recognized, the ability to effectively monetize online data 

has yielded astounding benefits to consumers. But consumers presented with an optin notice are likely to choose the path of least resistance. That is, many consumers 

will click ‘‘no’’ to avoid devoting time and energy to understanding an opt-in request. 

However, when opt-in requirements are the rule rather than the exception, and consumers take this approach in aggregate, everyone loses out on the benefits of reduced-cost or free products and services subsidized by the effective monetization of 

online data. While ISPs rely primarily on subscription fees, limiting their ability to 

effectively use customer data in turn limits a potential avenue for reducing the cost 

of broadband Internet access to consumers. Consistent with the FTC’s technologyneutral approach, ISPs should be able to use information in a manner consistent 

with consumer expectations and in a way that correlates to how the rest of the 

Internet ecosystem provides choice. Requiring over-inclusive opt-in consent mechanisms would unduly restrict ISPs from participating in the same Internet marketplace the FTC has found to provide benefits to both consumers and competition. 

The FCC’s NPRM also departs fundamentally from FTC guidance and questions 

the core principle of customer notice and choice by suggesting that it could be appropriate to prohibit ISPs from offering discounted services in exchange for being able 

to offer targeted marketing. Many of us may decide that the price to pay to avoid 

personalized marketing is worthwhile, and so long as ISPs provide sufficient information to enable an informed choice, consumers themselves should be able to choose 

how to value their own privacy. The FCC should not interfere with consumer choice. 

The application of a broad opt-in requirement for non-sensitive information as 

proposed by the FCC would create an isolated privacy regime for ISPs that bears 

little correlation with consumer data practices used in virtually every other sector. 

Deviating from the FTC’s privacy framework overall, but especially from the FTC’s 

emphasis on determining consumer choices based upon the sensitivity of the information, the context of a consumer’s interaction with a company, and the consumer’s 

expectations, will inevitably result in consumer confusion over illogical, disparate 

standards applied to the same set of data. Ultimately, while the FCC Privacy NPRM 

purports to be based significantly on the FTC privacy framework, it is far more restrictive in all of the above respects, without providing any clear benefits to consumers or identifying harms it is trying to address. Rather than pay lip service to 

the FTC’s well-tested approach to privacy, the FCC should actually heed the FTC’s 

advice and harmonize the former’s privacy regime with the latter’s. 

Data Security and Breach Notification 

The FCC’s proposed data security provisions, requiring ISPs to take reasonable 

measures to protect customer data, are consistent at a high level with the approach 

set out in the FTC Report. However, their prescriptive and static nature are at direct odds with the NIST Cybersecurity Framework, which has been voluntarily 

adopted by a wide swath of industry and reflects flexible and reasonable standards 

that emphasize business-driven responses and solutions to cyber threats over prescriptive regulatory measures. Specifically, the FCC should replace its strict liability 

data security standard with a reasonableness standard. In addition, these requirements should be more narrowly tailored to apply to customer information that carries a risk of harm in the event of a breach. 

The proposed FCC breach notification rules would require ISPs to notify consumers of a breach of a very broad new definition of ‘‘customer proprietary information,’’ much of which includes categories of data that do not pose any risk of harm 

to customers in the event of a breach, such as IP and MAC addresses and de-identified data. While the concept of breach notification is consistent with the approach 

the FTC and most states have taken, the proposed implementation by the FCC for 

12 

1Laurence Tribe and Jonathan Massey, The Federal Communication Commission’s Proposed 

Broadband Privacy Rules Would Violate the First Amendment, at 4 (May 27, 2016), http:// 

www.ctia.org/docs/default-source/defaultdocument-library/ctia-ncta-ust-file-tribe-paper.pdf. 

innocuous data and to notify only ten days after discovery of the breach is very different and far more cumbersome. 

The FTC has long supported requirements for companies to notify consumers of 

security breaches in appropriate circumstances, such as when information has been 

compromised that can lead to harms such as financial loss or identity theft. The 

FTC has advocated that ‘‘any trigger for providing notification should be sufficiently 

balanced so that consumers can take steps to protect themselves when their data 

is at risk, while avoiding over-notification, which may confuse consumers or cause 

them to ignore the notices they receive.’’ 

The proposed rules, as currently drafted, would mandate over-notification. As the 

FTC staff notes in its comments on the proposed rules, the FCC should limit its notification requirement to a ‘‘narrower subset of personal information than ‘customer 

proprietary information’ ’’ as the FCC has proposed that term to be defined in order 

to avoid over-notification to consumers. As the FTC staff asserts, ‘‘when consumers 

receive ‘a barrage of notices’ they could ‘become numb to such notices, so that they 

may fail to spot or mitigate the risks being communicated to them.’ ’’ The NPRM 

states that the FCC intends to avoid this outcome, but major changes are required 

to the breach notification provision to achieve this goal. Otherwise, the FCC will 

jeopardize, rather than enhance, data security. 

The proposed rules also contain an unrealistic timeline for customer notification, 

requiring ISPs to notify customers of a breach no later than ten days after the discovery of a breach. The FTC’s Health Breach Notification Rule requires companies 

to notify affected consumers ‘‘without unreasonable delay’’ and within 60 calendar 

days after the breach is discovered. Under the most restrictive time requirements 

among the general state breach notification laws—there is currently a patchwork 

of 47 state laws—an entity is required to provide notice ‘‘as expeditiously as practicable and without unreasonable delay but no later than 30 days after determination of breach, consistent with time necessary to determine scope of the breach, 

identify individuals affected, and restore the reasonable integrity of the system,’’ 

and with a 15-day extension granted for ‘‘good cause shown.’’ The FTC staff comments suggest an outer limit of between 30 and 60 days, which it views as ‘‘adequate for companies while protecting consumers.’’ When finalizing its breach notification rules, the FCC should take these realities into consideration. 

Constitutional Flaws In the FCC’s Proposal 

Fundamentally, the NPRM’s requirements would impose a substantial burden on 

speech because they would preclude ISPs from engaging in important and relatively 

routine communications with their customers. As discussed above, the NPRM would 

impose an opt-in consent requirement for the use or sharing of information, including non-sensitive information, by ISPs and their affiliates to market a broad category of non-communications related services. While this requirement is also the 

wrong policy outcome, it would prevent the type of targeted speech from which consumers benefit, and would prevent speech which will continue to be permitted for 

non-ISPs. 

In order to pass constitutional muster, such a burden on commercial speech must 

satisfy each element of the three-part test set out in Central Hudson Gas & Elec. 

Corp. v. Pub. Serv. Comm’n, 447 U.S. 557 (1980), which asks whether (1) ‘‘the government interest is substantial’’; (2) ‘‘the regulation directly advances the governmental interest asserted’’; and (3) ‘‘it is not more extensive than necessary to serve 

that interest.’’ Harvard Professor Laurence H. Tribe has concluded that the NPRM 

fails on each prong of the Central Hudson test.1

First, in Professor Tribe’s view, the government has not articulated a substantial 

interest in restricting ISPs ability to use customer information already in its possession, particularly where that information is not disclosed to third parties. Second, 

as discussed above, the NPRM completely ignores the fact that, even if the proposed 

highly burdensome rules are imposed on ISPs, myriad edge providers will continue 

to collect and share the same type of consumer information. As Professor Swire 

notes in his testimony, edge providers often collect more consumer information than 

ISPs and the former represent the dominant players in the online advertising market. For this reason, Professor Tribe has concluded that this asymmetry demonstrates that the NPRM cannot be considered to directly advance an important 

governmental interest. And third, Professor Tribe has concluded that the NPRM’s 

proposed opt-in rule is not narrowly tailored because a less obtrusive opt-out rule 

13 

2 Id. 

would serve any legitimate government interest in protecting consumers from firstparty marketing. 

The FCC is already familiar with the Central Hudson constraints on the restrictions the agency may impose pursuant to Section 222 of the Communications Act 

(47 U.S.C. § 222). In U.S. West Communications, Inc. v. FCC, 182 F.3d 1224 (10th 

Cir. 1999), the U.S. Court of Appeals for the 10th Circuit struck down the FCC’s 

attempt at regulations governing Customer Proprietary Network Information 

(‘‘CPNI’’) with respect to voice communications. In that case, the court determined 

that the collection and sharing of CPNI among affiliates constituted speech and that 

the FCC’s opt-in regime did not satisfy intermediate First Amendment scrutiny. As 

Professor Tribe notes, the proposals in the NPRM ‘‘represent a much larger burden 

on speech and are far less tailored to any substantial governmental interest.’’ (emphasis in original) 2 Because the NPRM’s proposed opt-in requirement poses a substantial burden on speech and is not tailored to any substantial governmental interest, it is susceptible to a constitutional challenge. 

Conclusion 

Mr. Chairman, thank you for holding this hearing today. Our Coalition commends 

you and Senator Nelson for devoting the Committee’s attention to this critically important issue. It is through the exercise of your crucial oversight authority that Congress can right the course of agency rulemakings that have veered away from mainstream, practical policy goals. 

In reviewing the record in the FCC’s privacy proceeding, the breadth and depth 

of the objections to the proposed rules are striking. A diverse set of parties, ranging 

from civil rights groups, academics, researchers, security specialists, start-ups, advertisers, ISPs, equipment companies, software providers, IT providers, edge entities, and other Federal agencies all raise important and substantive concerns about 

key features of the FCC’s proposal. Indeed, separate and apart from ISP objections 

to the FCC’s proposal, there is very little support in the record for these rules from 

any entity that is in any way involved in network operations, management or security, or otherwise involved—either as an ISP or an edge provider—in providing services to broadband consumers. The FCC’s proposal is so troubling that a number of 

parties that are clearly outside the scope of the proposed rules (as well as competitors in the marketplace) nonetheless felt compelled to submit comments due to the 

proposal’s potentially disruptive effects on the Internet ecosystem as a whole. I 

think this is something that should give policy-makers—both here and at the FCC— 

pause. And it certainly counsels against rushing ahead to adopt an entirely new set 

of rules that depart so dramatically from the proven and effective FTC framework 

that governed ISPs online activities prior to reclassification. 

As the FCC formalizes its privacy and data security rules, the agency should hold 

ISPs to the same robust privacy standards to which the FTC successfully held them 

for many years—and to which the FTC still holds the rest of the Internet ecosystem. 

A truly consistent approach will ensure a comprehensive, technology-neutral privacy 

framework that provides consumers the strong protections and choices they need 

and deserve, while reducing consumer confusion regarding what protections apply. 

At the same time, a consistent approach will promote the types of competition and 

innovation that fuel our economy. Such an approach will also demonstrate that the 

United States views the FTC approach to privacy as the preeminent model for consumer protection, which will help provide confidence to our trading partners that 

their own consumers will enjoy robust privacy protections under U.S. law. 

As someone who has been involved in more than a handful of rulemakings, it is 

important to point out that final rules are often more balanced than proposed ones. 

But the FCC’s current proposal fails to achieve its own goals. Instead, it would create inconsistent standards across the Internet, harm and confuse consumers, and 

undermine innovation. The NPRM is of questionable constitutionality and does not 

reflect a reasoned approach to consumer privacy. For all these reasons, the 21st 

Century Privacy Coalition’s view is that the FCC should ensure that any rules it 

adopts hew closely to the FTC’s time-tested and proven approach, which is consistent with the Obama Administration’s approach to privacy and data security, and 

abandon its overly prescriptive, asymmetric rules. 

The CHAIRMAN. Thank you, Mr. Leibowitz. 

Mr. Garfield. 

14 

STATEMENT OF DEAN C. GARFIELD, PRESIDENT AND CEO, 

INFORMATION TECHNOLOGY INDUSTRY COUNCIL (ITI) 

Mr. GARFIELD. Good morning. Chairman Thune, Ranking Member Nelson, members of the Committee, on behalf of 60 of the most 

dynamic and innovative companies in the world, we thank you for 

inviting us to present at this hearing. 

This hearing is both timely and important. The companies that 

we represent that are members of ITI reflect the full cross-section 

of the tech sector, from servers to software and service, from social 

media to search. Those companies do not fall within the ambit of 

the FCC’s Open Internet Order and so are not covered by the proposed rules. 

We are not here to choose sides between distinct regulatory agencies. Instead, what we present is our perspective on how to ensure 

that this vibrant ecosystem remains innovative and vibrant. I’ve 

submitted my testimony for the record, so rather than repeat it, I 

would like to hone in on three things: one, our perspective on privacy and cybersecurity; two, our views on the flaws of the FCC’s 

approach; and, third, a path forward. 

I’ve chosen to focus on privacy and cybersecurity first because for 

our companies, they are first principles that are foundational. No 

two issues are more important to building and retaining trust with 

our customers, and we treat them accordingly. Privacy and security, by design, are not catchphrases in the tech sector, they’re 

truly reflective of the commitment we place on privacy and security 

from the design phase to the delivery. 

The commitment of our companies to privacy and security is 

complemented by a rich, robust, well-developed privacy ecosystem 

that works. Jon alluded to much of it. In addition to the work of 

our companies, we have self-regulatory standards. We have the enforcement from the FTC and State attorney generals and, importantly, constant and consistent feedback from our companies that 

help to inform the approach that we take. The problem with the 

FCC’s approach is that it parachutes into this rich, robust, well-developed ecosystem and assumes that it needs to rework all of the 

rules whole cloth. That presumption is faulty. For example, as Jon 

noted, the definition of PII is uniquely broad and bolts onto it a binary and rigid framework that’s likely to prove unworkable. As 

well, around consent and choice, the FCC proposes an opt-in approach and to put its fingers on the thumb of the scale with no evidence that it’s likely to work more effectively for consumers. 

The FCC takes the same approach on cybersecurity, where rather than following the leadership of the experts at NIST, that have 

focused on a risk-based approach that’s grounded in standard global standards, it instead adopts an approach that’s mechanical and 

focused on mandates. The rules, or the proposed rules, around data 

breach are reflective of that. There is little evidence that the approach proposed by the FCC will be more workable, and it’s completely inconsistent with the approach that’s being taken at the 

state level today. 

Our suggestion, or my testimony, should not be read to suggest 

that the FCC does not have a role here. Senator Nelson, the point 

you made resonates. We do not intend to suggest that the FCC’s 

evaluation of these issues and attempt to find resolution of them 

15 

1Protecting the Privacy of Customers of Broadband and Other Telecommunications Services, 

WC Docket No. 16–106, Notice of Proposed Rulemaking, FCC 15–138 (April 1, 2016) 

(‘‘Broadband Privacy NPRM’’). 2For more information on ITI, including a list of its member companies, please visit: http:// 

www.itic.org/about/member-companies.dot. 

is mistaken. What we intend to suggest is that the approach that 

they’ve taken is one that’s inconsistent with best practices and 

what we know works. 

And so what we suggest as a path forward is that the FCC 

should take on board the comments that it’s receiving, revise the 

existing NPRM to one that’s more consistent with the well-established privacy and security framework that exists today, largely 

guided by the FTC and NIST, and then come back with further 

comments so that we end up with something and rules in place 

that will help to advance the innovation ecosystem rather than to 

stymie them. 

I see that I have a few minutes remaining. I would just like to 

really thank the folks who are sitting behind me who are responsible for this testimony. My comments are really an embodiment of 

the thoughts that they’ve helped us to develop. 

Thank you. 

[The prepared statement of Mr. Garfield follows:] 

PREPARED STATEMENT OF DEAN C. GARFIELD, PRESIDENT AND CEO, 

INFORMATION TECHNOLOGY INDUSTRY COUNCIL (ITI) 

Chairman Thune, Ranking Member Nelson, and members of the Committee, 

thank you for the opportunity to testify today. I am Dean Garfield, President and 

CEO of the Information Technology Industry Council (ITI), and I am pleased to testify before your committee today on the important topic of how the Federal Communications Commission’s (FCC or the ‘‘Commission’’) proposed broadband privacy regulations could impact consumers and competition.1

ITI shares the Commission’s interest in, and respects its efforts to, protect the privacy of consumers of broadband Internet access services. Privacy is of paramount 

concern to our member companies, many of whom are providers of information technology and Internet services, because it is at the core of the trust relationship with 

our customers. Though the FCC lacks the authority to regulate our member companies who are the ‘‘edge providers’’ of ‘‘over the top’’ internet-based services referred 

to in its Notice of Proposed Rulemaking (‘‘NPRM’’), we are nonetheless concerned 

with the approach taken by the Commission in a number of respects. We therefore 

welcome your interest and engagement on this subject. 

ITI is the global voice of the tech sector. We are the premier advocate and thought 

leader in the United States and around the world for the information and communications technology (ICT) industry, and this year we are pleased to be commemorating our centennial. ITI represents 61 of the world’s leading ICT companies,2 and 

we advocate globally for policies that advance U.S. leadership in technology, promote innovation, open access to new and emerging markets, protect and enhance 

consumer choice, and foster increased global competition. ITI’s members comprise 

leading technology and innovation companies from all corners of the ICT sector, as 

well as companies using technology to fundamentally evolve their businesses, including wireless and wireline network equipment providers, computer hardware and 

software companies, mobile computing and communications device manufactures, 

Internet and digital service providers, and network security providers. ITI’s member 

companies are also at the forefront of developing next-generation wireless communications equipment, infrastructure, networks, and services, along with the content, 

applications, and new uses that will be enhanced as mobile service evolves and advances. In other words, many of our members are the ‘‘edge providers’’ referred to 

in the FCC’s proposal. 

Privacy is of paramount concern to our member companies. Protecting our customers’ personally identifiable information (PII) and their privacy, along with providing robust security, are essential to earning citizens’ trust in the global technology marketplace. Innovating to protect privacy and security and to strengthen 

consumers’ trust in the global digital infrastructure and Internet services are core 

16 

to our companies’ business practices and philosophies. Privacy is thus critical to our 

members’ success, an essential component of our businesses, and impacts our ability 

to grow and innovate in a future heralding continued advances in the Internet of 

Things, Big Data, and beyond. Consequently, ITI has been a leading voice in advocating effective approaches to privacy, both domestically and globally. 

The Internet has thrived—and privacy has been protected—under the Federal 

Trade Commission’s (FTC) approach to privacy, which is grounded in the Fair Information Practices Principles (‘‘FIPPs’’). This framework applies to all entities under 

the FTC’s jurisdiction who collect and use consumer data. We believe the FCC’s primary objective should be to closely harmonize with the existing FTC framework any 

Internet Services Provider (ISP) or broadband privacy rules it ultimately adopts. 

While the FCC has concluded that the regulation of Broadband Internet Access 

Services (BIAS) providers is uniquely within its purview following the FCC’s decision to reclassify broadband as a Title II service, irrespective of whether that order 

is ultimately upheld in the courts, there is nothing in that decision that necessarily 

warrants a departure from the FTC’s successful approach to privacy based on effective notice to consumers and a meaningful choice as to how their data is used. Unfortunately, the FCC intends to proceed in another direction, proposing a series of 

onerous privacy and data security rules that are out of step with established policy, 

law, and practice in this area. 

I will focus my testimony on four areas: (1) The FCC’s lack of legal authority to 

regulate ITI’s companies, including ‘‘OTT’’ or ‘‘Edge’’ providers; (2) the inconsistency 

of the FCC’s proposed privacy regulations with consumer expectations; (3) the 

broader inconsistency of the FCC’s proposed privacy regulations with existing privacy authorities, frameworks and enforcement regimes, as embodied in the FTC’s 

well-established approach to privacy; and (4) ITI’s concern that the proposed rules 

will establish negative precedents that will ultimately adversely impact consumers, 

businesses, and the global policy ecosystem. 

On this latter point, I will highlight our concerns regarding how several of the 

specific rules proposed by the FCC are out of step with current law and practice, 

including: (1) the unreasonably short and inflexible breach notification periods; (2) 

the overbroad and unnecessary definition of personally identifiable information; (3) 

the overly burdensome consumer choice and consent framework; and (4) the prescriptive, inflexible data security requirements that are misaligned with current industry practice and Federal and state policymaking. 

The FCC Lacks the Authority to Regulate ITI’s Companies 

By and large, ITI’s companies do not offer broadband Internet access service as 

a core part of their businesses, and could not be categorized as such given the definitions for BIAS and BIAS providers in the Open Internet Order and these proposed 

broadband privacy rules. 

Given this, ITI’s companies are not subject to the FCC’s jurisdiction under 

Title II, even after the FCC reclassified broadband Internet access service as a telecommunications service under Title II, nor is there a valid legal argument which 

could subject our companies to Title II regulation under the Open Internet Order 

adopted last year. 

The FCC specifically defines BIAS to mean ‘‘[a] mass-market retail service by wire 

or radio that provides the capability to transmit data to and receive data from all 

or substantially all Internet endpoints, including any capabilities that are incidental 

to and enable the operation of the communications service, but excluding dial-up 

Internet access service. This term also encompasses any service that the Commission finds to be providing a functional equivalent of the service described in the previous sentence, or that is used to evade the protections set forth[.]’’ The FCC defines 

a ‘‘broadband Internet access service provider’’ as a person or entity engaged in the 

provision of broadband Internet access service. Furthermore, the Commission specifically notes over-the-top services and service providers—a category into which 

many ITI member companies fit—are not broadband Internet access service providers and were not captured under the Open Internet Order nor the Broadband 

Privacy Notice of Proposed Rulemaking. In fact, in the Open Internet Order the 

Commission went out of its way to emphasize that while broadband Internet access 

service providers may offer over-the-top services, over-the-top providers of voice over 

Internet protocol, Internet protocol messaging services, and Internet video providers 

are separate and distinct from broadband Internet access providers. 

There are well-founded consumer, business, and economic reasons to rationalize 

why Internet and IT services providers and network operators including broadband 

services providers are treated differently from a regulatory perspective. From a consumer choice standpoint, there are significant differences between OTT services providers or Internet companies and BIAS providers. Consumers have traditionally had 

17 

limited choices when it comes to choosing a BIAS provider for purposes of acquiring 

broadband or Internet service. Indeed, broadband access itself is increasingly considered a fundamental right by many—it is necessary for basic services at all levels 

of government, educational opportunities, workforce opportunities, and numerous 

other basic needs. Once a consumer has a broadband connection, however, consumers can easily choose amongst many different OTT applications and Internet 

service options, including choosing to discontinue one service, switch to another 

service, or subscribe to several comparable services simultaneously. And certainly, 

these types of services are not considered a right; rather, inherent in their multiplicity is the very concept of choice. 

Additionally, there are significant differences between the business and economic 

models of ISPs and edge service providers. Internet companies providing content or 

services to consumers have different economic interests than ISPs. For instance, 

consumers typically pay for broadband services whereas much of the content and 

many of the services provided to consumers over the Internet are ad-supported and 

thus provided to consumers free of charge. This relationship has not changed under 

the reclassification of broadband Internet access service, nor has the legal and regulatory authority governing that relationship. Internet companies’ relationship with 

their customers and the use of their customers’ data has been and remains subject 

to FTC enforcement. 

ITI’s perspective on this matter is solely driven by years of experience in engaging 

with, and helping to develop, the domestic and global privacy policy frameworks we 

operate under today. 

The FCC’s Proposed Data Privacy Rules are Inconsistent with Consumer 

Expectations 

As I described above, ISPs and edge providers are very differently situated from 

the perspectives of consumers both in terms of how their business models are implemented and in terms of the regulatory reach of the FCC. The fact that there are 

fundamental differences between ISPs and Internet companies and those differences 

have historically given rise to different regulatory and enforcement regimes, however, does not give license to creating data privacy rules that are inconsistent with 

consumer expectations. Rather, how the FCC regulates data should be determined 

by what is best for consumers, whether consumers are suffering identifiable and 

quantifiable harms, and whether gaps exist in the current regulatory and enforcement regime. 

Additionally, sound privacy policy for one entity in the Internet ecosystem should 

be sound policy for all others. The FCC has not made the case to justify the type 

of expansive and prescriptive regulatory regime contemplated by the NPRM—a significant departure from the current FIPPs-based approach undertaken by the FTC. 

Fundamentally, if the FCC seeks to ensure the goals articulated in the NPRM of 

protecting consumer privacy, it must carefully weigh consumer interests and expectations. Unfortunately, the proposed regulations contain no indication that consumer interests—in particular whether they are suffering any harm under the current regulatory approach—demand expansive new regulations in this area. Consumers have embraced today’s thriving internet, fueled by responsible data practices 

governed by the existing regulatory framework, and they have come to expect a 

seamless online experience across multiple devices that delivers convenience while 

also protecting their privacy. The current online ecosystem subsidizes online offerings that consumers value, promotes innovation, and grows the economy. There is 

simply no record of consumer harm supportive of the FCC’s proposal for such restrictive regulations. In other words, the FCC’s proposal should embrace a more 

measured approach. Consumer expectations have also not been factored into the 

FCC’s analysis. Indeed, as Commissioner O’Reilly points out in his dissent, ‘‘there 

is no need for the Notice to describe consumer expectations because it is irrelevant 

to the FCC’s analysis.’’ 

The FCC’s Proposed Data Privacy Rules are Inconsistent with Existing 

Privacy Frameworks and Enforcement Regimes 

We believe what would most benefit consumers is an approach that is consistent 

with existing privacy frameworks grounded in the FIPPs and consistent with existing privacy enforcement regimes. Consumers and industry benefit when one agency 

takes the lead on privacy regulation and enforcement because regulatory consistency 

permits continued innovation without bias among sectors. The FTC has a long history of addressing and enforcing privacy-related issues across industries. Indeed, the 

FTC has shown much leadership over the years as the enforcer on digital ecosystem 

issues, for both technical and legal reasons, and it remains well-situated to provide 

such leadership into the future. 

18 

Specifically, existing voluntary self-regulatory standards supported by FTC enforcement are the appropriate tool to govern the dynamic and interrelated online 

content and advertising ecosystem. Currently, online data collection and use are 

governed by robust industry self-regulatory regimes that subject the industry to the 

jurisdiction of the FTC and state attorneys general. These regimes are regularly updated to reflect new business models, which reflect the responsible data practices 

so essential for the continued success of the Internet economy. Enforceable, voluntary, self-regulatory codes remain best suited to promote consumer privacy protections while allowing these legitimate data practices to flourish. 

Further, the FTC’s enforcement authority provides effective legal safeguards for 

online data practices. In addition to industry self-regulation, the FTC robustly enforces consumer privacy and data security standards using its authority to address 

‘‘unfair or deceptive acts or practices’’ under Section 5 of the FTC Act. The FTC has 

used this authority to enforce company commitments to customers, to comply with 

industry self-regulatory requirements, and to protect consumers from harmful practices. State attorneys general typically follow FTC positions to actively enforce similar laws at the state level. These legal frameworks already provide consistent, 

meaningful consumer protections which can apply across industries, including to the 

practices the FCC now seeks to regulate. There is no need to create a new framework such as that proposed by the FCC because the FTC has well-established principles in this area. 

Nonetheless, if the FCC is ultimately found to possess the requisite authority to 

regulate broadband privacy and follows through on its intent to do so, it should 

make certain that any such efforts are consistent with existing robust privacy 

frameworks and enforcement authorities, particularly those of the FTC. One way to 

ensure this sort of consistency is for the FCC to work closely with the FTC to harmonize its privacy rules for broadband ISP consumers with the framework that protects consumers of those online businesses or services falling under the jurisdiction 

of the FTC. In addition, the FCC and FTC should work closely together to help the 

communities within their purview—broadband ISPs and businesses providing service over the internet, respectively—to clearly understand the applicable rules to enable good faith compliance. 

The FCC’s Privacy Proposal is Out of Step with Current Law and Practice, 

and would Establish Precedents that Will Negatively Impact 

Consumers, Companies, and the Internet Ecosystem 

Rather than adopt a regime aligned with the FTC’s well-established approach to 

privacy, the privacy regime proposed by the FCC in the NPRM departs from the 

FTC framework in significant and material respects. We are particularly concerned 

that the prescriptiveness of the proposed regulatory approach could have precedential effects that would negatively impact the rest of the Internet ecosystem, including the tech sector. While it is hard to say for certain what the implications on other 

sectors will be if the FCC moves forward with the NPRM and adopts standards that 

diverge from those the FTC has already established for customer information, we 

believe the existence of multiple sets of privacy rules will, at a minimum, send a 

troubling message to governments and businesses internationally. Additionally, I’d 

like to point out four specific components of the FCC’s proposal that are out of step 

with currently established policy and practice and raise significant concerns for both 

consumers and businesses. 

The Breach Notification Periods are Unreasonably Short and Inflexible. The FCC 

proposes extremely short data breach notification periods in the NPRM—entities 

suffering a breach would be required to provide notice within seven days to the 

Commission, FBI, and Secret Service, and within 10 days to customers (NPRM ¶ 75), 

without regard to whether the breach creates a significant risk of customer harm. 

Such notices would need to be provided regardless of whether a breach is malicious 

or inadvertent, which is an element in determining whether a risk of harm exists 

(NPRM ¶ 75). 

First, the FCC’s data breach proposal fails to include a risk analysis, and therefore will contribute to notice fatigue at best or incite unnecessary panic at worst. 

Additionally, the proposal fails to account for breaches of data that are rendered not 

actionable through technology, such as encryption, or for inadvertent but innocent 

breaches, such as an employee accidentally opening the wrong file. Notifying individuals that their information has been compromised is an important step that enables them to take protective measures. Notification to consumers, however, is not 

productive if all data breaches result in notifications. If over-notification becomes 

commonplace, consumers will have difficulty distinguishing between notices and determining which ones warrant them to take action. Notification should be made to 

consumers if an organization has determined there is a significant risk of identity 

19 

theft or financial harm. Upon receipt of such a notice, consumers can then implement measures to help avoid being financially damaged. 

Second, the proposal does not afford organizations adequate time to remediate any 

discovered vulnerabilities or to conduct thorough investigations to ascertain the nature and scope of any breach before notifying customers or government agencies of 

a breach of data. Unless vulnerabilities are addressed prior to making the breach 

incidents public, organizations and their customers are susceptible to further harm 

by wrongdoers. Because the NPRM does not afford organizations adequate time to 

investigate the scope and nature of breach incidents, the NPRM not only encourages 

over-notification by organizations, but it creates a standard of notification that 

would be counterproductive should the alleged breach prove a false alarm or if the 

breach does not create a significant risk of identity theft. A tremendous amount of 

forensics, decision-making, and clerical and legal work is required before 

ascertaining the nature and scope of a breach, assessing the risk of harm, or in determining the appropriate form of notification based on the organization’s relationship with the effected customer. 

More fundamentally, the FCC proposes to regulate breach notification in a way 

that is contrary to the existing state notification regimes and the proposals under 

consideration by Congress. Recognizing the sophistication of today’s hackers and the 

challenging nature of a post-data breach forensic investigation, a breach notification 

regime must provide realistic, flexible, and workable time requirements. ITI has 

long advocated for Congress to establish a uniform but flexible approach to data 

breach notification that notifies customers where there is a significant risk of identity theft or other financial harm. Such a uniform approach not only eases compliance burdens for businesses, but it reduces or eliminates confusion for consumers. 

The Proposed PII Definition is Overbroad and Unnecessary. The FCC proposes to 

define PII as ‘‘any information that is ‘‘linked or linkable to an individual.’’ (NPRM 

¶ 60). This is an overly broad definition that subsumes the entirety of the Customer 

Proprietary Network Information (‘‘CPNI’’) category that the FCC proposes to expand elsewhere in the NPRM. As a result, both the proposed PII and CPNI definitions expansively include data elements that have never before been considered PII 

under U.S. law, such as Internet protocol addresses or other unique identifiers necessary for the functioning of connected Internet devices, application usage data, persistent online identifiers (cookies), and Internet browsing history—data that is highly unlikely to contribute to a risk of concrete harm such as identity theft. (NPRM 

¶¶ 62–63). 

First, it is unclear why the Commission endeavors to define PII at all, rather than 

just focusing on the CPNI data clearly within its statutory ambit. Further, the Commission acknowledges that BIAS providers may not actually collect all of the categories of information included within the proposed expansive definitions, yet the 

FCC proposes to regulate the collection of such data anyway. The potential unintended consequences of these overly and unnecessarily broad definitions are quite 

concerning, particularly since many of the types of data captured by the proposed 

definitions are integral to providing Internet services to consumers, including securing Internet transactions. 

Exhibiting some awareness of the potential unintended consequences that could 

flow from such a broad PII definition, the FCC proposes a number of exceptions to 

the definition of PII. For example, the NPRM exempts from the definition of PII 

data collected by entities ‘‘to protect themselves or others from cybersecurity threats 

or vulnerabilities.’’ (NPRM ¶ 117). We are concerned this exception may not be nearly broad enough to adequately help protect the Internet ecosystem. To illustrate, the 

definition suggests that companies would only be allowed to collect such information 

to counteract specific threats. This belies the reality that some of this information, 

such as unique IDs, must be collected and shared by companies as part of their 

cybersecurity risk management programs in order to prevent cybersecurity intrusions from happening. Indeed, the trajectory of Federal policymaking in this area 

over the past several years has been to encourage both continuous monitoring by 

organizations and the sharing of cybersecurity threat information to counteract 

cyber threats. The approach here is illustrative of the overall flawed approach to, 

and treatment of, PII in the FCC’s proposal. 

The Proposed Consumer Choice and Consent Framework is Overly Burdensome 

and Restrictive. The consent standard proposed by the FCC is both overly burdensome and restrictive. Generally, the FCC has proposed to restrict most collection, 

use, and disclosures of data with an ‘‘opt-in’’ consent standard, which it acknowledges may cause ‘‘notice fatigue’’ for consumers (NPRM ¶ 141). The Commission further acknowledges the ‘‘burden of [their] proposed customer choice framework’’ on 

businesses, particularly on smaller entities (NPRM ¶ 151). The proposed choice 

framework is also out of step with current policy and practice. 

20 

Experience shows that an opt-out or implied consent standard is an effective 

mechanism to effectuate consumer privacy preferences with respect to non-sensitive 

online data while allowing legitimate practices, including advertising, to continue. 

We urge the FCC to follow the FTC approach of permitting an opt-out approach for 

use of consumer data in most instances, with an opt-in approach reserved for uses 

of the most sensitive consumer data. 

The Proposed Data Security Requirements are Prescriptive, Inflexible, and Misaligned with Both Industry Approaches and Federal Cybersecurity Policies. In the 

NPRM, the FCC proposes both general data security requirements for BIAS providers and ‘‘specific types of practices they must engage in to comply with the overarching requirement.’’ (NPRM ¶ 167). 

While the Commission acknowledges any proposed security requirements must 

‘‘allow for flexibility for practices to evolve as technology advances,’’ and claims it 

does not propose ‘‘to specify technical measures for implementing the data security 

requirements,’’ (NPRM ¶ 176), it nonetheless proposes a series of increasingly prescriptive security requirements. For example, the Commission proposes to not only 

require regular Graham-Leach-Bliley-like risk assessments (NPRM ¶ 180) at a frequency to-be-determined (NPRM ¶ 183), but it also asks whether the FCC should 

prescribe specific risk-management requirements on BIAS providers, and how the 

risk assessments themselves should be conducted. (NPRM ¶ 182) These proposed requirements contradict existing cybersecurity public policy—such as that embedded 

in the Framework for Improving Critical Infrastructure Cybersecurity 

(‘‘Cybersecurity Framework’’)—that risk management is a continuous process demanding flexibility in order to provide reasonable protections in light of the nature 

and scope of the activities of a given company, including the sensitivity of the data 

it handles, its threat profile, and the size and complexity of the relevant data operations of the company. Another example can be found in the series of proposed specific authentication measures the Commission proposes to prescribe (NPRM ¶¶ 191– 

200). 

Indeed, the structure of the entire security section appears contrary to many of 

the core concepts of risk management (e.g., voluntariness, flexibility, etc.) as 

throughout the NPRM the Commission asks a series of ‘‘should we require this’’ and 

‘‘should we require that’’ questions. This is a fundamentally flawed approach, out 

of step with the approach embodied in the Cybersecurity Framework and the consensus standards and best practices included within. We agree with Commissioner 

O’Reilly’s dissenting statement that the proposed prescriptive security rules are inconsistent with the voluntary approach embodied in the Framework and are indeed 

‘‘alarming.’’ 

Conclusion 

Members of the Committee, ITI and our member companies are pleased you are 

examining the important issue of how the FCC’s proposed broadband privacy regulations may impact consumers and competition. We share both the FCC’s and your 

interest in protecting the privacy of consumers of broadband Internet access services. As noted above, however, we are concerned with the approach taken by the 

Commission in a number of respects. We have raised our concerns directly with the 

Commission by submitting comments on the NPRM, urging the agency to reconsider 

promulgating data privacy rules that are inconsistent with consumer expectations 

or existing privacy authorities, frameworks and enforcement regimes, such as embodied by the FTC’s longstanding approach to privacy. We appreciate the opportunity to reiterate these concerns today, including our belief that the privacy regime 

proposed by the FCC is out of step with current law and practice and would establish precedents that will negatively impact not only consumers but companies and 

the Internet ecosystem as a whole. Please consider ITI a resource on these important issues moving forward, and do not hesitate to contact us with any questions 

regarding this submission. 

Thank you for the opportunity to appear before you today. 

The CHAIRMAN. Thank you, Mr. Garfield. 

Professor Ohm. 

STATEMENT OF PAUL OHM, PROFESSOR, GEORGETOWN 

UNIVERSITY LAW CENTER AND FACULTY DIRECTOR, 

GEORGETOWN CENTER ON PRIVACY AND TECHNOLOGY 

Mr. OHM. Chairman Thune, Ranking Member Nelson, and distinguished members of the Committee, it’s really my privilege to be 

21 

here today to discuss a very important topic with you. The basic 

principle at stake is a very old one. The Postal Service cannot track 

the letters you send or open your letters in order to sell that information to marketers. Without your consent, your telephone company cannot track the phone numbers you dial or listen in on your 

conversations in order to sell that information to advertisers. We 

should have the same rule for ISPs, and without your consent, they 

should not be able to sell your reading habits and your physical location to advertisers. 

So to help protect this very old basic principle, the FCC has proposed the rule we are discussing today. I want to say three things 

about the rule. I believe it is unambiguously authorized by law, it 

is a wise rule, and it is a measured rule. Let me take those in turn. 

Now that the D.C. Circuit has ruled that reclassification of 

broadband service into Title II was within the power of the FCC, 

it’s incumbent on the FCC to elaborate what this means for 

broadband providers, including rules for customer privacy. And nobody in the debate disputes that Congress enacted Section 222 of 

the Telecommunications Act to obligate telecommunications providers, such as telephone companies, to respect the privacy of their 

customers. It makes a straightforward reading of the statute to extend this obligation to ISPs as well. Because this is a straightforward reading, the burden should be on those who would rewrite 

the statute, or even worse, ask the FCC to disregard it, rather than 

the agency that’s merely trying to apply it. 

Number two, and I want to spend the most of the time on this, 

Why is the law wise? Congress’s act reflects the well-reasoned conclusion that telecommunications providers owe a heightened level 

of privacy to their customers. I’ve already explained the historical 

antecedent for this with our Postal Service and our telephone companies. Three other factors support this conclusion: visibility, 

choice, and sensitivity. 

Visibility. Your ISP sits at a privileged place in the network. 

They are the bottleneck between you and the Internet. You cannot 

access the Internet but by sending information through this bottleneck, and with this privileged location, they can be a part of every 

website or online destination that you visit. For unencrypted 

websites, this visibility is unparalleled, comprehensive, and complete, but even for websites that use encryption, the ISP’s view is 

only partially obscured, they can see the domain names of the 

websites you visit, how often you return to these websites, how 

much information you exchange with these websites. It is a very, 

very complete and privileged location. 

Number two, choice. Most Americans today, as you well know, do 

not have a meaningful choice when it comes to fixed broadband 

service. The situation is specifically and especially difficult in rural 

America, and I’m glad, Chairman Thune, you raised rural America, 

where only 13 percent of residents have more than one choice for 

high-speed fixed broadband. And even for those Americans who do 

happen to have more than one choice, switching costs make it quite 

difficult to switch their ISP. 

Finally, sensitivity. With the visibility providers have and given 

the lack of your choice for exit, your provider can compile a detailed list of what you read, with whom you communicate, what 

22 

you say, and, increasingly, where you go. And because storage is 

cheap, ISPs can record all of this vital sensitive information about 

you across years and eventually across decades. Privacy scholars 

have long tried to properly come up with a metaphor to characterize what we should think about a data base like this about every 

person in this room. Some have referred to them as digital dossiers. 

Others have talked about the right to intellectual privacy we ought 

to enjoy. My contribution to the metaphor debate has been to describe the database of ruin, the idea that there is now a corporate 

database in the celestial cloud that contains at least one fact about 

every member of our society that you would not want your worst 

enemy to know. 

These four factors together—history, choice, visibility, and sensitivity—led Congress in 1996 to do what it had done several times 

before. Simply put, in the American privacy law system, when we 

identify a sector or a context that has unique privacy risks like we 

have in telecommunications, we create a sectoral privacy law. We 

did this for health information in HIPAA, we did this for education 

information in FERPA, and, indeed, we did this in Section 222 of 

the Telecommunications Act. 

Finally, why do I believe that the FCC proposal is measured? 

Number one, the FCC proposal does not propose a ban. You might 

be excused from misunderstanding that based on some of the heated rhetoric that has come from critics of the proposal. You are not 

prohibited from any conduct under this rule. This is simply a disagreement about the type of user consent we ought to require before your ISP can look over your shoulder and record everything 

you do in order to sell it to advertisers. The FCC decided to require 

prior, informed, expressed consent before they could undertake this 

type of activity. I think this is the only sensible choice. And I’m 

happy to talk with you more about why during Q&A. 

Last, the proposal preserves the necessary conditions for competition by treating all providers alike. When Google operates as a 

broadband provider, as it now does in Kansas City through Google 

Fiber, they are required to follow the strictures of Section 222. 

When Verizon acquires American Online in order to bolster its advertising business, as it did last year, they are no longer regulated 

for that activity under Section 222. The playing fields are level. 

In closing, we do not have many privacy laws in this country. 

Section 222 is one of the few. And given the powerlessness your 

constituents feel and all Americans feel about this state of affairs, 

we ought to be bolstering and supplementing our privacy law, not 

cutting back on one of the very few that we have on the books. 

Thank you again for your invitation. 

[The prepared statement of Mr. Ohm follows:] 

PREPARED STATEMENT OF PAUL OHM, PROFESSOR, GEORGETOWN UNIVERSITY LAW

CENTER AND FACULTY DIRECTOR, GEORGETOWN CENTER ON PRIVACY AND

TECHNOLOGY

Chairman Thune, Ranking Member Nelson, and Members of the Committee, I appreciate the opportunity to discuss with you the Federal Communications Commission’s (FCC) proposal to protect the privacy of the customers of broadband Internet 

access service (BIAS). 

I am a Professor at the Georgetown University Law Center and a Faculty Director 

of the Center on Privacy and Technology at Georgetown. I specialize in information 

23 

1This testimony builds on several articles I have written on information privacy, most notably 

on Paul Ohm, The Rise and Fall of Invasive ISP Surveillance, 2009 U. ILL. L. REV. 1417 (2009). 

A full list of my published works is available online at http://paulohm.com/scholarship.shtml. 

I have recently filed two public documents commenting on the FCC’s NPRM. See Statement 

of Paul Ohm Before the Subcommittee on Communications and Technology, Committee on Energy and Commerce, U.S. House of Representatives (June 14, 2016), available at http:// 

paulohm.com/projects/testimony/PaulOhm20140614FCCPrivacyRules.pdf and Reply Comments 

of Paul Ohm Before the Federal Communications Commission in the Matter of Protecting the 

Privacy of Customers of Broadband and Other Telecommunications Services, WC Docket No. 16– 

106 (June 22, 2016), available at https://www.fcc.gov/ecfs/filing/10622254783425. 

privacy, computer crime law, and technology and the law. I make these comments 

to you in my independent, academic capacity. 

In 1996, Congress enacted section 222 of the Telecommunications Act of 1996, delegating to the FCC the power to promulgate rules to protect the information held 

by telephone companies and other telecommunications providers covered by Title II 

of the Act. Under this clear statutory authority, the FCC has proposed new rules 

requiring BIAS providers to respect and protect the privacy of their customers, in 

the wake of the agency’s decision to reclassify these providers into Title II, a reclassification recently found to be a proper exercise of the FCC’s power by a panel of 

the Court of Appeals for the D.C. Circuit. 

The FCC has acted appropriately and wisely. The application of section 222 to 

BIAS providers represents not only a straightforward implementation of the law but 

also a laudable exercise of privacy theory and policy. I support these conclusions not 

only through my academic work 1 and the work of other scholars, but also by 

leveraging the experience I have gained as a former Senior Policy Advisor to the 

Federal Trade Commission (FTC) on privacy issues, Department of Justice computer 

crimes prosecutor, and professional network systems administrator. 

In this testimony, I make four points: 

• Section 1: The Telecommunications Act of 1996 obligates telecommunications 

providers to serve as important gatekeepers of privacy, a sensible choice then 

and now, one that continues to protect important values in today’s online environment. 

• Section 2: The proposed FCC rules will decrease overall consumer confusion by 

creating a clear, bright line of privacy protection. 

• Section 3: Rather than ban any behavior, the proposed rules will create and preserve opportunities for innovation and competition. Importantly, BIAS providers 

will retain the ability to compete directly with edge providers subject to the 

same privacy rules as any other company. 

• Section 4: There remains a significant need to strengthen privacy rules for online actors other than BIAS providers. The Federal Trade Commission (FTC) 

does not have all of the authority or resources required to solve all online privacy problems. 

1 The Statute Treats BIAS Providers as the Gatekeepers of Individual 

Privacy 

Our Federal laws protect privacy on a sector-by-sector basis and in piecemeal. The 

FTC Act provides an essential backstop across many industries, but there are limits 

to its approach, as I will discuss later. In narrowly circumscribed contexts, Congress 

has seen fit to create heightened privacy obligations. HIPAA protects the privacy of 

some health information, FERPA does the same for some education records, and the 

Fair Credit Reporting Act protects some credit reports, to name only three examples. In the same way, Congress reaffirmed in the Telecommunications Act of 1996 

(1996 Act) that certain telecommunications providers would be subject to heightened 

privacy obligations. This was a measured and appropriate choice at the time, and 

it remains even more so today, even in light of reclassification. 

There are four reasons why it is essential to provide heightened protection for the 

privacy of information gathered by the companies that serve as our gatekeepers to 

the rest of the Internet: history, choice, visibility, and sensitivity. Each of these reasons contributes an answer to the question: why was Congress correct to require 

communications gatekeepers to respect the privacy of their customers? Let me 

elaborate each of these reasons in turn. 

1.1 History 

The first reason to subject BIAS providers to special privacy rules is history. Since 

the dawn of intermediated communications, we have almost always required our 

common carriers to respect the privacy of what they have carried. It was so for the 

postal service in the nineteenth century, the telephone service early in the twentieth 

24 

2FCC 2016 Broadband Progress Report, 31 FCC Rcd 699 (‘‘Approximately 51 percent of Americans have one option for a provider of 25 Mbps/3 Mbps fixed broadband service.’’). 3 Upturn, What ISPs Can See: Clarifying the Technical Landscape of the Broadband Privacy 

Debate, March 2016, https://www.teamupturn.com/reports/2016/what-isps-can-see (reporting 

that more than 85 percent of popular sites in health, news, and shopping categories do not 

encrypt browsing by default). 

century, and parcel delivery services in more recent years. Time, experience, and 

theory demonstrate why we must enact laws to create the conditions that allow people to have faith in the privacy, security, and confidentiality of the information and 

goods they entrust to intermediaries like these. 

Congress enacted privacy protections in the original Communications Act of 1934 

and restated and perhaps even broadened those protections in the 1996 Act. We are 

not working from a legal blank slate. Too much of the commentary around the FCC 

rules ignores the—perhaps inconvenient for some—fact that Congress has spoken 

quite clearly on this matter. The law protects what it protects, and the burden 

should be on those who would rewrite the statute, not on the agency that implements it. 

1.2 Choice 

It is also appropriate for Congress to protect the privacy of information sent 

through a BIAS provider because of the relative lack of choice consumers enjoy for 

BIAS services. Today, most people in the United States have only a single 

broadband Internet service provider to choose from.2 Even when there is a nominal 

choice, high switching costs in the form of time, effort, hassle, and contractual lockin make it difficult for a privacy-sensitive consumer to change providers in search 

of a more privacy-respecting alternative. 

1.3 Visibility 

Every BIAS provider sits at a privileged place in the network, the bottleneck between the customer and the rest of the Internet. This favorable position gives it a 

unique vantage point, from which it enjoys the ability to see at least part of every 

single packet sent to and received from the rest of the Internet. 

No other entity on the Internet possesses the same ability to see. If you are a habitual user of the Google search engine, Google can watch you while you search, and 

it can follow you on the first step you take away from the search engine. After that, 

it loses sight of you, unless you happen to visit other websites or use apps or services that share information with Google. If you are a habitual Amazon shopper, 

Amazon can watch you browse and purchase products, but it loses sight of you as 

soon as you shop with a competitor. Habitual Facebook users are watched by the 

company when they visit Facebook or use websites, apps or services that share information with Facebook, but they are not visible to Facebook at any other times. 

When users interact with websites or use apps or devices that do not support 

encryption or do not enable it by default, a BIAS provider’s ability to spy is complete 

and comprehensive. While it is true that BIAS providers can view less about its 

users’ visits to websites that deploy encryption, it is a regrettable fact that millions 

of websites, including many of the most popular ones, still do not enable encryption 

by default.3

Even for user visits to websites that deploy encryption, a BIAS provider retains 

a significant ability to observe. When you visit a website protected by the most 

widespread form of encryption in use, https or http over TLS, even though your 

BIAS provider cannot tell which individual page you are visiting on the website, it 

still can tell the domain name of the website you are communicating with, how often 

you return, roughly how much data you send and receive, and for how long each 

visit lasts. 

Compare the richness of this information to the information a telephone company 

can see, which although subjected to the heightened protection of section 222, is relatively limited by comparison. In the 1996 Act, Congress decided to impose significant limits on what telephone companies could do with the list of numbers an individual customer dials. This made good sense because even though this list did not 

literally expose the contents of communications, it nevertheless testified to something very private, individual, and important about our habits and associations. The 

list of websites visited by an individual (including how often and how long she visits 

each site) is even more private, individual, and sensitive than those older lists of 

telephone contacts. 

25 

4See Paul Ohm, Sensitive Information, 88 S. CAL. L. REV. 1125 (2015) (providing a detailed 

review of the use in privacy laws of the concept of sensitive information). 5 NEIL RICHARDS, INTELLECTUAL PRIVACY: RETHINKING CIVIL LIBERTIES IN THE DIGITAL AGE

(2015). 6 E.g., Comments of the United States Telecom Association, WC Docket No. 16–106 at 4; Comments of Mobile Future, WC Docket No. 16–106 at 6. These commenters uniformly rely on statistics cited in a report by a team of attorneys from Georgia Tech and Alston & Bird, Peter 

Swire, et al., Online Privacy and ISPs at 3 (May 2016) [hereinafter Broadband for America Report]. 7Pew Research, Chapter One: A Portrait of Smartphone Ownership, U.S. SMARTPHONE USE

IN 2015, April 1, 2015, http://www.pewinternet.org/2015/04/01/chapter-one-a-portrait-of-smart 

phone-ownership/. 

1.4 Sensitivity 

Perhaps the most important reason to protect the information a BIAS provider 

can obtain is the intrinsic sensitivity of this information.4 A BIAS provider can gather at least three types of information we have long deemed sensitive: communications, reading habits, and location. 

Our laws have long recognized the sensitivity of our communications. Under the 

Fourth Amendment, almost nothing receives the heightened protection for privacy 

given to the content of our conversations. Federal and state statutes vigorously protect both the content of and the metadata associated with communications. We reveal intimate portraits of ourselves through what we say to our friends, family, and 

associates. A BIAS provider can readily access the content and metadata of communications, particularly sent across unencrypted services. 

A BIAS provider can also build a fairly complete dossier of our reading habits 

across time. The list of websites an individual visits, available to a BIAS provider 

even when https encryption is used, reveals so much more than a member of a prior 

generation would have revealed in a composite list of every book she had checked 

out, every newspaper and magazine she had subscribed to, every theater she had 

visited, every television channel she had clicked to, and every bulletin, leaflet, and 

handout she had read. Nobody has been able until now to watch us read individual 

articles, calculate how long we linger on a given page, and reconstruct the entire 

intellectual history of what we read and watch on a minute-by-minute, individualby-individual basis. 

Professor Neil Richards describes the right we should enjoy to ‘‘intellectual privacy.’’ 5 He argues that the law ought to protect vigorously the record of what we 

read and write. His writing supplies a powerful and well-reasoned justification for 

treating BIAS providers precisely as the 1996 Act does. 

Finally, with the rise of mobile broadband, BIAS providers now also track our location across time in a finely granular manner. Never before has anybody compiled 

such a complete accounting of the precise comings-and-goings of so many of us. 

So much of us can be revealed to a company that compiles a finely wrought accounting of where we have traveled, what we have read, with whom we have engaged, and what we have said. BIAS providers might respond that they want this 

information only to reduce us into marketing categories to sell and resell. I derive 

no comfort from that justification. 

1.5 Privacy for All 

The four reasons for holding BIAS providers to high privacy standards—history, 

choice, visibility, and sensitivity—each implicate the same, difficult question: will 

privacy be enjoyed by every American, regardless of wealth or station in life, or only 

by America’s privileged few? For each of these factors, the need for meaningful privacy protections for broadband customers is even stronger from the perspective of 

mainstream and marginalized Americans. 

For example, when it comes to visibility, some have argued that we need not 

worry about the privacy threat to a given consumer from any single ISP because 

the average American owns 6.1 devices and accesses the Internet using at least 

three different networks: one each for home, mobile, and work.6 These arguments 

ignore the lived reality for the many Americans who rely on only a single 

smartphone with a single connection as their lifeline to the Internet, and as a group 

tend to be less wealthy, younger, and disproportionately members of minority 

groups than the general population.7 Also, the average American worker does not 

have access to a Virtual Private Network (VPN) provided by an employer, the way 

some white collar workers do, and so is left looking for clunkier, costlier alternative 

technologies if she wants to shield her online activities from her provider. 

The problem of insufficient choice, the next factor, is particularly stark for rural 

Americans, many of whom have only a single available provider to access the network. While 44 percent of Americans in urban areas have more than one available 

26 

8FCC 2016 Broadband Progress Report, 31 FCC Rcd 699, ¶ 86 (2016). 9Two noted privacy experts, Aleecia McDonald and Lorrie Faith Cranor (currently Chief Technologist of the Federal Trade Commission), estimate that it would take the average person 244 

hours per year to read the privacy policies of all sites and apps they used. Aleecia M. McDonald 

and Lorrie Faith Cranor, The Cost of Reading Privacy Policies, 4 I/S: J L & Pol Info Soc’y 540, 

560 & table 7 (2008), available at https://lorrie.cranor.org/pubs/readingPolicyCost-author 

Draft.pdf. 10 Reply Comments of Paul Ohm Before the Federal Communications Commission in the Matter of Protecting the Privacy of Customers of Broadband and Other Telecommunications Services, WC Docket No. 16–106 (June 22, 2016), available at https://www.fcc.gov/ecfs/filing/ 

10622254783425. 

provider offering 25 Mbps/3Mbps fixed broadband, only 13 percent of Americans in 

rural areas can say the same.8 Protecting only information deemed ‘‘sensitive’’ tends 

to underprotect Internet users with idiosyncratic or non-majoritarian sensitivities, 

such as members of minority religions, racial or ethic groups, or marginalized political viewpoints. Finally, history suggests that we protect the privacy of the telephone system (and the mail system before it) as a reflection of how important these 

networks are for average Americans seeking basic access to employment, social 

interaction, and benefits, which is even more true today for the Internet. This argument weighs much more heavily for those without stable employment or social support than for those who enjoy greater stability, wealth, and political power. 

We should reject arguments that would set information policy based only on the 

conditions of urban and wealthier Internet users who have relatively more (but still 

very little) service choice, more devices, more connections, better access to privacy 

tools, and whose sensitivities conform to society’s default standards. Privacy should 

be available to all. 

2 The FCC’s Proposed Rule Will Decrease Consumer Confusion 

The FCC has proposed a simple, bright-line rule for the privacy of information 

transiting a BIAS provider’s network: a BIAS provider may not use its customer’s 

private information for purposes unrelated to the provision of service unless and 

until the informed consumer consents to those uses. The burden of communicating 

the purported benefits of uses of information rests on the party best positioned to 

make that case, the BIAS provider itself. This approach mirrors the approach the 

law takes in other sectors where the information at stake is especially sensitive or 

private, including healthcare, banking, and education. 

Contrast the straightforward nature of this proposal with the ‘‘notice-and-choice’’ 

background rules that apply to otherwise unregulated online actors. Notice-andchoice regimes rest on the fiction that Internet users read and understand the hundreds of Terms of Service and Privacy Policy documents with which they are presented online each year.9 Each one of these lawyer-drafted and densely-worded documents sets idiosyncratic ground rules for acceptable provider behavior for a single 

site or service alone. Even when companies break their own ground rules, they cannot be held to account unless the FTC or a state Attorney General notices, pursues, 

and proves the deception or unfairness. 

This crazy cacophony is somehow the ideal framework that BIAS providers urge 

the FCC to embrace, in the dubious name of reducing consumer confusion. The 

FCC’s proposed default rule is much simpler and comprehensible: no unexpected 

uses of your information. A BIAS provider can diverge from the default, but only 

if it explains to you in clear, non-deceptive terms what it intends to do and receives 

your informed, express consent. To argue that this will increase rather than decrease consumer confusion not only defies good sense but also fails to give the consumer his or her due respect. 

3 By Allowing Data Uses with Consent, the FCC’s Proposed Rule Benefits 

Consumers Without Unduly Burdening Providers or Competition 

In section 222, Congress made clear that covered providers could continue to use 

any information they could access ‘‘with the approval of the customer.’’ Faithfully 

applying this provision, the FCC proposes to allow any uses of information after 

prior customer consent. Neither Congress nor the FCC has enacted or even proposed 

a ban on uses of information, although you might think otherwise based on the 

characterizations of many of the covered providers. 

Put plainly, this debate is not about prohibiting conduct. Stripped of this confusion, this is simply a disagreement about the type of user consent we ought to require for conduct that at least some consumers find objectionable. In my reply comment to the FCC, I pointed out that the difference between the proposed opt-in rule 

and an alternative opt-out rule is not nearly as stark a difference as some have stated.10 Recent research suggests that companies in other industries subjected to optVerDate Nov 24 2008 10:44 Feb 21, 2017 Jkt 075679 PO 00000 Frm 00030 Fmt 6633 Sfmt 6621 S:\GPO\DOCS\24204.TXT JACKIE
27 

11 Id. citing Lauren E. Willis, When Nudges Fail: Slippery Defaults, 80 U. CHI. L. REV. 1155 

(2013). 12Peter Swire, et al., Online Privacy and ISPs (May 2016). 

in requirements have managed to convince large numbers of users to choose to opt 

in.11 I do not doubt that BIAS providers will try to replicate these results. 

The new rules also preserve other level playing fields to facilitate unburdened 

competition. BIAS providers like Verizon or Comcast can acquire (and have acquired) edge provider services such as content publishers, search engines, and social 

networking sites. A BIAS provider that launches or acquires a search engine will 

be able to use the information it takes from its search engine customers in the relatively unrestricted manner the law currently provides for that industry. Likewise, 

if a traditional edge provider like Google creates or acquires a broadband Internet 

service, such as the Google Fiber service, it will fall for those purposes within 

Title II of the Communications Act and thus be subject to the FCC’s privacy rules. 

In either case, any two companies competing in the same market will be subjected 

to precisely the same rules under precisely the same terms. 

4 The Need to Enhance Privacy in Other Contexts 

Of course, the FCC’s new privacy rule will not solve all of the privacy problems 

we face. We need to raise our privacy standards across other parts of the online ecosystem as well. We ought to increase the resources we provide to the FTC and enhance its power to police deceptive and unfair privacy practices. We also ought also 

to consider imposing new and more stringent rules for industry segments striving 

to develop the kind of pan-Internet view that BIAS providers structurally enjoy or 

that handle vast amounts of sensitive information, as BIAS providers do. 

4.1 The FTC Cannot Go It Alone 

It was my privilege to serve the FTC as a Senior Policy Advisor on privacy issues 

from 2012 to 2013. I was convinced during my service and continue to feel today 

that the FTC has become an important bulwark of privacy in a tumultuous time 

of change. We should view the FTC as the irreducible floor of online privacy protection, and we should do what we can to give the FTC additional resources to raise 

that floor. 

But the FTC simply cannot go it alone. The rise of the FTC as a capable and wellrespected privacy regulator does not mean we should dismantle sectoral privacy regulation. The FTC’s jurisdiction and enforcement activity cannot supplant the Department of Health and Human Service’s role under HIPAA, the Department of 

Education’s role under FERPA, or the Consumer Financial Protection Bureau’s role 

under numerous financial privacy laws. Likewise, the fact that the FTC has been 

very active and successful policing privacy online does not mean we should discourage the FCC from protecting privacy under Section 222 using its distinctive approaches and capabilities. 

For all of the amazing strides the FTC has taken to become an expert in online 

data collection, the FCC has had a much longer time to develop expertise in the protection of network access subscribers. With this head start, the FCC has unparalleled experience ensuring that the Nation’s communications networks function in a 

way that is reliable and trustworthy and crafting regulations that promote the 

buildout of networks. Nobody has more experience and staff expertise on these matters than the FCC. 

Moreover, the FCC’s clear statutory mandate in Section 222 is specific and 

proactive, in contrast to the FTC’s mandate in Section 5 of the FTC Act, which is 

far more general and reactive. Fortunately, these two mandates work together, as 

nothing in the proposed FCC rule will subject any company to conflicting FTC rules 

and vice versa. It is to the credit of the staff of these two agencies that they have 

entered into a Memorandum of Understanding committing to work together in their 

common privacy endeavors. 

4.2 The Need to Strengthen Other Privacy Laws 

As I have argued above, it is a combination of history, choice, visibility, and sensitivity that justifies subjecting BIAS providers to the same kind of special privacy 

rules we have enacted for doctors, schools, credit agencies, and other industries. A 

sectoral approach to privacy law continues to be a desirable approach. 

It is true that other online entities are beginning to rival BIAS providers on at 

least some of these critical dimensions.12 Other entities traffic in location information, a category Congress ought to consider protecting as especially sensitive. Social 

networking sites carry exceptionally sensitive information and exhibit network effects and insufficient data portability that limit customer choice and exit. Finally, 

28 

advertising networks strive to attain a BIAS-provider-like visibility across the Internet. 

Congress should examine whether any other industry segment has implicated individual privacy along these dimensions so much that they have begun to rival doctors, schools, credit agencies, or BIAS providers. But once it identifies such an example, the answer will not be to decrease privacy law across industries, the answer 

will be to enact another new, measured and narrow sectoral privacy law, perhaps 

one modeled on the FCC’s rules. 

5 Conclusion 

Given the deep concern many of your constituents feel about their lack of control 

of information about them; given the calls and e-mails you no doubt receive after 

every significant data breach or other privacy debacle; given the survey after survey 

which bear witness to the breadth and depth of concern American citizens have 

about this state of affairs; and given the critical importance of an Internet we can 

trust for commerce, communications, and innovation, this is not the time to roll 

back one of the very few privacy protections we have for online activity. We should 

be strengthening not weakening the privacy of online activity. All American Internet 

users owe owe our thanks to Congress and the Federal Communications Commission for taking modest, sensible, and legally authorized steps toward enhancing the 

protection we enjoy. 

The CHAIRMAN. Thank you, Professor Ohm. 

Mr. Polka. 

STATEMENT OF MATTHEW M. POLKA, PRESIDENT AND CEO, 

AMERICAN CABLE ASSOCIATION 

Mr. POLKA. Thank you, Chairman Thune, Ranking Member Nelson, and members of the Committee, for inviting me to testify 

about the Federal Communications Commission’s proposed privacy 

regulations and their effect on consumers and competition. Today 

I would like to focus on four essential points. 

First, American Cable Association members are already subject 

to a host of privacy and data security obligations, take those obligations seriously, and have an excellent track record of compliance. 

We, too, are consumers and so understand the need for privacy protections. 

Second, to best serve the interests of broadband consumers, the 

FCC should adopt a privacy and data security regime that is consistent with the FTC’s framework. It has proven valuable and 

workable for all interests. 

Third, we fear that the FCC’s proposed privacy and data security 

rules would impose needless, unduly burdensome obligations on 

smaller broadband providers, chilling investment and innovation, 

all with little consumer benefit. 

And fourth, should the FCC nonetheless proceed and adopt rules 

in line with its proposals, it should ease the burden on small 

broadband providers by providing tailored exemptions, extending 

compliance deadlines, and streamlining its rules. 

The American Cable Association represents 750 smaller cable operators, incumbent telephone companies, municipal utilities, competitors, and other local providers which offer service in all 50 

States. Eighty percent of our members serve fewer than 5,000 customers. Fifty percent serve fewer than 1,000. Most have 10 or 

fewer employees and cannot afford to dedicate employees solely to 

regulatory compliance. 

As I said at the outset, ACA members must comply, and have 

complied, with numerous privacy and data security obligations, 

several of which were the work of this committee. These two longVerDate Nov 24 2008 10:44 Feb 21, 2017 Jkt 075679 PO 00000 Frm 00032 Fmt 6633 Sfmt 6601 S:\GPO\DOCS\24204.TXT JACKIE
29 

standing provisions include the Communications Act, Section 631, 

for cable services enacted in 1984, and Section 222, the Consumer 

Proprietary Network Information rules, also known as CPNI, for 

voice and now broadband services, enacted in 1996. These also include Section 5 of the Federal Trade Commission Act for non-common carrier services and the laws of the states where providers operate. Complying with all of these requirements imposes a significant burden on smaller providers, but ACA members understand 

their duty and their legal obligations to protect the confidentiality 

of their customers’ information. 

Because ACA members are subject to so many time-tested privacy and security obligations, they had hoped that the FCC, in 

crafting CPNI regulations to cover broadband, would have proposed 

a regime consistent with requirements already on the books. In 

fact, ACA joined with other industry organizations last year to 

present to the FCC a privacy framework that would promote the 

goals of transparency, choice, data security, while retaining consistency with the FTC’s framework. 

Our privacy proposal would protect consumers and equally regulate all participants in the Internet ecosystem. It would also enable 

smaller providers to comply without undue burdens. Unfortunately, 

the FCC insisted on blazing an entirely new path by proposing 

novel, complex, and overly burdensome requirements. In comments 

filed recently with the FCC, the Small Business Administration’s 

Office of Advocacy said that smaller providers will be subject to onerous obligations. 

In our view, these obligations would chill investment and innovation while providing uncertain consumer benefits. Even more importantly, these rules would apply only to broadband providers, a 

mere subset of players in the Internet ecosystem. This would lead 

to customer confusion as well as distort the market through asymmetric regulation. The FCC should revise its approach, reassess the 

costs and benefits of its proposal, and seek to blend it with the 

FTC’s approach. 

In closing, ACA members have spent decades protecting their 

customers’ privacy and data security. As the FCC moves to craft 

new rules for broadband, we seek to bring to bear our experience 

and the previous efforts of this committee and other government 

bodies to build a sound and lasting regulatory regime. And we 

promise to continue our efforts to develop a solution that works for 

all. 

Thank you. 

[The prepared statement of Mr. Polka follows:] 

PREPARED STATEMENT OF MATTHEW M. POLKA, PRESIDENT AND CEO, 

AMERICAN CABLE ASSOCIATION

Thank you, Chairman Thune, Ranking Member Nelson, and Members of the Committee, for inviting me to testify on behalf of the American Cable Association (ACA) 

and its members about the steps we are taking to protect the privacy and security 

of our customers’ personal information and our thoughts on the Federal Communications Commission’s (FCC’s or Commission’s) proposed privacy and data security 

rules for broadband Internet access service (broadband service). 

In my testimony, I will focus on four points. First, ACA members are already subject to a host of privacy and data security obligations, take those obligations seriously, and have an excellent track record of compliance. Because they too are consumers, ACA members understand consumers’ expectations and the need for privacy 

30 

1 Cable operators have been subject to Section 631 for over 30 years. Section 631 includes a 

robust set of requirements, including annual subscriber notices, a customer consent framework, 

access rights, and a private right of action. 2Section 222 and its implementing rules are designed to protect the confidentiality of individually identifiable CPNI, a narrow category of information that includes information about a customer’s use of the network (e.g., call detail records) and information contained within customer 

bills. The CPNI rules include a three-tiered notice and consent regime, data security safeguards, 

a breach notification rule, and annual certifications. Beginning in 2014, the FCC began to read 

Section 222 more broadly to protect ‘‘customer proprietary information,’’ a category of information that according to the FCC includes both CPNI as well as all personally identifiable information. ACA and others have challenged the Commission’s broad interpretation of the statute as 

unlawful. 3 Every state has a law prohibiting deceptive practices, and most have laws prohibiting unfair 

practices, similar to the FTC’s Section 5 prohibition. See, e.g., Conn. Gen. Stat. § 42–110b(a); Fla. 

Stat. Ann. § 501.204; Mass. Gen. Laws Ch. 93A, § 2(a); S.D. Codified Laws § 37–24–6(1). Further, 

47 states have enacted data breach notification laws. See, e.g., Conn. Gen Stat. § 36a-701b; Fla. 

Stat. §§ 501.171, 282.0041, 282.318(4)(j)(1); Mass. Gen. Laws § 93H–1 et seq. Moreover, several 

states have enacted additional privacy and data security requirements. See, e.g., Fla. Stat. 

§ 501.171; 201 CMR 17.00. For example, Massachusetts requires companies to ‘‘develop, impleprotections. Second, to best serve the interests of broadband consumers, the FCC 

should adopt a privacy and data security framework that is consistent with the Federal Trade Commission’s (FTC’s) approach, which has proven valuable and workable 

for all interests. Third and most unfortunately, we fear that the FCC’s proposed privacy and data security rules would impose needless, unduly burdensome obligations 

on smaller broadband providers, chilling investment and innovation, all with little 

consumer benefit. And finally, if the FCC nonetheless proceeds and adopts rules in 

line with its proposals, it should ease the burdens on small providers by providing 

tailored exemptions, extending compliance deadlines, and streamlining its rules. 

I. Background on ACA’s Members 

ACA represents approximately 750 small and medium-sized cable operators, incumbent telephone companies, municipal utilities, and other local providers, which 

provide service in all fifty states. ACA members provide a variety of services to their 

residential and business customers, including voice, cable service, broadband, and 

various non-common-carrier services, such as home security, PC support, e-mail, 

and data center services. Eighty percent of ACA members serve fewer than 5,000 

subscribers, and roughly fifty percent serve fewer than 1,000 subscribers. Half of 

ACA’s members have ten or fewer employees, with typically just one or two engineers or individuals with technical expertise, and these employees perform many 

duties within their companies. Few have in-house personnel dedicated to privacy 

and data security compliance. Yet, they take all necessary steps to comply with today’s regulatory mandates, even though it is a challenge and cuts into their ability 

to upgrade systems and to offer new products and services. 

Consequently, ACA urges Congress and the Commission to continue to seek to 

balance actions that would impose new obligations with the resource capabilities of 

smaller providers. Skewing that balance against broadband providers—as the Commission proposes to do—imperils investments in high performance networks and information services so critical for consumers and our economy. 

II. ACA Members Are Already Subject to A Host of Privacy and Data 

Security Rules, Take Those Obligations Seriously, and Have 

an Excellent Track Record of Compliance 

ACA members must comply and have complied with numerous privacy and data 

security obligations, several of which were the work of this Committee. ACA members that provide cable service must comply with Section 631 of the Cable Communications Policy Act of 1984 (the Cable Act).1 ACA members that provide voice services—whether traditional circuit-switched voice or interconnected voice over Internet 

Protocol (VoIP)—must comply with Section 222 of the Communications Act of 1934, 

and its implementing rules related to customer proprietary network information 

(CPNI).2 ACA members that provide broadband service must comply with the FCC’s 

transparency rule (which requires disclosure of privacy policies), and since the 2015 

Open Internet Order, the FCC has asserted that they must comply with Section 222 

(notwithstanding ongoing challenges to the agency’s authority to do so). ACA members that provide non-common-carrier information services, a term which until recently applied to broadband service, must also comply with Section 5 of the Federal 

Trade Commission Act, which prohibits ‘‘unfair or deceptive acts or practices,’’ including those related to privacy and data security. Further, our members are subject 

to the laws and rules of the states in which they operate, including but not limited 

to data breach notification laws.3 In addition, to the extent that they interact with 

31 

ment, and maintain a comprehensive information security program that is written in one or 

more readily accessible parts and contains administrative, technical, and physical safeguards,’’ 

with granular requirements that every such information security program must include. See 201 

CMR 17.00. 

institutions handling sensitive information such as banks, hospitals, and schools, 

they often must assume obligations—by statute, rule, or contract—to protect such 

information. 

Complying with all of these privacy and data security laws is a significant burden 

for smaller providers, but they understand their responsibilities and have taken the 

necessary steps to ensure they comply. ACA members notify their subscribers of 

their privacy practices through welcome packages, annual notifications, and website 

privacy policies. Our members also provide opportunities for customers to make 

choices about how service providers use or share their information and give all the 

necessary information to make an informed choice. They also understand the importance of effective personnel training, as well as the need to ensure that agents and 

independent contractors—e.g., billing and customer service companies—protect the 

confidentiality of customer information. 

ACA members employ reasonable physical, technical, and administrative data security practices to protect against breaches of customer information. For example, 

ACA members have established robust authentication requirements, such as password protection for access to customer information or, for small-town providers, requiring customers to authenticate themselves in person with proper identification. 

In addition, our members are responsible in their duties to comply with the recordkeeping and reporting obligations of the FCC’s existing privacy and data security 

rules, including obligations to keep records of customer approval status and marketing campaigns, as well as annual certification obligations. We have been active 

in the FCC’s Communications Security, Reliability and Interoperability Council 

Working Group IV proceeding, which is intended to assist companies with implementing voluntary cybersecurity measures for the communications sector that respect the unique challenges that small and medium-sized providers face. 

The privacy and data security actions described above and others that smaller 

providers undertake do not exist in a vacuum—they are just one part of an increasingly complex web of legal and regulatory obligations with which providers must 

comply, including law enforcement, disabilities access, copyright, emergency alert 

service, universal service, and open Internet obligations, as well as a variety of state 

and local regulations. 

ACA members have an excellent track record in protecting the confidentiality of 

their customers’ information and complying with privacy and data security laws and 

rules. Indeed, in the decade during which the FTC exercised its authority over 

broadband providers—conducting innumerable investigations and actions against 

companies related to privacy and data security—we are not aware of a single action 

against a smaller broadband provider for the sorts of privacy and data security practices that the FCC seeks to regulate pursuant to its proposals. Such a long run free 

of major incidents reinforces the view that a new and more intrusive privacy and 

data security regime is not needed to protect consumers. 

III. To Best Serve the Interests of Broadband Consumers, the FCC Should 

Adopt a Privacy and Data Security Framework That Is Consistent With 

the FTC’s Approach, Which Has Proven Valuable and Workable for All 

Interests 

Until the FCC classified broadband service as a Title II telecommunications service in the 2015 Open Internet Order, all industry participants in the Internet ecosystem were subject to the jurisdiction of the FTC. The FTC’s approach combines 

a flexible statutory provision—Section 5 of the FTC Act—with heightened obligations for limited categories of sensitive information (e.g., children’s information, 

health information, or financial information). As such, the FTC’s approach has at 

its core the concepts of flexibility, context specificity, and technological neutrality. 

This framework has enabled the Internet ecosystem to flourish to the benefit of consumers, edge providers, and broadband providers alike. Further, by avoiding hyperprescriptive rules and focusing instead on the reasonableness of providers’ practices 

and the truthfulness and completeness of their representations to their customers, 

the FTC’s framework lessens the compliance burdens on smaller providers. 

In contrast, the FCC proposes to cleave the Internet ecosystem in two by subjecting one set of participants—broadband providers—to a different and more burdensome privacy and data security regime, while another set—including edge providers—remain subject to the FTC’s approach. The FCC is proposing these rules despite the fact that the large edge providers can know more about a user’s activity 

32 

and, unlike broadband providers, often employ business models that depend on the 

collection, use, and sharing of their customers’ personal information. For smaller 

broadband providers, which lack scale, such business models are rarely in our members’ strategic plans. 

In advance of the FCC issuing its proposals, ACA and several trade associations 

proposed a framework that would protect consumers and promote the FCC’s goals 

of transparency, choice, and data security while retaining consistency with the 

FTC’s framework. Such an approach would protect consumers and avoid entitybased regulation that would create consumer confusion and stifle innovation. Consumers expect their data will be subject to consistent privacy standards based upon 

the sensitivity of the information and how it is used, regardless of which entity in 

the Internet ecosystem uses that data. Indeed, FTC staff has stated that ‘‘any privacy framework [for broadband providers, operating systems, browsers, and social 

media] should be technology neutral,’’ and has argued that the FCC’s failure to propose a consistent privacy regime is ‘‘not optimal.’’ 

We recommended that to maintain consistency with the FTC’s framework, the 

FCC should adopt rules based on the following principles: 

• Transparency. A broadband (telecommunications service) provider should provide notice, which is neither deceptive nor unfair, describing the CPNI that it 

collects, how it will use the CPNI, and whether and for what purposes it may 

share CPNI with third parties. 

• Respect for Context and Consumer Choice. A broadband provider may use or disclose CPNI as is consistent with the context in which the customer provides, 

or the provider obtains, the information, provided that the provider’s actions are 

not unfair or deceptive. For example, the use or disclosure of CPNI for the following commonly accepted data practices would not warrant a choice mechanism, either because customer consent can be inferred or because public policy 

considerations make choice unnecessary: product and service fulfillment, fraud 

prevention, compliance with law, responses to government requests, network 

management, first-party marketing, and affiliate sharing where the affiliate relationship is reasonably clear to consumers. Consistent with the flexible choice 

mechanisms available to all other entities in the Internet ecosystem, broadband 

providers should give consumers easy-to-understand choices for non-contextual 

uses and disclosures of their CPNI, where the failure to provide choice would 

be deceptive or unfair. The provider should consider the sensitivity of the data 

and the context in which it was collected when determining the appropriate 

choice mechanism. 

• Data Security. A broadband provider should establish, implement, and maintain 

a CPNI data security program that is neither unfair nor deceptive and includes 

reasonable physical, technical, and administrative security safeguards to protect 

CPNI from unauthorized access, use, and disclosure. Providers’ CPNI data security programs should provide reasonable protections in light of the nature and 

scope of the activities of the company, the sensitivity of the data, and the size 

and complexity of the relevant data operations of the company. 

• Data Breach Notifications. A broadband provider should notify customers whose 

CPNI has been breached when failure to notify would be unfair or deceptive. 

Given that breach investigations frequently are ongoing at the time providers 

offer notice to customers, a notice that turns out to be incomplete or inaccurate 

is not deceptive, as long as the provider corrects any material inaccuracies within a reasonable period of time of discovering them. Broadband providers have 

flexibility to determine how and when to provide such notice. 

Our proposal would meet consumers’ privacy needs while allowing them to take 

advantage of products and services they expect from their service provider and 

would avoid inconsistent and burdensome oversight. Moreover, it would ensure a 

level playing field between edge providers and broadband providers, promoting an 

innovative and competitive broadband ecosystem. 

Our proposal also would improve the ability of smaller providers to comply without incurring undue costs or other burdens. As I explained earlier, smaller providers 

work to ensure that they use customer information consistent with their customers’ 

expectations. Since these providers are already familiar with the FTC framework, 

they would not have to incur material additional costs to bring their policies, processes, and systems into compliance if the FCC adopts rules consistent with this 

framework. 

Our proposal also is superior because the consumer choice provisions align with 

consumer expectations by respecting the context of customer-carrier interactions. 

33 

This will enable small providers to offer new and innovative services to their customers, increasing consumer choice and competition. 

The data security rule in our proposal also contains a robust general security 

standard that requires ‘‘physical, technical, and administrative’’ security safeguards 

while including the size of the company as a factor in determining whether particular safeguards are reasonable. As such, in the event that smaller providers grow, 

the rules will require more sophisticated processes commensurate with their larger 

operations. Additionally, our framework enables the FCC to establish best practices 

through multi-stakeholder processes. 

Finally, our proposed data breach notification rule is superior to the FCC’s proposed rule because it provides flexible deadlines that will not overburden small providers and a safety valve for good faith disclosures so that small providers can avoid 

counterproductive strict liability enforcement actions associated with inflexible and 

overly prescriptive regimes. 

IV. The FCC’s Proposals Would Needlessly Impose Unduly Burdensome and 

Costly Restrictions on Small Providers, Chilling Investment and 

Innovation With Minimal Additional Consumer Benefit 

The FCC proposes a set of privacy and data security rules that, if adopted, would 

be one of the most complex in the United States. Let me highlight just some of the 

new notice, customer approval, data security, and data breach notification obligations the FCC proposes to impose on smaller broadband providers. 

• Proposed Notification Rules. The proposed notification rules would prescribe, in 

minute detail, when, where, how, and how often providers must notify their 

subscribers about their privacy and data security practices, which would require 

smaller providers incur legal costs to draft and update privacy notices, administrative costs to deliver the notices, and technical costs to post the notices ‘‘persistently’’ on the provider’s website, mobile app, and any functional equivalent. 

• Proposed Customer Approval Rules. The proposed customer approval rules 

would replace the long-standing, context-specific, and consumer-friendly opt-out 

regime of the FTC with an incredibly complex and restrictive three-tiered 

framework that would erect unnecessary barriers to collecting, using, or sharing 

customer information by requiring opt-in consent in many situations that are 

well within consumer expectations. 

• Proposed Data Security Rules. The proposed data security rules would replace 

the FTC’s reasonable security standard with a general strict liability rule requiring providers to ‘‘ensure’’ the confidentiality, security, and integrity of customer information, irrespective of the sensitivity of that information and ignoring the fact that most agencies recognize that there is no such thing as perfect 

security. The proposed data security rules also would impose exacting operational requirements on broadband providers, such as: requiring regular risk 

management assessments; appointing ‘‘senior officials’’ to oversee providers’ privacy and data security practices; implementing third party oversight mechanisms; and conducting training for personnel, agents, and affiliates. 

• Proposed Data Breach Notification Rules. The proposed data breach notification 

rules would impose a strict, seven-day turnaround time from discovery of the 

breach to notify the FCC and law enforcement about any data breach, and a 

ten-day turnaround for notifying affected customers, regardless of whether the 

breach was intentional or whether consumer harm is reasonably likely. The result of this proposed breach notification rule will be over-notification, often including incomplete or evolving facts, which will confuse consumers, breed unnecessary distrust in the Internet ecosystem, and work to undermine the ‘‘virtuous circle’’ of demand for Internet services, deployment of broadband infrastructure, and innovation. 

Unlike the existing CPNI rules, the proposed rules would not be limited to ‘‘customer proprietary network information’’—the narrow set of information that Section 

222 was drafted to address—but rather would apply to all ‘‘customer proprietary information,’’ a broad, amorphous term that appears nowhere in the Communications 

Act and covers everything from the make and model of a user’s modem to an individual’s public demographic information. Further, unlike the existing CPNI rules, 

the proposed rules would apply to all past, present, and prospective customers of 

a broadband provider. The FCC even seeks comment on whether to expand the definition of customer to include minors, members of a group plan, or other individual 

users who can access a shared account. By extending the universe of covered information and individuals, smaller providers will need to manage significantly more 

information, dramatically increasing the costs and burdens of compliance. 

34 

To meet all of these new, extensive obligations, smaller broadband providers 

would need at least to: 

• Develop and implement new data security controls, website policies, and customer approval tracking systems; 

• Hire and train dedicated privacy and data security staff; 

• Provide additional customer notices, including data breach notifications that 

would increase customer confusion and ‘‘notice fatigue’’; 

• Retain attorneys and consultants for such activities as regulatory analysis, contract negotiation, risk management assessments, and preparing required policies, forms, training, and audits; 

• Ensure compliance for call centers, billing software, and others that interface 

with customer proprietary information; and 

• Divert scarce resources from innovation and infrastructure deployment to regulatory compliance. 

These new costs would be most burdensome for smaller providers, decreasing 

their ability to innovate, upgrade systems, and compete while increasing costs, confusion, and inconvenience for their customers. Indeed, the Office of Advocacy for the 

Small Business Administration (SBA) told the FCC that its ‘‘proposed rules will be 

disproportionately and significantly burdensome for small Broadband Internet Access Service (BIAS) providers,’’ arguing that ‘‘the FCC failed to comply with the 

[Regulatory Flexibility Act’s] requirement to quantify or describe the economic impact that its proposed regulations might have on small entities,’’ and ‘‘[t]he FCC has 

provided no estimate of the paperwork hours required to comply with the regulations.’’ 

V. If the FCC Adopts Its Proposed Rules, It Should Take Steps to Ease the 

Burden on Smaller Providers Through Exemptions to the More 

Onerous Elements of the Rules, Extensions of the Applicable 

Compliance Deadlines, and Streamlined Regulations 

If the FCC rejects our proposal in favor of its prescriptive, ex ante privacy and 

data security framework, it should, consistent with similar privacy regimes: 

• Exempt smaller providers from prescriptive specific data security requirements 

(while maintaining a flexible general data security standard) and add ‘‘the size 

of the BIAS provider’’ to the factors that the FCC must consider when assessing 

the reasonableness of a BIAS provider’s security program; 

• Exempt smaller providers from the more onerous elements of its customer approval framework by grandfathering existing customer consents and exempting 

smaller providers from the requirement to obtain additional approval where 

they do not share sensitive personal information with third parties for marketing purposes; 

• Exempt smaller providers from several elements of the FCC’s proposed data 

breach notification rule (as applied to voice and broadband services) by exempting smaller providers from the specific notification deadlines in favor of an ‘‘as 

soon as reasonably practicable’’ standard; and 

• Exempt smaller providers from any customer dashboard requirements that it 

adopts pursuant to its notice and choice regulations. 

These exemptions address and reduce the burdens that the proposed privacy rules 

would have on smaller providers, and align with the SBA Advocacy Office’s request 

that the FCC adopt ‘‘exemptions for small BIAS providers wherever practicable.’’ 

The FCC also should extend the deadlines for smaller providers to comply with 

any new privacy and data security rules by at least one year beyond any general 

compliance deadline (i.e., the date at which larger providers must comply with the 

rules). The FCC should commit to initiate a subsequent rulemaking together with 

or immediately after any order that results from this proceeding to determine 

whether to further extend the deadline and/or establish additional exemptions, and 

should further commit to rule on whether to extend the deadline or establish additional exemptions prior to the expiration of the general compliance deadline. The 

FCC often has extended effective dates for small entities in the context of its consumer protection regulations, including: (1) a three-year waiver for certain analogonly cable systems to comply with the emergency information rule; (2) a two-year 

delay to comply with the User Guide Requirements of the FCC’s accessibility rules; 

(3) a one-year extension of the compliance deadline for the FCC’s open Internet enhanced transparency rule, which it subsequently extended for another year; and (4) 

a six-month extension to implement requirements of the 2007 CPNI Order. 

35 

Moreover, the FCC should rationalize and streamline its proposed rules to ensure 

that they are not too burdensome for smaller broadband providers by: 

• Developing, with industry and other stakeholders, standardized notices with 

safe harbor protection that small providers can use to reduce enforcement risks, 

as well as the need to pay for outside counsel, consultants, and developers; 

• Streamlining its proposed customer approval requirements to better align with 

consumer expectations and avoid disrupting existing customer relationships; 

• Adopting a general data security standard and working with industry to establish and update best practices rather than imposing prescriptive data security 

rules; 

• Tailoring any data breach notification requirements to ease burdens on 

broadband providers, including by adopting flexible deadlines for breach notification, limiting notifications to situations where consumer harm is reasonably 

likely, creating a one-stop-shop for breach reporting, and preempting state 

breach notification laws; and 

• Harmonizing its rules within Section 222, but not across statutory provisions 

including Section 631 of the Cable Act, which would undermine consumer expectations and would upend providers’ existing compliance regimes. 

While a suite of extensions, exemptions, and rationalized rules would not be as 

effective as adopting rules consistent with the FTC framework, it would address the 

concerns of smaller providers and many others in the record—including the SBA— 

that the FCC’s proposed rules go too far without adequately considering the burdens 

of its proposals on smaller providers. 

ACA members have a strong record of protecting consumer data and complying 

with myriad state and Federal privacy and data security laws. Based on this experience, we urge the Commission to adopt the time-tested privacy framework employed 

by the FTC. It has proven valuable for consumers and imposes important but reasonable obligations on smaller broadband providers. We look forward to working 

with the Committee and the Commission as this process moves forward. 

The CHAIRMAN. Thank you, Mr. Polka. 

Next up is Professor Swire. And I apologize, I mispronounced 

your name—— 

Mr. SWIRE. It’s happened before. 

[Laughter.] 

The CHAIRMAN.—during my introduction. That was from me not 

wearing these (referencing glasses). But, Professor Swire, please 

proceed. 

STATEMENT OF PETER SWIRE, HUANG PROFESSOR OF LAW 

AND ETHICS, SCHELLER COLLEGE OF BUSINESS, GEORGIA 

INSTITUTE OF TECHNOLOGY 

Mr. SWIRE. Thank you, Chairman Thune, and Ranking Member 

Nelson and members of the Committee. And thank you for the opportunity to testify today on the FCC’s proposed privacy rule. As 

you said, my name is Peter Swire, not Swine. I teach at George 

Tech. 

Today I’m testifying about a major research project that my coauthors and I issued this year called ‘‘Online Privacy and ISPs.’’ 

It’s 125 pages. It has pretty color illustrations. We tried to set out 

the facts for how this stuff works. Before our report came out, 

many of those supporting stronger privacy rules signed a letter 

stating that ISPs, ‘‘have a comprehensive view of consumer behavior,’’ and they said, ‘‘that ISPs have a unique view in the online 

ecosystem because they connect the users to the Internet.’’ 

And our report documented two factual findings. First, ISP visibility into consumer online information is far from comprehensive 

36 

and will likely continue to decline, and the biggest reason is the 

huge growth in encryption. 

Second, ISPs appear to lack unique insights into users’ Internet 

activity. The biggest reason is that the data the ISPs see is generally not as detailed and insightful as that available to others in 

the Internet ecosystem. These two conclusions are surprising to 

many people on first encounter for understandable reasons based 

in history, but the facts have changed over time and will continue 

to do so. 

My own work here began when the FCC invited me to testify 

over a year ago at their workshop on broadband consumer privacy. 

That day, the debates were about comprehensive and unique access, and I believe getting more facts would be useful. 

I’ll say just a word about my own role in this discussion. During 

2009 and 2010, I worked in the White House on the National Economic Council. As part of that job, I signed what is sometimes 

called the ‘‘Obama Pledge,’’ I will not engage in any lobbying of 

Federal officials while President Obama is in office. As a consequence, all of my writing about this privacy rulemaking has been 

factual, and I do not and have not advocated for any policy outcome. 

As a related point, I know why I think our research has been 

helpful to those with different views about the policy issues here. 

For those who believe the proposed rule is too strict, and we heard 

several people today already, our research has corrected important 

misperceptions that policymakers might have had, and now we can 

decide based on current facts rather than previous impressions. 

And for those who support the FCC’s proposed rules, such as Professor Ohm, I believe our research has also been useful. Before the 

working paper, much of the advocacy for the rule was based on factual claims that have not stood up to scrutiny, especially the claim 

that ISPs, because of their place in the ecosystem, see everything 

about a user’s activity. Without the working paper, supporters of 

the rule faced a real risk the rule would be based on inaccurate 

facts, thus exposing the rule to risk of reversal in judicial review. 

And I believe the factual record now before the Commission is more 

nuanced and complete than it would have been. 

So turning to these facts and the issue of whether there is comprehensive access, the most cited findings in our working paper 

concern the recent and rapid and historic rise in encrypted communications for the typical user. Just two years ago, in 2014, in February, 13 percent of the bits going through the U.S. backbone were 

encrypted. By this January, that number had soared to 49 percent, 

half the bits, and we expect it to be 70 percent by the end of this 

year. 

And with the shift to HTTPS, which is the secure protocol, there 

are two main effects. First of all, the content gets encrypted. This 

is again for a majority of bits now today. And for years, the biggest 

privacy concern about ISPs is what was called ‘‘deep-packet inspection,’’ and that was because ISPs technically can go deep into the 

packet to see the full content and not just the header. For 

encrypted communications, deep-packet inspection doesn’t work 

anymore, it’s encrypted, they can’t get in. 

37 

1Peter Swire, Justin Hemmings, and Alana Kirkland, Online Privacy and ISPs: ISP Access 

to Consumer Data is Limited and Often Less than Access by Others (Feb. 29, 2016) available 

at http://www.iisp.gatech.edu/working-paper-online-privacy-and-isps. 

2https://www.fcc.gov/ecfs/filing/107062066122504/document/10706206612250467ca. 

Second, blocking of detailed URLs. HTTPS also blocks ISP access 

to the detailed URLs. With encryption, the ISP sees something like 

‘‘www.example.com,’’ but along with blocking content, encryption 

blocks all the details, such as ‘‘www.example.com/sensitivemedical 

condition.’’ So a lot of the details get blocked, and that applies 

broadly to our e-mails now and social networks and web search. 

The other topic is to discuss briefly whether ISPs have unique 

data, maybe because they’re the bottleneck, as Professor Ohm mentioned, and whether they have unique insights. My written remarks discuss five categories of data: domain names, location information, IP addresses, subscriber information, and NetFlow or 

IPFIX information. 

Sticking with domain names as the example, ISPs can see the 

general domains, such as ‘‘example.com,’’ but so can a lot of others, 

and that’s sort of the point here. The user’s operating systems see 

it, the user’s browser, the app that he or she is using, the advertising network, all the people with cookies in the system. Advertisers also have third parties who sell profiles based on where people surf. And so the point when it comes to domain names is that 

compared to other Internet actors, ISPs access only the domain 

names, that’s third best, not as good as the content or the detailed 

URLs that others see. 

So in conclusion, at a factual level, there are greater limits in 

ISP visibility than most people had assumed, and I had assumed 

when I began the research, and the FCC should base its conclusions on the ecosystem we have today and going forward rather 

than a simplified view of what ISPs used to be able to see. 

My thanks to the Committee for the opportunity to speak here, 

and I look forward to your questions. 

[The prepared statement of Mr. Swire follows:] 

PREPARED STATEMENT OF PETER SWIRE, HUANG PROFESSOR OF LAW AND ETHICS, SCHELLER COLLEGE OF BUSINESS, GEORGIA INSTITUTE OF TECHNOLOGY

Chairman Thune, Ranking Member Nelson, and Members of the Committee, 

thank you for the opportunity to testify today on ‘‘How Will the FCC’s Proposed Privacy Regulations Affect Consumers and Competition?’’ I am Peter Swire, the Huang 

Professor of Law and Ethics at the Scheller College of Business at Georgia Tech. 

I have worked intensively on privacy and cybersecurity issues in government, academia, and practice for over twenty years. A biography is attached to the end of this 

testimony. 

In February of this year, my co-authors and I issued the 125-page Working Paper 

called ‘‘Online Privacy and ISPs: ISP Access to Information is Limited and Often 

Less Than That of Others.’’ 1 My testimony today, based on reply comments filed 

this week with the FCC,2 focuses on two principle factual findings arising from that 

research project: 

(1) ISP visibility into consumer online information is far from comprehensive, and 

will likely continue to decline; and 

(2) ISPs appear to lack unique insights into users’ Internet activity. 

These two conclusions, in my experience, are surprising to many people on first 

encounter. For understandable reasons based in history, many observers have believed that ISPs do have comprehensive and unique insights into users’ Internet activity. Our research has sought to provide an accurate factual basis for consideration 

by the FCC and other policymakers about these topics. As discussed further below, 

38 

3My statement is at https://peterswire.net/wp-content/uploads/SwirelFCC-testimony 

lCPNIl04l27l15.pdf. 

we have researched the facts about ISP activity, and I do not take any position on 

the policy issues facing the FCC concerning broadband privacy. 

This testimony first discusses the context for our research project. It next discusses the limits on the comprehensiveness of ISP visibility into consumer behavior, 

notably due to the historic rise in encrypted communications. It concludes by examining claims that ISPs have unique insight into users’ Internet activity. 

1. The Context for the Research Project 

I briefly discuss the origins of the research project in 2015, and the chronology 

of work product through the testimony today. 

A. The Origins of the Research Project 

My research into ISP access to user data began with the request from the Federal 

Communications Commission to participate in its April 28, 2015, Public Workshop 

on Broadband Consumer Privacy.3 In connection with that Workshop, I was asked 

by a senior FCC official about a prominent dispute during the workshop—advocates 

for stricter privacy regulation essentially argued that ISPs have ‘‘comprehensive’’ access to consumer online information, while the ISPs instead emphasized the limited 

data to which they have access. In response, I answered that this was actually a 

factual question—research could illuminate the extent to which ISPs do or do not 

have ‘‘comprehensive’’ access. 

My research project has sought to shed light on the ‘‘comprehensive’’ access and 

related issues. As disclosed from the start, in addition to funding from Georgia 

Tech-related sources, funding also came from Broadband for America, a trade association that includes major ISPs. At each stage, my co-authors and I have had complete editorial discretion—the views expressed are our own. To underscore our commitment to accurate research, we have asked for public comments about any factual 

inaccuracies. Our Working Paper in February 2016 held up very well to scrutiny. 

Our May 2016 comments to the FCC included detailed responses to comments, including deletion of two sentences (out of the 125-page report) that we concluded we 

could not support. 

As someone who has often previously provided policy recommendations concerning 

privacy issues, I provide some detail about why my work on this topic has been factual rather than making any policy recommendations about what the FCC should 

do in its privacy rulemaking. I am under binding obligations that arise from my role 

as Special Assistant to President Obama for Economic Policy in 2009–2010. As a 

condition of that employment, I signed what is sometimes called the ‘‘Obama 

Pledge’’—I will not engage in any lobbying of Federal officials while President 

Obama remains in office. As a consequence, my writing about the FCC privacy rulemaking has been factual, and I do not and have not advocated for any policy outcome in the proceeding. 

As a related point, I note the role that our research has played both for those concerned the FCC’s proposed privacy rule is too strict as well as those who support 

the FCC’s proposed rule. For those concerned that the FCC’s proposed rule is too 

strict, I believe our research has served a distinctly useful role—the public debate 

had often assumed that ISPs have comprehensive insights into user online activity, 

but in fact that is not so. The research, most clearly concerning the rising use of 

encryption, thus has corrected important misperceptions, prompting policymakers to 

decide based on current facts rather than false impressions. For those who support 

the FCC’s proposed rule, I submit that our research has also served a distinctly useful role. Prior to our Working Paper, a substantial part of the advocacy for the rule 

had been based on factual claims that have not stood up to scrutiny, especially the 

claim that ISPs, due to their place in the Internet ecosystem, see ‘‘everything’’ about 

a user’s Internet activity. In the absence of our Working Paper, proponents of the 

rule faced a risk that the rule would be based on inaccurate facts, thus exposing 

the rule to the risk of reversal during the process of judicial review. 

B. The Chronology Related to the Research Project 

Here is the chronology related to our research project: 

1. As discussed above, in April 2015, the FCC invited me to participate as a panelist in its Public Workshop on Broadband Internet Privacy. The Workshop notably featured the debate about the extent to which ISPs have ‘‘comprehensive’’ 

access to user online information. Shortly thereafter, we began our research 

project on the topic. 

39 

4Letter from Access, et al., to Tom Wheeler, Chairman, Federal Communications Commission 

(Jan. 20, 2016) available at https://www.publicknowledge.org/assets/uploads/documents/ 

BroadbandlPrivacylLetterltolFCCl1.20.16lFINAL.pdf. 5Peter Swire, et al., Online Privacy and ISPs: ISP Access to Consumer Data is Limited and 

Often Less than Access by Others (Feb. 29, 2016) available at http://www.iisp.gatech.edu/working-paper-online-privacy-and-isps. 6 Comment of Peter Swire, In the Matter of: Protecting the Privacy of Customers of Broadband 

and Other Telecommunications Services, WC Docket No. 16–106 (May 24, 2016) available at 

https://www.fcc.gov/ecfs/filing/60001926727. 7See, e.g., FCC Overreach: Examining the Proposed Privacy Rules: Hearing Before the 

Subcomm. on Commc’ns and Tech. of the H. Comm. on Energy and Commerce, 114th Cong. 3 

(2016) (statement of Paul Ohm, Prof., Georgetown University Law Center) (‘‘When users interact 

with websites or use apps or devices that do not support encryption or do not enable it by default, a BIAS provider’s ability to spy is complete and comprehensive.’’) (emphasis added) available at https://energycommerce.house.gov/hearings-and-votes/hearings/fcc-overreach-examining-proposed-privacy-rules, Examining the Proposed FCC Privacy Rules: Hearing Before the 

Subcomm. on Privacy, Tech. and the Law of the S. Comm. on the Judiciary, 114th Cong. 1 (2016) 

(statement of Tom Wheeler, Chairman, Federal Communications Commission) (‘‘. . . an ISP has 

a broad view of all of its customers’ unencrypted online activity’’) (emphasis added) available at 

http://www.judiciary.senate.gov/meetings/examining-the-proposed-fcc-privacy-rules, Comments 

of Public Knowledge, et al., In the Matter of: Protecting the Privacy of Customers of Broadband 

and Other Telecommunications Services, WC Docket No. 16–106, 19–22 (May 27, 2016) (discussing why traffic remains largely unencrypted) available at https://www.fcc.gov/ecfs/filing/ 

60001974141/document/60002080037. 8https://www.fcc.gov/ecfs/filing/107062066122504/document/10706206612250467ca. 

2. In January 2016, over fifty public interest groups signed a letter urging the 

FCC to enact a broadband privacy rule, stating that ISPs have a ‘‘comprehensive view of consumer behavior,’’ and ‘‘have a unique role in the online ecosystem’’ due to their role in connecting users to the Internet (emphasis supplied).4

3. In February, we issued the Working Paper on ‘‘Online Privacy and ISPs: ISP 

Access to Information is Limited and Often Less Than That of Others.’’ 5 We 

submitted a slightly revised version as initial comments to the FCC, including 

with an appendix that documents that our initial draft is factually accurate 

based on expert review.6

4. Several comments in the wake of our Working Paper modified the claim that 

ISPs have a ‘‘comprehensive’’ view to a revised statement that ISPs have a 

‘‘comprehensive view of unencrypted traffic,’’ 7 (emphasis supplied) an important change because a majority of non-video Internet traffic is already 

encrypted today and there are strong trends toward greater encryption. Comments also emphasized types of data where ISPs may have unique advantages, 

such as the time of user log-in and the number of bits uploaded and 

downloaded. 

5. On July 6, we submitted reply comments to the FCC, providing additional facts 

and insights to support our view that ISPs lack comprehensive knowledge of 

or unique insights into users’ Internet activity.8 The key parts of the reply 

comments are laid out in this testimony today. As with our February Working 

Paper, the reply comments and this testimony take no position on what rules 

should apply to ISPs and other players in the Internet ecosystem going forward. As we did in February, we will receive comments on the Georgia Tech 

Institute of Information Security and Privacy Website, and publish edits or corrections if needed. 

2. ISP Visibility into Consumer Online Information is Far From 

Comprehensive, and Will Likely Continue to Decline 

Our February Working Paper informed the public debate by documenting how 

encryption is limiting the possibility of ISP’s viewing much of the content and the 

detailed URLs accessed by consumers. The trend toward greater encryption has continued since February, including the recent Apple announcement that apps in the 

iOS ecosystem must be encrypted by the end of 2016. The growing use of encryption 

and other developments mean that ISP visibility is likely to continue to decline during the period when any new FCC broadband privacy rule would go into effect. 

A. The Trend Toward Encryption is Continuing 

The most-cited findings of our Working Paper concern the recent and rapid rise 

in encrypted connections for the typical user, most notably by use of the HTTPS (secure HTTP) protocol. As we reported in our Working Paper, HTTPS traffic in the 

U.S. Internet backbone was 13 percent in February 2014. That number rose to 49 

percent by January 2016, an historic shift. Sandvine estimates that figure will grow 

40 

9 ‘‘2016 Global Internet Phenomena, Latin America & North America,’’ Sandvine, 1, Jun. 2016 

(‘‘Sandvine forecasts that 70 percent of global Internet traffic will be encrypted in 2016, with 

many networks expected to exceed 80 percent’’) available at https://www.sandvine.com/trends/ 

global-internet-phenomena/. 10Larry Downes, The Downside of the FCC’s New Internet Privacy Rules, HARVARD BUSINESS

REVIEW (May 27, 2016) available at https://hbr.org/2016/05/the-downside-of-the-fccs-new-internet-privacy-rules. 11See, e.g., Center for Democracy and Technology, Online Behavioral Advertising: Discussing 

the ISP-Ad Network Model (Sep. 18, 2008) available at https://cdt.org/insight/online-behavioral-advertising-discussing-the-isp-ad-network-model/, Declan McCullagh, Web Monitoring for 

Ads? It may be Illegal, C/NET (May 19, 2008) available at http://www.cnet.com/news/web-monitoring-for-ads-it-may-be-illegal/, Grant Gross, ISP Backs off of Behavioral Ad Plan, PCWORLD

(Jun. 24, 2008) available at http://www.pcworld.com/article/147508/article.html. 12Professor Nick Feamster, in his comments to the FCC, said ‘‘DPI is typically not widely deployed in many ISP networks,’’ and, ‘‘contrary to some conventional beliefs, ISPs often do not 

retain much of the data that they collect because the cost of doing so can be substantial.’’ Taken 

together with the increasing prevalence of HTTPS, these comments from Professor Feamster 

provide the basis for concluding that DPI going forward is much less of a privacy concern than 

has often been asserted in ISP privacy debates. Comment of Nick Feamster, In the Matter of: 

Protecting the Privacy of Customers of Broadband and Other Telecommunications Services, WC 

Docket No. 16–1606, 6 (May 27, 2016) available at https://www.fcc.gov/ecfs/filing/ 

60001973502/document/60002079367. 

Professor Feamster discusses other possible privacy risks in his comments, which are discussed below. 13 Neil Richards, INTELLECTUAL PRIVACY: RETHINKING CIVIL LIBERTIES IN THE DIGITAL AGE

(2015). 14 In Re: Google Inc. Cookie Placement Consumer Privacy Litigation, 806 F.3d 125, 138 (3rd 

Cir. 2015) available at http://www2.ca3.uscourts.gov/opinarch/134300p.pdf. 

to 70 percent of global Internet traffic by the end of 2016,9 and encryption will become increasingly ubiquitous in the next five to ten years.10 Some of the continuing 

growth in encrypted bits is due to the decision of high-volume video providers such 

as Netflix to shift to encryption. As discussed in the Working Paper, however, a majority of non-video traffic is already encrypted, including widespread encryption for 

potentially revealing activities such as e-mail, text messages, video conversations, 

social networks, and web search. 

The Working Paper provides diagrams and detailed explanations of what changes 

with the shift from HTTP to the encrypted HTTPS protocol. The shift to HTTPS has 

two main effects, the shift to encrypted content and blocking of detailed URLs. 

i. The shift to encrypted content. Based on my professional experience, the most 

prominent privacy concerns about ISPs for the past twenty years have been 

about ‘‘deep-packet inspection’’ (DPI). When an ISP uses DPI, then the ISP can 

go ‘‘deeply’’ into the packet, examining the full content in contrast to the header 

information about where the packet should go. Privacy experts have long expressed concerns that ISP examination of all of a user’s content could reveal a 

great deal of sensitive personal information.11 Notably, for encrypted communications, DPI does not work. Even if ISPs sought to profile customers based 

on content, the use of HTTPS blocks the ISP’s access to the content.12 In short, 

the rise of HTTPS provides technical assurances that address the longest-voiced 

privacy concern about ISPs. 

ii. Blocking of detailed URLs. Along with blocking ISP access to content, HTTPS 

blocks ISP access to detailed URLs. By contrast, ISPs continue to see the domain itself, such as www.example.com. Compared to the domain, detailed URLs 

typically reveal more granular detail about a user’s interests and communications. For a news site, the detailed URL is typically more revealing 

(www.OnlineNewspaper.com/PoliticalNewsStory) than the domain itself 

(www.OnlineNewspaper.com). As another example, the major search engines 

have shifted to HTTPS. With HTTP search, information known as ‘‘HTTP refer’’ 

would reveal the search terms to the ISP. With HTTPS search, however, ISPs 

can no longer see the search terms. As Professor Neal Richards has explained, 

more granular information provides greater risks to what he calls ‘‘Intellectual 

Privacy,’’ or the ability of the organization gathering the data to make inferences about a person’s interests and personality.13 Consistent with this view, 

Federal courts have found content and detailed URLs deserving of stricter legal 

protection under the Electronic Communications Privacy Act than the domain 

itself.14

Comments made after release of the Working Paper have agreed with the growth 

of encryption and the fact that HTTPS blocks content and detailed URLs, and have 

focused instead on other points. A report from Upturn, for instance, correctly states 

that while HTTPS is prevalent on some of the most popular websites, the majority 

41 

15 ‘‘What ISPs Can See: Clarifying the Technical Landscape of the Broadband Privacy Debate,’’ 

Upturn, 3–4, Mar. 2016, available at https://www.teamupturn.com/reports/2016/what-ispscan-see. 16Zack Tollman, We’re Going HTTPS: Here’s How Wired is Tackling a Huge Security Upgrade, 

WIRED (Apr. 28, 2016) available at https://www.wired.com/2016/04/wired-launching-https-security-upgrade/. 17Kate Conger, Apple Will Require HTTPS Connections for iOS Apps by the End of 2016, 

TECHCRUNCH (Jun. 14, 2016) available at https://techcrunch.com/2016/06/14/apple-will-require-https-connections-for-ios-apps-by-the-end-of-2016/. 18 About, LET’S ENCRYPT (last visited Jun. 24, 2016) available at https://letsencrypt.org/ 

about/. 19Let’s Encrypt Community Support, LET’S ENCRYPT (last visited Jun. 24, 2016) available at 

https://community.letsencrypt.org/. 20 Josh Aas, Our Millionth Certificate, LET’S ENCRYPT (Mar. 8, 2016) available at https:// 

letsencrypt.org/2016/03/08/our-millionth-cert.html. 21 Current Sponsors, LET’S ENCRYPT (last visited Jun. 24, 2016) available at https:// 

letsencrypt.org/sponsors/. 22https://letsencrypt.org/2016/03/08/our-millionth-cert.html. 23 HTTPS Everywhere: Encryption for All WordPress.com Sites, WORDPRESS (Apr. 8, 2016) 

available at https://en.blog.wordpress.com/2016/04/08/https-everywhere-encryption-for-allwordpress-com-sites/. 24 Id. 

of total websites remain unencrypted, including a large percentage of health, news, 

and shopping sites.15 In considering these statistics, we note that the number of bits 

transferred is an important measure of whether users’ communications are typically 

encrypted, including for important communications such as e-mails, search, and social networks. Users do a large portion of their Internet activity on the most popular 

such sites, where encryption has often already been adopted. 

News and a wide variety of other sites that rely on display advertising. Change 

is occurring for sites that rely on display advertising, including news sites, where 

encryption adoption has been slow to date. The announcement this April that Wired 

Magazine is shifting to HTTPS is instructive. Wired Magazine has reported that 

every advertisement placed on a page must be delivered via HTTPS for the page to 

work properly.16 Wired Magazine is thus staging its deployment of HTTPS, working 

with its advertising providers to make the transition. This effort by Wired Magazine 

as an early adopter is a promising sign that display advertising-based sites will shift 

to HTTPS. Once an advertising company has upgraded to HTTPS to serve Wired 

Magazine and other early adopters, there is a positive spillover effect—the advertising company can then support HTTPS for the other news, shopping, health, and 

other sites where it places display advertisements. 

In considering the prevalence of encryption under any FCC broadband privacy 

rule, policymakers should move beyond a static view of the state of encryption 

today, and consider the overall trend toward increasingly ubiquitous deployment of 

encryption, including for the ‘‘long tail’’ of websites that have lower user traffic. 

In 2016, signs of the expansion of encryption include: 

• Apple is requiring HTTPS for iOS applications. In June, Apple announced at 

its Worldwide Developers Conference that app developers will be required to 

connect over HTTPS servers when transferring data online.17 App developers 

must make these changes by January 1, 2017, and new apps will not be listed 

on the App Store unless they are encrypted. 

• Progress for the Let’s Encrypt Project, to make implementing HTTPS easier. The 

Let’s Encrypt project is a free, automated, and open certificate authority.18 The 

organization hosts a support community for those seeking to implement Let’s 

Encrypt certificates and to navigate the obstacles to encrypting a website.19 In 

March, Let’s Encrypt issued its one millionth certificate and reported a rate of 

growth of 100,000 certificates per week.20 The success of the project, thanks in 

part to the support of numerous sponsors from public interest groups and technology companies,21 is raising encryption adoption for smaller websites.22

• WordPress has enabled HTTPS by default for hosted content. WordPress announced in April that it will provide HTTPS by default for hosted content, providing increasingly available and accessible encryption for the ‘‘long tail’’ of 

sites.23 By utilizing the Let’s Encrypt project, WordPress was able to automatically deploy and manage HTTPS for the over 1 million custom domains hosted 

through the company.24 The announcement by WordPress illustrates the growth 

of encryption and how encryption is becoming easier to implement. In addition, 

42 

25Darren Pauli, WordPress Pushes Free Default SSL for Hosted Sites, THE REGISTER (Apr. 11, 

2016) available at http://www.theregister.co.uk/2016/04/11/wordpresslpusheslfreeldefault 

lssllencryptsl26loflthelwebslcmses/. 26 ‘‘Internet of Things: Privacy & Security in a Connected World,’’ Federal Trade Commission, 

27–28 (Jan. 2015) available at https://www.ftc.gov/system/files/documents/reports/federaltrade-commission-staff-report-november-2013-workshop-entitled-internet-things-privacy/ 

150127iotrpt.pdf. 27 Id. at 30. 28Peter Swire, et al., Online Privacy and ISPs: ISP Access to Consumer Data is Limited and 

Often Less than Access by Others, 28–30 (Feb. 29, 2016) available at http://www.iisp 

.gatech.edu/working-paper-online-privacy-and-isps. 29 Angela Moscaritolo, Tablets to Make Up Half the PC Market in 2014, PCMAG (Nov. 26, 

2013) available at http://www.pcmag.com/article2/0,2817,2427623,00.asp. 30 Robert McMillan, PC Sales Continue to Fall, WALL ST. J. (Jul. 9, 2015) available at http:// 

blogs.wsj.com/digits/2015/07/09/pc-sales-continue-to-fall/, Jordan Weissman, The End of the 

Home Computer: Why PC Sales Are Collapsing, THE ATLANTIC, (Apr. 11, 2013), available at 

http://www.theatlantic.com/business/archive/2013/04/the-end-of-the-home-computer-why-pcsales-are-collapsing/274899/. 31 At the beginning of 2015, one study showed that 91 percent of users owned a desktop or 

laptop. Smartphone use has climbed sharply, to 80 percent. In addition to desktops, laptops, and 

smartphones, nearly 50 percent of users reported owning a tablet. See Jason Mander, 80 percent 

of Internet users own a smartphone, GLOBALWEBINDEX (Jan. 5, 2015) available at http:// 

www.globalwebindex.net/blog/80-of-internet-users-own-a-smartphone. 32 ‘‘Cisco Visual Networking Index, Forecast and Methodology, 2014–2019 Working Paper,’’ 

Cisco (May 27, 2015) available at http://www.cisco.com/cen/us/solutions/collateral/service-provider/ip-ngn-ip-next-generation-network/whitelpaperlc11-481360.html. 

with 26.3 percent of all content management systems running WordPress,25 the 

shift would appear to provide a competitive advantage for WordPress compared 

to other hosting services, incentivizing other services to offer easy-to-use 

encryption tools. 

• The Federal Trade Commission has emphasized the importance of encrypting 

Internet of Things (IoT) devices. In January, an FTC report strongly recommended encryption of confidential consumer information transmitted by IoT 

devices.26 The FTC gave notice that companies face the risk of enforcement action if they fail to encrypt their devices and communications.27 The public 

threat of enforcement action provides an incentive for companies to deploy 

encryption for the IOT, where encryption adoption has previously lagged. 

• As discussed above, Wired.com’s switch to full HTTPS will make it easier for 

news and a wide variety of other display advertising-supported sites to follow 

suit. 

Our original Working Paper provided extensive additional information about the 

trend toward prevalent use of encryption.28 As one notable example: 

• Google Search ranks HTTPS higher. In 2014, Google announced it would use 

HTTPS as a ranking signal as part of its ‘‘HTTPS Everywhere’’ campaign. In 

light of Google’s large market share in search, website owners thus have an incentive to enable HTTPS in order to gain better search rankings and subsequent page views. Together with developments such as the ‘‘Let’s Encrypt’’ campaign, this means that even small website owners: (i) have an incentive to use 

HTTPS; and (ii) increasingly have the ability to do so. 

B. The Rise of Mobile and Other Reasons for Limits on ISP Visibility 

Beyond encryption, our Working Paper discussed other limits on ISP visibility 

into consumer online information, notably the shift toward mobile access to the 

Internet. Historically, many consumers did most or all of their Internet access from 

home, using an unencrypted connection through a single ISP. We believe that this 

mental model of Internet use is a reason that many people have believed that an 

ISP does have a ‘‘comprehensive’’ view of its customers’ Internet activity. The rise 

of smartphones, tablets, and other mobile computing, however, places limits on an 

ISP’s ability to gain such a view, in addition to the limits that come from prevalent 

encryption: 

• Mobile is becoming the leading way to access the Internet. As our Working Paper 

noted, the number of mobile Internet-enabled devices today is as large as traditional laptops and desktops combined,29 and the market share of desktop computers is continuing to fall.30 Today, the great majority of Internet users own 

mobile devices.31

• Mobile traffic is offloaded to WiFi networks. By 2014, an estimated 46 percent 

of all data traffic shifted to WiFi networks,32 growing to an estimated 60 perVerDate Nov 24 2008 10:44 Feb 21, 2017 Jkt 075679 PO 00000 Frm 00046 Fmt 6633 Sfmt 6621 S:\GPO\DOCS\24204.TXT JACKIE
43 

33 ‘‘Juniper Mobile Data Onload & Offload Report,’’ Juniper (Jun. 2015) available at http:// 

www.juniperresearch.com/researchstore/enablingtechnologies/mobile-data-onload-offload/wifismall-cell-network-strategies. 34 If the Wifi ISP and subscriber ISP are the same, then that ISP can generally detect that 

the individual is using the same MAC address to connect to the ISP. 35 ‘‘Seventeenth Annual Mobile Wireless Competition Report,’’ Federal Communications Commission, DA 14–1862 ¶ 51, rel. Dec. 18, 2014, available at https://apps.fcc.gov/edocslpublic/ 

attachmatch/DA–14–186 2A1.pdf; ‘‘2015 Broadband Progress Report and Notice of Inquiry on 

Immediate Action to Accelerate Deployment,’’ Federal Communications Commission, FCC 15– 

10 109, rel. Feb. 4, 2015, available at https://apps.fcc.gov/edocslpublic/attachmatch/FCC-15- 

10A1.pdf. 36 ‘‘Annual Report and Analysis of Competitive Market Conditions with Respect to Mobile 

Wireless, Including Commercial Mobile Services: Fifteenth Report,’’ Federal Communications 

Commission (Jun. 27, 2011) available at https://apps.fcc.gov/edocslpublic/attachmatch/FCC11-103A1.pdf. 37 ‘‘Broadband Decisions: What Drives Consumers to Switch-or Stick with-Their Broadband 

Internet Provider,’’ Federal Communications Commission (Dec. 2010) available at https:// 

apps.fcc.gov/edocslpublic/attachmatch/DOC-303264A1.pdf. 38Letter from Access, et al., to Tom Wheeler, Chairman, Federal Communications Commission 

(Jan. 20, 2016) available at https://www.publicknowledge.org/assets/uploads/documents/ 

BroadbandlPrivacylLetterltolFCCl1.20.16lFINAL.pdf. 39FCC Overreach: Examining the Proposed Privacy Rules: Hearing Before the Subcomm. on 

Commc’ns and Tech. of the H. Comm. on Energy and Commerce, 114th Cong. 3 (2016) (statement of Paul Ohm, Prof., Georgetown University Law Center) available at http://docs 

.house.gov/meetings/IF/IF16/20160614/105057/HHRG-114-IF16-Wstate-OhmP-20160614.pdf. 

cent of all mobile data traffic by 2020.33 The ISP that connects the WiFi network to the Internet (WiFi ISP) is often different from the ISP that connects 

the mobile user to the Internet (subscriber ISP). In such cases, the subscriber 

ISP has no visibility into the subscriber’s Internet activity connected through 

the WiFi network.34

• Consumers switch carriers. According to FCC statistics, 82 percent of mobile 

broadband Internet users have a choice of at least four providers, and 98.8 percent have at least two.35According to the FCC, between a fifth and a third of 

wireless subscribers switch their carriers annually.36 Consumers also switch 

wireline carriers, with one out of six subscribers switching wireline providers 

every year, and 37 percent of subscribers switching every three years.37 Switching carriers cuts off the visibility of the old carrier, splitting the user’s Internet 

history. 

• Consumers access the Internet through multiple mobile carriers. Any given ISP 

loses visibility into the subscriber’s Internet activity as the user moves between 

cellular connections and WiFi hotspots during the day. For example, they may 

connect using their home and work WiFi, then free WiFi in a coffee shop, then 

WiFi at a friend’s house, any of which may use different ISPs. 

In conclusion about whether ISPs have ‘‘comprehensive’’ visibility into user Internet activity, the prevalence of encryption and the shift to mobile computing put important limits today on ISPs’ visibility. In addition, the role of both encryption and 

mobile computing will continue to grow in the coming years, during the period when 

any new rule would enter into effect. 

3. ISPs Appear to Lack Unique Insights Into Users’ Internet Activity 

Public debate about privacy and ISPs has featured comments that ISPs ‘‘play a 

unique role in the online ecosystem’’ 38 and their position as an Internet ‘‘bottleneck’’ 

gives them unique access to privacy sensitive insights about users.39 To clarify the 

role that ISPs play in the online ecosystem, our Working Paper explained the roles 

played by other online actors, including their access to sensitive personal information, devoting separate chapters to: social networks; search engines; webmail and 

messaging; mobile and other operating systems; interest-based advertising; and 

browsers, Internet video, and E-commerce. 

In the reply comments and this testimony, we examine sources of data, raised by 

commenters, which are potentially available to ISPs. For each source of data, we 

look at the visibility to others—other actors in the online ecosystem often have access to the same or comparable data as that available to ISPs. We also look at the 

insights available from data seen by the ISPs. Looking at each category of data, the 

data available to ISPs appears to offer the same as or less insight than the data 

used by other actors. For instance, ISPs sometimes see ‘‘third-best’’ information: 

they can see the basic domain name a user visits (such as www.example.com) but 

not the encrypted content (what example.com sends to the user) or the detailed Uniform Resource Locator (URL) (such as www.example.com/InterestingPageTitle). Others in the Internet ecosystem, meanwhile, see the content and detailed URLs. 

44 

40Peter Swire, et al., Online Privacy and ISPs: ISP Access to Consumer Data is Limited and 

Often Less than Access by Others, 4 (Feb. 29, 2016) available at http://www.iisp.gatech.edu/ 

working-paper-online-privacy-and-isps. 41Moreover, the domain resolution process was expressly designed to be public. Comment of 

Manos Antonakakis, et al., In the Matter of: Protecting the Privacy of Customers of Broadband 

and Other Telecommunications Services, WC Docket No. 16–106, 6 (May 27, 2016) available at 

https://www.fcc.gov/ecfs/filing/60001973444/document/60002079307. 42Peter Swire, et al., Online Privacy and ISPs: ISP Access to Consumer Data is Limited and 

Often Less than Access by Others, 70–72 (Feb. 29, 2016) available at http://www.iisp 

.gatech.edu/working-paper-online-privacy-and-isps. 

Before discussing the relevant categories of data, I note the difference between 

having access to unique data and having access to unique insights about users. Any 

two companies, at some level, have unique data—they have at a minimum different 

customer lists and different specific interactions with their customers. For purposes 

of informing the record about online privacy, the discussion here provides detail 

about the uniqueness or lack thereof of several categories of data available to ISPs. 

Our analysis here and in the Working Paper primarily focuses, however, on whether 

ISPs have unique insights about their customers—to what extent their position in 

the online ecosystem may mean that ISPs can learn more about consumers than 

others can. For commercial businesses, the focus on insight is key. These insights 

are what provide economic value, including for internal proprietary purposes, to sell 

more valuable advertisements, or to sell to other parties such as data brokers. To 

date, of the top 10 ad-selling companies, which earn over 70 percent of the total online advertising dollars, none gained their current position by providing broadband 

Internet service.40 For the reasons discussed below, ISPs, based on our review, appear to lack unique insights about consumer online activity because other players 

in the Internet ecosystem can collect the same (or equivalent) information. 

I next examine categories of Internet activity data identified by commenters, 

which are sometimes or always available to ISPs. For each category, I provide: (i) 

the type of data; (ii) a description of who other than ISPs has visibility, including 

in some cases data being considered already ‘‘public’’; (iii) discussion of the quality 

of insights that the available data may provide about users; and, (iv) other discussion. 

• Domain names. As discussed above, with HTTPS, general domain information 

is visible to the ISP (such as www.example.com), while the content (what 

www.example.com sends to the user) or the detailed URL (such as 

www.example.com/InterestingPageTitle) are not for encrypted traffic. 

» Visibility to others: Many or all of the domain names a user visits are available to others, including the user’s operating system, the user’s browser or application, and advertising networks and other third parties with cookies or 

services that are present on the page being visited.41 Third parties sell profiles of users based on the domains and/or detailed URLs they visit. 

» Insights: The domain names a user visits are not as revealing as the content 

accessed or full URLs. Some domain names, however, can reveal information 

that would be considered sensitive by most privacy experts, such as 

www.SensitiveHealthSite.com or www.UnusualPoliticalViews.com. 

» Discussion: Compared to other Internet actors, ISP access to domain names 

can be seen as ‘‘third-best’’ information, less revealing than content or detailed URLs. With HTTPS, ISPs cannot see encrypted content or detailed 

URLs, whereas that more detailed information is available to others, including the operator of the page being visited, the operating system, and the 

browser or application. 

• Location information. As discussed in the Working Paper, mobile carriers can 

estimate a user’s location through the process of ‘‘trilateration,’’ based on the 

distance from the user to three or more cell towers.42

» Visibility to others: Commercial services today principally determine location 

based on information from the global positioning system (GPS) or Bluetooth. 

When GPS is switched on, at a minimum the operating system can determine 

location. A large number of popular mobile apps gather detailed location information. Third parties sell profiles based on location information. Moreover, 

mobile operating systems and apps can collect trilateration results using the 

known locations of cell towers and WiFi networks. 

» Insights: Most privacy experts consider precise location history to be sensitive 

information. 

45 

43 Id. 44 Comment of The Future of Privacy Forum, In the Matter of: Protecting the Privacy of Customers of Broadband and Other Telecommunications Services, WC Docket No. 16–1606, 14–16 

(May 27, 2016) available at https://www.fcc.gov/ecfs/filing/60001981713/document/6000208 

9525. 45 ‘‘Data Brokers: A Call for Transparency and Accountability,’’ Federal Trade Commission, 

47–49 (May 2014) available at https://www.ftc.gov/system/files/documents/reports/data-brokers-call-transparency-accountability-report-federal-trade-commission-may-2014/140527data 

brokerreport.pdf. 46 Number Resources, INTERNET ASSIGNED NUMBERS AUTHORITY (last visited Jul. 5, 2016) 

available at https://www.iana.org/numbers. 47See, e.g., View IP Address, CHROME WEB STORE (last visited Jul. 5, 2016) available at 

https://chrome.google.com/webstore/detail/view-ip-address/mfhcchbdblkggcenfmmpgkpgphfhfc 

be?hl=en. 48 IPFIX is a protocol developed by the Internet Engineering Task Force as an open, universal 

standard for exporting Internet Protocol flow information and as an alternative to Cisco’s proprietary NetFlow protocol. See RFC 5102—Information Model for IP Flow Information Export, 

INTERNET ENGINEERING TASK FORCE (Jan. 2008) available at https://tools.ietf.org/html/ 

rfc5102. 49 NetFlow is Cisco’s proprietary protocol for exporting Internet Protocol flow information. The 

term ‘‘NetFlow’’ is often used interchangeably with IPFIX to refer to this type of protocol. Introduction to Cisco IOS NetFlow—A Technical Overview, CISCO (May 29, 2012) available at 

https://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/ios-netflow/prodlwhite 

lpaper0900aecd80406232.html. 

50See id. 

» Discussion: As discussed in our Working Paper, trilateration results in rough 

location information compared to GPS or Bluetooth location tracking, which 

is significantly more precise and available to the user’s device, operating system, and any application or service with access to those sensors.43

• Subscriber information. ISPs often learn subscriber information, such as name, 

address, credit card information, and Social Security number. 

» Visibility to others: Many players in the online ecosystem gain access to data 

such as name, address, and credit card information. Companies that seek information under the Fair Credit Reporting Act (such as for lending, employment, or insurance purposes) also learn Social Security number. A company 

that has name and address can often purchase additional profiling information, a process that Jules Polonetsky of the Future of Privacy Forum calls 

‘‘the democratization of data.’’ 44

» Insights: Many privacy experts, along with the FTC in its report on Data Brokers,45 have expressed concerns about the amount of personal information 

that can be purchased when a company knows subscriber information such 

as name and address. 

» Discussion: The insights that ISPs can gain from subscriber information are 

available to many others in the Internet ecosystem. 

• IP addresses. ISPs use Internet Protocol addresses to connect an individual device to the Internet. IP addresses are assigned by the ISP.46

» Visibility to others: IP addresses are visible to every carrier between the customer and the relevant content provider. Operating Systems, websites, applications, content/website providers, browser plug-ins, and software development kits can all collect IP address information.47 E-commerce sites can combine IP addresses of visiting customers with the names and addresses of those 

customers, along with purchase history. Logs of IP addresses are commonly 

used for purposes other than marketing, including for cybersecurity. Third 

parties sell correlations of IP addresses with cookies and other information. 

All these channels enable other actors to replicate IP address information 

that an ISP can access through providing its services. 

» Insights: IP addresses can give clues to information such as a user’s location, 

commonly visited sites, and usage patterns (including time of log-in, amount 

uploaded and downloaded, and some information on protocols used). 

» Discussion: Many of the insights that ISPs can gain from IP addresses are 

available to many others in the Internet ecosystem. 

• IPFIX Data/Netflow. The Internet Protocol Flow Information Export (IPFIX)48

and NetFlow 49 are protocols for monitoring network traffic.50 For any individual IP flow, or ‘‘sequence of packets sent from a particular source to a parVerDate Nov 24 2008 10:44 Feb 21, 2017 Jkt 075679 PO 00000 Frm 00049 Fmt 6633 Sfmt 6621 S:\GPO\DOCS\24204.TXT JACKIE
46 

51See RFC 3697—IPv6 Flow Label Specification, INTERNET ENGINEERING TASK FORCE (Mar. 

2004) available at https://tools.ietf.org/html/rfc3697. 52 Id. 53Oracle, Little Blue Book: A Buyer’s Guide, 84 (Dec. 2014) available at http:// 

www.bluekai.com/bluebook/assetsl20150102/bluekai-little-blue-book.pdf. 54 ‘‘What ISPs Can See: Clarifying the Technical Landscape of the Broadband Privacy Debate,’’ 

Upturn, 8, (Mar. 2016) (‘‘It is possible to uniquely identify certain web page visits or otherwise 

reveal information about what those packets likely contain.’’) available at https:// 

www.teamupturn.com/reports/2016/what-isps-can-see. 55 Chen, Shuo; Side-Channel Leak in Web Applications: a Reality Today, a Challenge Tomorrow; https://www.microsoft.com/en-us/research/wp-content/uploads/2016/02/WebAppSideCha 

nnel-final.pdf 56FCC Overreach: Examining the Proposed Privacy Rules: Hearing Before the Subcomm. on 

Commc’ns and Tech. of the H. Comm. on Energy and Commerce, 114th Cong. 52 (2016) (testimony of Paul Ohm, Prof., Georgetown University Law Center) available at http:// 

docs.house.gov/meetings/IF/IF16/20160614/105057/HHRG-114-IF16-Transcript-20160614.pdf. 57 Comment of Nick Feamster, In the Matter of: Protecting the Privacy of Customers of 

Broadband and Other Telecommunications Services, WC Docket No. 16–1606, 3–4 (May 27, 

2016) available at https://www.fcc.gov/ecfs/filing/60001973502/document/60002079367. 

Feamster also states: ‘‘even though IPFIX records contain no information about the actual content of communication, information such as volumes, sources, and destinations can sometimes 

reveal private information about user behavior.’’ The discussion here has pointed out that access 

to the content of communications will provide greater insights than partial information about 

the types of data Feamster describes. Id. at 4. 58 ‘‘What ISPs Can See: Clarifying the Technical Landscape of the Broadband Privacy Debate,’’ 

Upturn, 8 (Mar. 2016) available at https://www.teamupturn.com/reports/2016/what-isps-cansee. 59 Comment of Nick Feamster, In the Matter of: Protecting the Privacy of Customers of 

Broadband and Other Telecommunications Services, WC Docket No. 16–1606, 4 (May 27, 2016) 

(‘‘Network operators may also share IPFIX data with researchers. I use IPFIX data collected 

at interconnection points to analyze utilization patterns. In another project related to DoS mitigation, we are using IPFIX data to better understand traffic attack patterns. In the past, we 

ticular. . .destination,’’ 51 IPFIX can be used to record and store the start and 

end time for the flow, the number of bytes and packets in the flow, the protocol/ 

type of connection (e.g., TCP or UDP), and the source and destination of the 

flow.52

• Visibility to others: IP flow information is visible to each: network operator; 

ISP; transit provider; Internet backbone provider; and edge provider along the 

path between the end-user and the destination. The same IP flow information, 

as well as additional information, is visible to the user’s operating system and 

applications. For other members of the ecosystem, this data can be aggregated 

through purchase from and sale to data brokers, including data linked to the 

IP addresses of a service’s users.53

• Insights: Access to IPFIX/Netflow data may in some instances provide ‘‘side 

channel’’ information from these flows that can help in inferring end-user behavior such as whether they are browsing the web, streaming a video, or chatting with someone online. Comments state it is possible to ‘‘identify certain web 

page visits’’ or ‘‘information about what those packets likely contain’’ 54 from the 

IP flow information; to do this appears to require ‘‘finger printing’’ each website 

of interest 55 and the collection of a high fraction of the flows. In addition, concerning the statement that such information is stored as a ‘‘permanent record 

of these individual transactions,’’ 56 Professor Nick Feamster reports that IPFIX 

normally samples one out of every 1,000 packets for traffic statistics.57 Thus, 

‘‘many short flows may not be recorded whatsoever.’’ Sampling this data would 

be an inefficient way to profile users compared to analysis of the actual content 

available to the operators of pages that users visit and others. Similarly, given 

the volume of connections and volume of websites, we are not aware of a business justification for creating a ‘‘permanent record’’ of all of IPFIX data for an 

ISP’s users nor for maintaining an archive of website fingerprints (which 

change often and dynamically). 

• Discussion: Professor Feamster also states: ‘‘even though IPFIX records contain 

no information about the actual content of communication, information such as 

volumes, sources, and destinations can sometimes reveal private information 

about user behavior.’’ This data, along with other ‘‘side channel’’ inferences, is 

an example of what we believe is ‘‘third-best’’ advertising data—inferences 

based on information that provides less insight than content or detailed URLs. 

We are not aware of any evidence that these methods are currently widely used, 

let alone profitable,58 for advertising. This data, however, is useful for purposes 

including network management, network security, and research.59

47 

have also used IPFIX traffic traces from access ISPs to design and validate algorithms to detect 

botnets, large networks of compromised machines. Most recently, I have been using IPFIX data 

collected at the interconnection points from seven access ISPs in the United States—covering 

50 percent of the U.S. broadband subscriber population—to explore the characteristics and patterns of utilization between access ISPs and edge providers. Interestingly, this type of project 

that provides exactly the type of insight and analysis that the FCC is increasingly paying attention to. Preventing ISPs from sharing this type of data with researchers would impede progress 

on this research.’’) available at https://www.fcc.gov/ecfs/filing/60001973502/document/ 

60002079367. 

Conclusion 

In conclusion about whether ISPs have ‘‘unique’’ visibility into user Internet activity, the discussion here has pointed out the many places where other players in the 

Internet ecosystem receive the same (or equivalent) information about user actions. 

Concerning unique insights into user behavior, ISPs in many instances have access 

to data that is less revealing than content or other information about user activity 

available to the companies providing services to the user. 

In conclusion, I thank the Committee for the opportunity to testify today, and 

would be glad to answer any questions. 

Background of the witness 

I am the Huang Professor of Law and Ethics at the Georgia Tech Scheller College 

of Business, with appointments by courtesy with the College of Computing and 

School of Public Policy. Consistent with university consulting rules, I am Senior 

Counsel with Alston & Bird, LLP. 

I have been immersed in privacy and cybersecurity issues for two decades. In 

2015, the International Association of Privacy Professionals, among its over 20,000 

members, awarded me its Privacy Leadership Award. In 2013, I served as one of 

five members of President Obama’s Review Group on Intelligence and Communications Technology. Prior to that, I was co-chair of the global Do Not Track process 

for the World Wide Web Consortium. I am Senior Fellow with the Future of Privacy 

Forum. 

Under President Clinton, I served as Chief Counselor for Privacy, in the U.S. Office of Management and Budget. In that role, my activities included being White 

House coordinator for the HIPAA medical privacy rule, serving as White House representative to the privacy rulemaking process under the Gramm-Leach-Bliley Act, 

and helping negotiate the U.S.-E.U. Safe Harbor agreement for trans-border data 

flows. Under President Obama, I served as Special Assistant to the President for 

Economic Policy in 2009–2010. 

I have testified on privacy and other issues before almost a dozen committees in 

the U.S. Congress, and worked closely with the Federal Trade Commission and 

other Federal agencies on privacy and cybersecurity issues. In 2011, the Federal 

Communications Commission asked me to summarize and comment on the day’s 

proceedings for its Workshop on Location Information. Further information is available at www.peterswire.net. 

48 

ATTACHMENT

Complete article can be found at: http://www.iisp.gatech.edu/sites/default/files/ 

images/online—privacy—and—isps.pdf 


712ISPS1.eps
49 


712ISPS2.eps
50 


712ISPS3.eps
51 


712ISPS4.eps
52 


712ISPS5.eps
53 


712ISPS6.eps
54 


712ISPS7.eps
55 


712ISPS8.eps
56 


712ISPS9.eps
57 


712ISPS10.eps
58 


712ISPS11.eps
59 


712ISPS12.eps
60 


712ISPS13.eps
61 


712ISPS14.eps
62 

The CHAIRMAN. Thank you, Professor Swire. 

Before I begin with questions, I want to submit a few items for 

the record of today’s hearing. I received two letters that I believe 

contribute greatly to this topic. The first letter is signed by constitutional scholar Laurence Tribe and 13 other law professors, 

economists, and experts. They support strong protections for consumers in the online space, but they have significant concerns with 

the FCC’s proposal, and, instead, they suggest that the Commission adopt rules modeled after the FTC’s longstanding and highly 

successful approach, their words. 

The second letter, signed by the heads of eight trade associations 

representing both the technology sector and the telecom industry, 

also argues for the FCC to harmonize its effort with the existing 

FTC framework, in order to minimize consumer confusion and provide flexibility for the marketplace to innovate. 

[The letters referred to follow:] 

INTERNATIONAL CENTER FOR LAW & ECONOMICS

July 11, 2016 

VIA EMAIL 

Hon. JOHN THUNE, 

Chairman, 

Committee on Commerce, Science, and 

Transportation. 

Hon. BILL NELSON, 

Ranking Member, 

Committee on Commerce, Science, and 

Transportation. 

Hon. FRED UPTON, 

Chairman, 

Committee on Energy and Commerce. 

Hon. FRANK PALLONE, 

Ranking Member, 

Committee on Energy and Commerce. 

Hon. GREG WALDEN, 

Chairman, 

Subcommittee on Communications and 

Technology, 

Committee on Energy and Commerce. 

Hon. ANNA ESHOO, 

Ranking Member, 

Subcommittee on Communications and 

Technology, 

Committee on Energy and Commerce. 

Re: Letter from legal scholars and economists concerning the Federal Communications Commission’s Broadband Privacy NPRM 

Dear Senators Thune and Nelson, Congressmen Upton, Pallone and Walden, and 

Congresswoman Eshoo: 

We, the undersigned experts in the law and economics of the Internet, have significant concerns with the proposal of the Federal Communications Commission 

(‘‘Commission’’ or ‘‘FCC’’) to adopt new data privacy and security rules for 

broadband Internet access service providers (‘‘ISPs’’) under Title II of the Communications Act. 

We support strong consumer protection and believe that the Commission has a 

role to play in protecting consumers’ data privacy and security. For several reasons, 

however, we find that the proposed rules take the wrong approach and would harm 

consumers, competition, and innovation. 

As a fundamental matter, the proposed rules do not reflect the technological and 

economic nature of the Internet environment, in which ISPs are just one of many 

types of entities that have access to and can use consumers’ online information to 

provide services, including access to ad-supported content. The proposed rules would 

single out ISPs for heightened regulation, imposing strict opt-in consent requirements on their use and disclosure of customer information. 

By contrast, other online entities—such as social media networks, operating systems, browsers, data brokers, and search engines—would operate under the Federal 

Trade Commission’s (‘‘FTC’s’’) strong but flexible opt-out consent regime, which 

would allow them to continue collecting, using, and sharing information about consumers’ online activities for a variety of commercial purposes. The FTC’s framework 

focuses on stopping practices that truly harm consumers, allowing companies ample 

space to develop innovative and beneficial products and services. 

As a result, the FCC’s proposed rules would not only distort the marketplace in 

ways that are likely to increase costs to consumers, but also mark an unprecedented 

63 

1See also Professor Laurence H. Tribe and Jonathan Massey, ‘‘The Federal Communications 

Commission’s Proposed Broadband Privacy Rules Would Violate the First Amendment,’’ WC 

Docket No. 16–106 (May 27, 2016) (white paper detailing how the FCC’s proposed rules would 

violate the First Amendment in various respects and should not be adopted). 

and unwarranted departure from the successful balance that has governed the Internet economy for the past couple of decades and which has led to substantial innovation, investment, competition, and growth. 

Moreover, the asymmetrical regulatory framework that would be created by the 

proposed rules likely would confuse consumers and negatively affect the Internet 

economy. Specifically, the Commission’s proposal to require ISPs to obtain opt-in 

consent before using or disclosing consumers’ data for most activities is diametrically opposed to the approach that the FTC has taken for decades and to which 

consumers have become accustomed. Consumers may not understand that the 

choices they make through their ISPs’ opt-in mechanism do not apply to other participants in the Internet ecosystem, even though these other participants will be collecting exactly the same data and using it for exactly the same purposes (e.g., online 

advertising) as ISPs. 

In addition, the free flow of data is the lifeblood of the Internet economy. The proposed heightened consent requirements, however, would impede consumers’ access to 

information about new online services and cost-savings that may be of interest to 

them and therefore would reduce ISPs’ incentives to develop new services, reducing 

competition and innovation online. 

The Commission’s failure to take these costs into account exemplifies its broader 

failure to conduct a full economic analysis of the proposed rules. 

Finally, the Commission’s proposed choice rules are unconstitutional because they 

would uniquely prohibit ISPs’ use and disclosure of information for marketing purposes without obtaining consumers’ opt-in consent. By treating ISPs differently from 

other online entities, the proposed rules would create a discriminatory, speaker-based 

regime. Such a regime is presumptively invalid and subject to strict scrutiny, which 

the proposed rules could not withstand. Nor could the proposed rules survive intermediate scrutiny: by requiring opt-in consent for most first-party marketing and 

other activities, regardless of the potential for consumer harm, they are not narrowly tailored to advance a substantial governmental interest.1

Fortunately, there is another path forward. The Commission should adopt rules 

modeled after the FTC’s longstanding and highly successful approach, which the 

FTC staff highlighted in its comments filed in this proceeding. This technology-neutral approach—which applies an opt-in consent requirement to the use and sharing 

of sensitive information such as financial, health, children’s, and precise geolocation 

data as well as social security numbers, plus robust notice and opt-out choice for 

other data uses—would provide strong, time-tested, and consistent privacy protections for consumers across the Internet ecosystem while fostering continued innovation, competition, investment, and growth. 

Respectfully submitted, 

(Affiliations provided for identification purposes only) 

LAURENCE H. TRIBE

Carl M. Loeb University Professor & Professor of Constitutional Law 

Harvard Law School 

RICHARD A. EPSTEIN

Laurence A. Tisch Professor of Law, The New York University School of Law 

The Peter and Kirsten Bedford Senior Fellow, The Hoover Institution 

The James Parker Hall Distinguished Service Professor of Law Emeritus and Senior 

Lecturer, The University of Chicago 

ROBERT CORN-REVERE

Partner 

Davis Wright Tremaine LLP 

ROBERT D. ATKINSON

President 

Information Technology and Innovation Foundation 

JANE BAMBAUER

Associate Professor of Law 

University of Arizona 

James E. Rogers College of Law 

64 

BABETTE BOLIEK

Associate Professor of Law 

Pepperdine University School of Law 

FRED H. CATE

Distinguished Professor and C. Ben Dutton Professor of Law 

Indiana University Maurer School of Law 

JAMES C. COOPER

Associate Professor of Law and Director, Program on Economics & Privacy 

Scalia Law School, George Mason University 

JUSTIN (GUS) HURWITZ

Assistant Professor of Law 

Nebraska College of Law 

MARK A. JAMISON

Director and Gunter Professor, Public Utility Research Center 

University of Florida 

DANIEL A. LYONS

Associate Professor of Law 

Boston College Law School 

GEOFFREY A. MANNE

Executive Director 

International Center for Law & Economics 

DAVID W. OPDERBECK

Professor of Law, Seton Hall University Law School 

Director, Gibbons Institute of Law, Science & Technology 

PAUL H. RUBIN

Samuel Candler Dobbs Professor of Economics 

Emory University 

July 11, 2016 

Hon. JOHN THUNE, 

Chairman, 

Senate Committee on Commerce, 

Science, and Transportation, 

Washington, DC. 

Hon. BILL NELSON, 

Ranking Member, 

Senate Committee on Commerce, 

Science, and Transportation, 

Washington, DC. 

Dear Chairman Thune and Ranking Member Nelson: 

We write to applaud the Committee for your efforts to examine the Federal Communication Commission’s (‘‘FCC’’) proposed broadband privacy rules. Now that the 

reply comment period in the FCC’s proceeding has closed, this hearing is a timely 

and important venue for considering the deep flaws that we, and many other commenters, have identified in the FCC’s lead proposal. In the months since the FCC 

unveiled its proposed rules, a diverse set of stakeholders has criticized the proposals 

because they would impose unnecessary costs on consumers, put a drag on innovation and competition, and make it harder for broadband Internet access service providers (‘‘ISPs’’) to work with the government and third-party partners to ensure the 

security, reliability, and integrity of the service. The record before the FCC adds 

depth and breadth to these criticisms and raises additional arguments, including 

important constitutional concerns. It is clear that the FCC’s proposed rules are both 

inconsistent with consumer expectations and clash with the important policies that 

have successfully guided the Internet economy for almost two decades under both 

Democratic and Republican administrations. 

Title II of the Communications Act in no way requires the FCC to adopt prescriptive privacy rules that would single out one subset of the broader online ecosystem 

for heightened and inconsistent regulation that ignores the sensitivity of the information at issue. As comments from current and former Federal Trade Commission 

(‘‘FTC’’) Commissioners, civil rights organizations, economists, legal scholars, and 

companies ranging from advertisers to home efficiency companies have noted, the 

FTC’s consumer privacy framework is much better suited for the dynamic, innovative, and highly competitive Internet economy—in which ISPs play an important but 

limited role. At the center of the FTC’s framework and the Obama Administration’s 

reports and legislative proposals is the idea that companies should be transparent 

65 

with consumers, provide them with choices that are appropriate for the sensitivity 

of data or use in question, and maintain reasonable data security safeguards. 

Consistent with that approach, before the FCC initiated the broadband privacy 

proceeding, a broad industry coalition of ISPs, tech companies, equipment providers, 

and others joined together to urge the FCC to adopt a framework based on the 

broad principles of transparency, respect for context, and choice. The coalition’s proposal, which is attached to this letter, emphasized that ‘‘[c]onsumers should have 

consistent and predictable privacy protections for the information they deem private 

and sensitive, no matter how or with whom they share it.’’ In other words, we support privacy protections that address the potential for genuine consumer harm, 

allow consumers to exercise appropriate control over how information about them 

is used and shared, and provide the flexibility that is necessary to promote innovation and competition. The FCC’s proposed rules, however, are inconsistent with the 

flexible framework that the FTC enforces against many other players in the Internet economy; and the proposed rules offer no material improvement to consumer 

privacy protections. 

The staff of the FTC’s Bureau of Consumer Protection recently made the same 

point in their comments to the FCC, noting that creating special rules for ISPs ‘‘is 

not optimal’’ and that the rigid proposed rules ‘‘could hamper beneficial uses of data 

that consumers may prefer, while failing to protect against practices that are more 

likely to be unwanted and potentially harmful.’’ We agree: privacy rules that hamper innovation and competition while also failing to meet consumers’ expectations 

are ‘‘not optimal,’’ to say the least. 

The FCC’s proposed rules are also seriously out of step with the technology-neutral approach—applied to both ISPs and non-ISPs—that that has guided the Administration’s many efforts on privacy and cybersecurity policy, with great success. For 

example, the Administration’s Consumer Privacy Bill of Rights emphasized the importance of common principles that apply across the ecosystem, in particular the 

need to harmonize the standards that apply to communications companies with the 

standards that apply to the rest of the Internet economy. The Consumer Privacy Bill 

of Rights framework provides a ‘‘clear statement of basic privacy principles that 

apply to the commercial world, and a sustained commitment of all stakeholders to 

address consumer data privacy issues as they arise from advances in technologies 

and business models.’’ Similarly, the Administration’s Cybersecurity Framework 

was ‘‘created through collaboration between government and the private sector, uses 

a common language to address and manage cybersecurity risk in a cost-effective way 

based on business needs without placing additional regulatory requirements on 

businesses.’’ This is the right approach for the innovative, dynamic, competitive 

Internet economy. 

The FCC’s proposal to go in a radically different direction also raises serious constitutional concerns. Professor Laurence Tribe, a pre-eminent scholar of the U.S. 

Constitution, concluded that the ‘‘profound mis-matches’’ between the goals of the 

FCC proposal and its actual effects if adopted would violate the First Amendment 

in several ways. According to Professor Tribe, because the proposal ‘‘singles out 

broadband ISPs for extremely burdensome regulation’’ while leaving a wide range 

of other participants in the Internet economy under different rules, it is the kind 

of speaker-based restriction that would face strict scrutiny under the First Amendment. Professor Tribe also concluded that the proposal would be unconstitutional 

even under the more lenient standard that applies to commercial speech. The timeproven effectiveness of the legal standards that the FTC enforces demonstrates that 

a much less restrictive alternative is available to the FCC. 

Put simply, the ‘‘profound mis-match’’ between the FCC’s highly restrictive proposal and the surrounding legal, economic, and technological landscape is bad policy 

and constitutionally problematic. 

We appreciate the Committee’s important recognition of this issue and the need 

for Congressional oversight. We are hopeful that your examination of these issues 

will lead to an FCC approach that closely harmonizes FCC privacy rules with the 

existing FTC framework and is consistent with the Administration’s guiding principles for privacy and security in the Internet economy. Doing so would protect consumer privacy, minimize consumer confusion resulting from inconsistent regulations, permit new entry into the online advertising market, and provide the flexiVerDate Nov 24 2008 10:44 Feb 21, 2017 Jkt 075679 PO 00000 Frm 00069 Fmt 6633 Sfmt 6621 S:\GPO\DOCS\24204.TXT JACKIE
66 

bility the online marketplace needs in order to continue to innovate and evolve as 

it has done for many years under such a regime. 

Sincerely, 

GARY SHAPIRO

President and CEO 

Consumer Technology Association 

JIM HALPERT

President & CEO 

Internet Commerce Coalition 

JONATHAN SPALTER

Chair 

Mobile Future 

SCOTT BELCHER

CEO 

Telecommunications Industry 

Association 

MEREDITH ATTWELL BAKER

President and CEO 

CTIA®

GENEVIEVE MORELLI

President 

ITTA 

MICHAEL POWELL

President & CEO 

National Cable & Telecommunications 

Association 

WALTER B. MCCORMICK, JR. 

President & CEO 

USTelecom 

The CHAIRMAN. There is also a new paper published by Gerard 

Faulhaber, former Chief Economist at the FCC, and Hal Singer, a 

Senior Fellow at the George Washington School of Public Policy. 

Their paper is titled, ‘‘The Curious Absence of Economic Analysis 

at the Federal Communications Commission: An Agency in Search 

of a Mission.’’ And while it focuses primarily on the Commission’s 

failure to ground its recent regulations in economic reasoning, 

Faulhaber and Singer offer some valuable insight in this case 

about the FCC’s privacy proposal, and particularly noting the complete lack of any cost-benefit analysis by the Commission in this 

proceeding. 

So I want to as well submit that for the record. 

[The information referred to follows:] 

67 


712FAULH1.eps
68 


712FAULH2.eps
69 


712FAULH3.eps
70 


712FAULH4.eps
71 


712FAULH5.eps
72 


712FAULH6.eps
73 


712FAULH7.eps
74 


712FAULH8.eps
75 


712FAULH9.eps
76 


712FAULH10.eps
77 


712FAULH11.eps
78 


712FAULH12.eps
79 


712FAULH13.eps
80 


712FAULH14.eps
81 


712FAULH15.eps
82 


712FAULH16.eps
83 


712FAULH17.eps
84 


712FAULH18.eps
85 


712FAULH19.eps
86 


712FAULH20.eps
87 


712FAULH21.eps
88 


712FAULH22.eps
89 


712FAULH23.eps
90 


712FAULH24.eps
91 


712FAULH25.eps
92 


712FAULH26.eps
93 


712FAULH27.eps
94 


712FAULH28.eps
95 


712FAULH29.eps
96 


712FAULH30.eps
97 


712FAULH31.eps
98 


712FAULH32.eps
99 


712FAULH33.eps
100 


712FAULH34.eps
101 


712FAULH35.eps
102 


712FAULH36.eps
103 


712FAULH37.eps
104 


712FAULH38.eps
105 


712FAULH39.eps
106 


712FAULH40.eps
107 


712FAULH41.eps
108 


712FAULH42.eps
109 


712FAULH43.eps
110 


712FAULH44.eps
111 


712FAULH45.eps
112 


712FAULH46.eps
113 


712FAULH47.eps
114 


712FAULH48.eps
115 


712FAULH49.eps
116 


712FAULH50.eps
117 


712FAULH51.eps
118 


712FAULH52.eps
119 


712FAULH53.eps
120 


712FAULH54.eps
121 


712FAULH55.eps
122 


712FAULH56.eps
123 


712FAULH57.eps
124 


712FAULH58.eps
125 


712FAULH59.eps
126 


712FAULH60.eps
127 

The CHAIRMAN. As I mentioned in my opening statement, 94 percent of Americans prefer that all companies collecting data online 

follow the same consumer privacy rules, and so the question for 

any of you really is the FCC is, as I’ve said, nonetheless proposing 

to create a privacy regime for ISPs that’s wholly distinct from the 

privacy rules governing all other companies on the Internet. So do 

any of you believe that consumers expect or want to have their online activity subjected to privacy rules that differ depending on the 

type of company collecting their information? 

Mr. Ohm. 

Mr. OHM. Absolutely. I think companies—consumers do expect 

that health care companies, for example, when interacting with a 

consumer on the Internet, are obligated to follow different rules. I 

think parents, and I’m a parent of young children, hope that 

websites are obligated to follow different rules when it comes to the 

sensitivity of information collected from children. I think the same 

is said when our children go to school and use Google Docs: we 

hope that the companies that are engaging in contracts with our 

school districts are obligated to follow special privacy rules. And as 

I said in my opening statement, I think ISPs belong in this group 

as well for the reasons that I’ve already laid out. 

This speaks to something that we’ve heard in this debate, that 

the FCC rule will somehow confuse consumers. I think I give the 

American consumer a lot of credit, right? The notice and choice regime that the FTC use, which is exalted by almost everybody in 

this debate, is frankly a pretty complex system of reading privacy 

policy after privacy policy after privacy policy, trying to manipulate 

privacy settings. It’s a really, really straightforward thing. In contrast to that, what the FCC proposes is a bright line opt-in consent 

for certain uses of information that are unexpected. Thanks. 

The CHAIRMAN. Mr. Leibowitz. 

Mr. LEIBOWITZ. Yes. Can I just respond to the last point? And I 

have the greatest respect for Professor Ohm. He worked for the 

FTC when I was there, he helped out with the Children’s Online 

Privacy Protection Act, and he did a great job. But first of all, the 

FTC approach is not complicated, it is simple. It prohibits unfair 

or deceptive acts or practices, and if you—which means if you’re a 

company and you don’t honor your privacy commitment, the FTC 

will go after you. And the FTC has brought cases against Google, 

against Facebook, against Dish Network for not honoring its privacy commitments. 

The second point I’d make—I just want to come back to the consumer confusion issue—90 percent of consumers, according to a 

study—this might have been what you cited, Mr. Chairman—by 

the Progressive Policy Institute, and I’ll put this in the record after 

the hearing, believe that consumers should be under the same 

rules, and those same—and those same rules—and the reason isn’t 

just because of consumer confusion, although that’s a reason, the 

reason is because consumers benefit when there is competition between ISPs and other technology companies, and the FCC has an 

ability to take the FTC approach and turn it into rules. And that’s 

why I think Mr. Garfield’s idea of having them put out a second 

draft, because the draft that they’ve put out is full of—it makes— 

I believe they have policy choices or the Coalition believes, and it 

128 

is riddled with just mistakes, would be a good idea. You don’t write 

a bill—you don’t write a bill, introduce it one day and go to the 

floor the next day. It gets beveled by this committee, it gets tested 

and stress-tested, and that’s what the FCC should do. This is a big 

part of industry. You want to get this right. They’re not very close 

yet. They need to do a better job. 

Mr. GARFIELD. Yes, I would add that the problem is not simply 

that it’s distinct, and there’s a problem there, as Mr. Leibowitz has 

pointed it, it’s also that it ignores what is proven to be effective and 

workable over decades. And so replacing something with something 

that’s likely to not be workable is making change for change’s sake 

without any evidence that will improve the nature of things for 

consumers. 

The CHAIRMAN. Mr. Leibowitz, has the FCC identified any specific harm or particular problems posed by ISPs that require a different privacy framework from what the FTC has applied to ISPs 

for years? 

Mr. LEIBOWITZ. No, I don’t believe it has, Mr. Chairman, and, indeed, you know, it would be easy for the FCC to take the FTC’s 

approach embodied in the 2012 report, which, by the way, was 

criticized by some businesses and supported by a lot of consumer 

groups, and just focus on the really important thing, where consumers need protection, which is sensitive data. 

The CHAIRMAN. Mr. Polka, while the FCC’s proposals would 

place significant additional burdens on all broadband providers, as 

you pointed out, there are burdens that I think probably disproportionately affect smaller providers, like those serving much of South 

Dakota and rural America, who may have only hundreds or perhaps a few thousand broadband consumers. 

Would you think the FCC’s proposed regulations lead to more 

and better broadband service options for rural American households, or might they lead to less? And maybe you could elaborate 

a little bit, too, some of the burdens and how they do disproportionately affect providers in our part of the world. 

Mr. POLKA. We believe it would lead to less with a chilling effect 

on investment and deployment, which is something none of us 

want. I mean, we’re all here in Washington where we’re encouraging greater deployment of broadband in smaller markets, rural 

areas. And the fact of the matter is you can look at our members 

and say that they’re good actors. They’ve been member companies 

that have supported privacy and protected the privacy of their customers for decades. 

And, in fact, our member companies have been part of the solution. We’re the ones that have delivered broadband out to the 

smaller markets in rural areas where the large companies simply 

won’t come. So we are part of that solution in reaching those hardto-reach communities. 

But what we’re talking about here is really the challenge of balancing the need for privacy and privacy regulations with the ability 

to deliver important broadband services in rural markets in rural 

areas, in smaller markets, and in competitive areas, and that’s 

where I think the balance is necessary with the FCC’s rules. 

When we look at changing the nature of what has been a consistent longstanding policy that is applied to consumers in the 

129 

broadband—Internet ecosystem for years and now changing that 

and changing their expectations, I think we’re asking for trouble. 

As your previous question alluded to, consumers expect privacy 

to apply across the board. If you create two different systems of privacy regulation, the consumer is going to think there is just one 

standard. They might be surprised on the other end, where there’s 

a lesser standard, to realize that maybe their privacy isn’t protected as maybe they assumed it would be when they’re dealing 

with their ISP. 

The CHAIRMAN. Thank you. My time has expired. 

Senator Nelson. 

Senator NELSON. Thank you, Mr. Chairman. 

I have been struck listening to your testimony, and I thank you 

for it, I think it’s very reasoned. What we have been going through 

over the past several years in trying to protect the privacy of American citizens and American persons from intrusion by the government, and, thus, we have set up this long case history that if you 

want to get something in somebody’s house, you have to go to a 

judge, if you’re the government, to get that. So, too, then in this 

new world of the Internet and telephone calls, we have said that 

if the government wants to get content of those communications, it 

has to go to a specially set-up court to handle intelligence matters, 

the FISA court. 

Now, if that is true and now we move from government wanting 

to get your content over to corporations wanting to get your content, Professor Swire, is that the reason that half the people are 

now encrypting their communications? 

Mr. SWIRE. Well, a big reason for the shift in encryption—and I 

was on the President’s NSA Review Group and we worked a lot on 

those FISA kinds of things—a big reason is that American-based 

companies that operate overseas were facing a lot of loss of confidence overseas, folks didn’t want to use U.S.-based services, and 

one of the ways that American-based tech companies have responded is by upping the level of encryption in a lot of different 

places. 

Senator NELSON. But you said in your testimony, as I understood 

it—— 

Mr. SWIRE. Yes. 

Senator NELSON.—that it is the consumers that are choosing to 

encrypt their communications. 

Mr. SWIRE. It happens at the service level. So Gmail a few years 

ago wasn’t encrypted, and now it is. Facebook a few years ago 

wasn’t encrypted, and now it is. It’s complicated for us, as individuals, to set up an encryption system, but it’s by default, then it 

works, and what’s happened for consumers is in the last few years 

the defaults have shifted a lot more toward encryption. 

Senator NELSON. OK. Professor Ohm. 

Mr. OHM. Yes, no, it’s a great question and it’s a really interesting one. I spent four years at the Justice Department as a computer crime prosecutor—— 

Senator NELSON. In essence, my question to you is—— 

Mr. OHM. Yes, yes. 

Senator NELSON.—do we not have an obligation since we’re protecting American citizens and American persons from the governVerDate Nov 24 2008 10:44 Feb 21, 2017 Jkt 075679 PO 00000 Frm 00133 Fmt 6633 Sfmt 6601 S:\GPO\DOCS\24204.TXT JACKIE
130 

ment intrusion of their content, do we not have an obligation to 

protect from the commercial intrusion of their content? 

Mr. OHM. Yes, it speaks to the Chairman’s question about consumer expectations, right? Privacy is in shambles everywhere. The 

consumers and the citizens feel a lot of anxiety about this, and 

again I’m guessing that you hear this from your constituents. One 

measure of this is kind of clamor for encryption. And, by the way, 

some of that encryption may be, ‘‘Please encrypt your service so my 

ISP can’t look over shoulder,’’ which feeds the FCC’s impetus, not 

cuts against it, right? And for these reasons—and, in fact, in some 

of my work, I’ve even documented how the line between these two 

systems of surveillance is actually quite blurry, and that a lot of 

government surveillance is sometimes abetted by massive data 

bases that are held by corporations. 

But to get to your basic point, I couldn’t agree more. Like if we 

want parity, we should have parity in all ways, including parity in 

the understanding that information, when it’s sent through an 

intermediary that you have to use, you have no option not to use 

an ISP, will have a modicum of measured level of modest privacy 

support on top of that. 

Mr. GARFIELD. What we’re talking about is not a choice between 

protection or no protection. What we’re talking about is the framework for that protection, and should it be grounded in well-established principles or reinvented whole cloth by the FCC? 

Senator NELSON. Well, what we’re talking about, when you look 

at it from the consumer’s standpoint, is, should the consumer have 

the authority, by giving their consent or not, to control the invasion 

of their content? That’s what we’re talking about. 

Mr. GARFIELD. Right. But opt-in and opt-out are both giving consumers choice and consent. What we’re talking about is whether 

the agency gets to define which is—— 

Senator NELSON. But as a practical matter, that doesn’t work 

that way. 

Mr. OHM. Right. And if I may, Senator Nelson, it goes directly 

to your question, the Wiretap Act and FISA, which you referenced, 

they do have consent exceptions, but they’re prior consent exception just like the FCC’s opt-in rule. Imagine if it weren’t so. Imagine if the baseline rule was all of our communications could be 

wiretapped unless we found some obscure government website and 

opted out. Right? So this goes exactly to the question that you were 

asking. 

Mr. LEIBOWITZ. But the other thing I just wanted to mention is 

you are talking about sensitive data, and I think we all agree there 

should be protections for sensitive data. That was the FTC’s approach, and we believe that could be the FCC’s approach, but that 

is not the approach they have now, it’s for all data. And keep in 

mind that right now over the top 10 ad sites and 70 percent adselling companies and 70 percent of online advertising revenue, 

much of it driven by rich data collection. It’s not ISPs, it’s everybody else in the Internet ecosystem. And so everyone should be 

under the same—every company should be under the same rules 

to protect the kind of data you want protected. 

Senator NELSON. Well, I’ll get into it later on. But thank you, 

Mr. Chairman. 

131 

But let me just tell you some country boy logic. One person’s sensitive data is not another person’s sensitive data. And so the question here to me is, Should the consumer have the choice of whether 

they want that data shared with the commercial sector? 

The CHAIRMAN. Thank you, Senator Nelson. 

Senator Blunt. 

STATEMENT OF HON. ROY BLUNT, 

U.S. SENATOR FROM MISSOURI 

Senator BLUNT. And following up on that thought, Mr. Leibowitz, 

why would you have two different standards? 

Mr. LEIBOWITZ. Well—— 

Senator BLUNT. Even if you do establish this data, sensitive data 

standard, why would you have one standard for one group of data 

providers and another standard for another group of data providers? 

Mr. LEIBOWITZ. Well, I think you’re absolutely right, and in the 

FTC’s 2012 report, which was widely praised by consumer groups 

and had some praise and some criticism by businesses, we called 

for the same standards to be imposed on all large-platform providers, large-platform providers meaning both ISPs and other collectors of data, if those standards were to be applied at all, because 

we think that’s what’s critical, and technology neutrality, which I 

think is the point that you’re going to. 

Senator BLUNT. It seems to me, Mr. Garfield, that that’s the fundamental debate we ought to be having here, is if we determine the 

issue of sensitive data, why would it only apply in one sector of the 

way we transmit this information? I mean, everything from my 

flashlight on my iPhone, I believe if there is a way to disconnect 

that from the location finder, I don’t know what it is, so if I turn 

on that flashlight, somebody knows where I am, or at least it’s 

been registered in a way that somebody could find out where I was, 

and that kind of data isn’t even considered in this FCC discussion. 

Is that right? 

Mr. GARFIELD. Correct. The FCC’s proposed rules would only 

apply to companies that provide broadband internet access services 

and that are otherwise covered by the Open Internet Order and so 

would not apply to many of the companies that I represent. 

Our advocacy—there are important differences between network 

operators and our companies, but our advocacy today is not suggesting that there shouldn’t be protection, it is actually making the 

point that you’re making, which is we have rules that have been 

working for the last—at least the last 3 decades, and rather than 

rewrite those rules with no foundation, no data to suggest that 

they would help consumers more, less rely on the rules that are 

well established that have been working that have been developed 

by the FTC. 

Senator BLUNT. Mr. Polka, I believe your group of companies, the 

American Cable Association, is largely small and rural cable providers. 

Mr. POLKA. Right. 

Senator BLUNT. What would be discussed here? Does that impact 

the ability of your companies to provide the higher levels of Internet and communication that we think everybody needs to have? 

132 

Mr. POLKA. It would because it adds layers of complexity regarding privacy compliance. And in saying that, I’m not saying at all 

that our members are not strictly committed to protecting the privacy of their customers, it’s just that these rules have a tradeoff 

effect in terms of providing broadband service in smaller markets. 

When you’re talking about small companies in southeast Missouri that I know of, such as BOYCOM Communications or Fidelity 

Communications or SEMO Communications, that have less than a 

couple of thousand subscribers, the FCC would be asking them to 

maintain a strict liability of ensuring privacy protection, which 

even the FTC has said is undoable. It’s impossible to meet that 

standard, not to mention the revision of policies, the revision of 

consents that are asked of consumers who opted out to provide consent for commercial reasons, which they enjoy, now to an opt-in 

over non-sensitive data that would necessitate the addition of legal 

time, consultant time, man-hours. The FCC itself hasn’t even determined the cost-benefit analysis of these rules on smaller operators, let alone larger ISPs, and I think it’s a big issue in terms 

of—— 

Senator BLUNT. And in rural areas, it costs more to add customers—— 

Mr. POLKA. Absolutely. 

Senator BLUNT.—that are further spaced apart, and you’re saying this is just another reason not to make that additional investment to further expand your liability for very little impact on your 

company in a positive way? Is that—— 

Mr. POLKA. What this would cause is a shift of resources from 

investment and deployment into regulatory compliance for smaller 

businesses, and that means less deployment of broadband in smaller markets, rural areas, slower speeds, maybe less capacity. And in 

addition, because of the customer confusion, maybe customer anger 

over consents that they now have to give that they didn’t have to 

give before, more consents, and in such a way, creating, you know, 

fatigue on the part of a consumer to say, ‘‘Well, I just give up. I 

don’t even want the service any longer.’’ We don’t want to see that 

happening in our markets. 

Senator BLUNT. Thank you. 

The CHAIRMAN. Thank you, Senator Blunt. 

Senator Schatz. 

STATEMENT OF HON. BRIAN SCHATZ, 

U.S. SENATOR FROM HAWAII 

Senator SCHATZ. Thank you, Mr. Chairman. 

Professor Ohm, it seems to me that one of the basic questions is, 

what is it that makes an ISP different from another Internet company? And the Title II part is easy, that was sort of pursuant to 

a legal strategy, the Open Internet Order. Set that aside for a moment. Your assertion, and I find it persuasive, is that ISPs occupy 

a unique place in the Internet ecosystem, and especially for people 

in rural areas and actually people in D.C. who have very few 

choices in terms of how they get on the Internet. 

So I want you to talk a little bit about that, and then I want to 

give a chance for Mr. Leibowitz to respond, and then, additionally, 

I want you to respond to Professor Swire’s data point regarding 

133 

encryption because it seems to me that this unique place in the 

ecosystem becomes somewhat less critically essential if you’re talking about 70 percent encryption eventually and going up and up 

and up, which is to say, intuitively, I don’t want to necessarily let 

an ISP have all of my data, and yet if all they know is that I went 

to Facebook, I went to the Star-Advertiser back home, I went to 

Gmail, that I do not find to be, to repeat Mr. Leibowitz’s term, particularly personally sensitive. 

So I want you to address, first of all, what is it that makes an 

ISP special? And how do you respond to the contention that increasing encryption may diminish that argument? 

Mr. OHM. Absolutely, and thank you for the question. There are 

actually two ways to take on the first question. I think they’re both 

consistent with one another. The first is simply the choice point 

again, that if you have an operating system, as Professor Swire 

suggested in his testimony, that is bucking, frankly, their industry 

norms and beginning to build a dossier on you as well. Well, first 

of all, it will have a press outcry when this is revealed; second, you 

have a choice to switch operating systems. It’s even an easier 

choice if it’s your browser that is doing the untoward spying, but 

when it’s your Internet service provider, as you say, for rural 

Americans, for people who live on tribal lands, and for urban dwellers, that’s not really a meaningful choice. 

Second, it goes directly to Senator Blunt’s—— 

Senator SCHATZ. So you’re not necessarily talking about current 

bad behavior, but potential future bad behavior. 

Mr. OHM. Potential future, yes. 

Senator SCHATZ. Fairly. 

Mr. OHM. I strongly believe that we don’t need to wait for Pearl 

Harbors and data out—you know, dead bodies before we decide in 

anticipation to regulate something, right? And I think that’s the decision that was made by this body in 1996. 

Second, it goes to Senator Blunt’s question about, Why have two 

standards? Right? As I said earlier, we have numerous privacy 

standards about online space itself. One reason why not to have 

two standards is because Congress hasn’t gotten around to regulating—— 

Senator SCHATZ. Well, I’ll just interject there and point out that 

if you ask a person whether they think that there should be one 

standard, the assumption of the respondent in the poll is that it 

would be one high standard—— 

Mr. OHM. Right. 

Senator SCHATZ.—not one high standard and one low standard. 

So I don’t find that particularly persuasive at all. 

Mr. OHM. Yes, no, no. And if I can say one more thing agreeing 

with you on that, I have all the respect in the world for Professor 

Swire’s work. You can read his report to say everybody is collecting 

information in ways that consumers don’t know, don’t expect, don’t 

appreciate. Right? And so you could read it, and I think he’s even 

said this, you can even read it as a full-throated defense for more 

privacy law in different sectors. Right? 

Senator SCHATZ. Can I get you to respond to the encryption question and then kick it over to Mr. Leibowitz? 

134 

Mr. OHM. Absolutely, absolutely. So encryption is spreading, but 

as the report from Upturn, which has been widely cited, has said, 

85 percent of the most widely used websites still don’t encrypt. It’s 

a sad fact in 2016. 

The second thing is you were talking about a rather anodyne list 

of websites that you may not care if people know about, but it 

doesn’t require much imagination to come up with the websites we 

might care more about. This person is visiting the NRA website reliably, this person is visiting Planned Parenthood, this person is 

visiting Black Lives Matter related websites. Right? There’s a long 

tail of sensitivity, and sensitivity is often in the eye of the beholder. 

Senator SCHATZ. OK. Go ahead. 

Mr. LEIBOWITZ. So I will yield 30 seconds of my time to Professor 

Swire at the end so that he can talk about why—— 

Senator SCHATZ. That gives you 10 seconds. 

[Laughter.] 

Mr. LEIBOWITZ.—why ISPs are not unique. Then I will only yield 

15 seconds of my time. 

[Laughter.] 

Mr. LEIBOWITZ. But I think the important answer—and I can see 

you’re struggling with this, and I think all of us are struggling with 

this, is you can have similar—rules ought to be technology-neutral 

to the extent that they can, and if you’re going to have a higher 

level of scrutiny—right?—for the things that consumers are concerned about and that they need to be protected about, then it 

should be the kind of sensitive data like health, like financial information, and like information that involves children—right?—which 

is what the FTC did in its role, which Senator Markey was very 

involved in, on the Children’s Online Privacy and Protection Act. 

And so all we are saying from a 21st Century Privacy Coalition 

approach, Privacy Coalition approach, is have the FCC’s rules reflect more of the FTC’s policies, which is enforcement plus restrictions on sensitive data and technology neutrality to the extent that 

you can do it, and then I’ll turn it—— 

Senator SCHATZ. With the Chair’s permission, we’ll go to Professor Swire for just a couple of seconds. 

Mr. SWIRE. I don’t think I have really much to add. 

Senator SCHATZ. OK. Thank you. 

[Laughter.] 

The CHAIRMAN. That is a first in front of this committee. 

[Laughter.] 

The CHAIRMAN. I have Senator Markey up next. 

STATEMENT OF HON. EDWARD MARKEY, 

U.S. SENATOR FROM MASSACHUSETTS 

Senator MARKEY. Thank you, Mr. Chairman, very much. And I 

guess I would argue that where you go online all day long, and 

we’ve learned from recent surveys that adults and children are 

pretty much online all day long, but where you go online all day 

long is as sensitive as your health information. It is as sensitive. 

I mean, that’s the profile of who you are as a human being in the 

United States in 2016. OK? If that information is not considered 

to be sensitive, then all of us have every bit of information being 

gathered about us, about what we’re doing all day long, every sinVerDate Nov 24 2008 10:44 Feb 21, 2017 Jkt 075679 PO 00000 Frm 00138 Fmt 6633 Sfmt 6601 S:\GPO\DOCS\24204.TXT JACKIE
135 

gle day, as being out there and kind of being determined to be not 

sensitive, not sensitive, just kind of a product, just information that 

can be sold to people. And I think that’s what the heart of this 

whole matter is all about. 

So historically, the telephone company was viewed as a company 

that if you got on the phone and you called that department store 

or you called this or you called that place, we had laws that said 

the telephone company can’t sell that information, where you went, 

who you are. Right? And beginning now, with this new FCC regulation that’s been upheld, well, this broadband access is now considered to be a common carrier like a telephone company was, so now 

the FCC has the ability to regulate it. 

And so as you’re looking at the issue again and you’re saying, 

OK, so what should the protections be? What should this common 

carrier be allowed to do with all of this information, which is essentially who we are as people? Now, what that company did that you 

called with your information, that’s one issue, and we have to deal 

with that, but this is a separate issue. What does the telephone 

company do? Because essentially there’s just a telephone company 

and a cable company. You don’t have a choice. If you’re going to 

be online, you have to pick one or the other, and in many places, 

you can just pick one. 

So, Professor Ohm, can you talk a little bit about that transferring over of what the expectations are of ordinary Americans and 

the protection of this profile of who they are as a human being? 

Mr. OHM. There are so many studies, including a particularly 

distressing one about a survey of American authors, that show that 

people hesitate to surf the Web in the way they would like to because they’re worried about where that information may end up. 

Now, it may be that for some of the people, they’re worried about 

the government, and for others, they’re worried about corporations, 

but that chilling effect has been documented and it has a sort of 

deleterious effect and influence on expectations that you’ve been 

describing. 

And the other thing I can tell you is I couldn’t agree more with 

your assessment of all of this information being sensitive. I would 

be so bold as to say it probably could justify a ban on the sort of 

behavior we’re talking about, but that’s not what Congress did in 

1996, and it’s not what the FCC has done in its rule. It’s a very 

measured rule, and I would love to say more about that, but it 

doesn’t go to the extreme—— 

Senator MARKEY. Then say a little bit about that because what 

they’re talking about is giving consumers more power to choose if 

their sensitive information can be used or shared by the ISPs, require the ISPs to adopt ADA security protections and notify consumers if a breach occurs, and promote transparency by mandating 

that the ISPs disclose what they collect about consumers. So what’s 

wrong with that? 

Mr. OHM. Absolutely. It’s a modest set of requirements. It overlaps in significant part with the FTC report of 2012 that Mr. 

Leibowitz has talked about several times. As I hear Mr. Polka’s testimony, and I’m very sympathetic to the idea that small businesses 

need to be accommodated by regulations, I heard him say repeatedly this his companies are responsibly already doing right by their 

136 

consumers when it comes to privacy and security. I’m guessing 

most of them are not selling data en masse to advertisers. This 

rule will have modest effect on them, and if there is something 

that’s disproportionate, then the FCC ought to accommodate that. 

Senator MARKEY. Yes. So this essentially says there’s a bill of 

rights, that is, that each American knows what the rules are going 

in—— 

Mr. OHM. Yes. 

Senator MARKEY.—rather than hoping that the FCC brings a 

case later on saying, ‘‘You know, that was really an unfair and deceptive practice.’’ 

Mr. OHM. Well, and I’m sorry to disagree just a little bit. I wish 

it were more of a bill of rights. This is merely an opportunity for 

a contractual, meaningful contractual, conversation with your ISP, 

but you’re not afforded any rights, right? They can say in some 

meaningful ways, ‘‘The deal we’re offering you is not a very good 

deal, but here’s the deal we’re offering.’’ 

Senator MARKEY. ‘‘Here’s the deal.’’ 

Mr. OHM. Yes. But, again, I totally agree. It’s a modest measured 

approach to privacy on this—— 

Senator MARKEY. There’s kind of an argument here, well, this is 

kind of like a radical departure from what’s been going on for the 

last 20 years, and what you’re saying is it’s not at all. 

Mr. OHM. Yes. 

Senator MARKEY. It’s modest. 

Mr. OHM. Absolutely. 

Senator MARKEY. It’s reasonable. It gives the consumer some 

rights, some sense of expectations about what they can expect, but 

it’s in their relationship with the ISP, with the telephone company 

and cable company, and then they can decide what they want to 

do. 

Mr. OHM. And, quite importantly, they’re having a public NPRM. 

Congress is watching them very closely. They have strong incentives, the agency does, not to do something that’s terribly radical, 

hence the modest approach. 

Senator MARKEY. OK, great. Thank you. 

Thank you, Mr. Chairman. 

The CHAIRMAN. Mr. Leibowitz, did you want in on that? 

Mr. Garfield? 

Mr. GARFIELD. It is far from modest, and that’s—moreover, if you 

are, as Professor Ohm said, going to regulate prospectively, I think 

it’s incumbent upon you to bring forward evidence to suggest that 

the alternative approach that you are going to move forward with 

is one that will actually benefit consumers. 

Mr. LEIBOWITZ. Yes. 

Mr. GARFIELD. And in this NPRM, there is no zero data suggestive of that, and that’s why we think it’s critically important that 

there’s a second NPRM that cabins—reacts to the responses that 

have been given thus far to date, and that gives consumers, as well 

as the public broadly, the opportunity to react to what’s being proposed. 

Mr. LEIBOWITZ. Yes, and I just want to say I do agree that they 

should put out a second draft of this proposal. But having said 

that, going back to your point about the constitutionality, Senator 

137 

Markey, when we were dealing with phones, it was a closed universe of information, as you know. Now we’re dealing with data, 

and when you’re dealing with data and so little of it is collected by 

ISPs and so much of it is collected by others, you have a problem 

under the Central Hudson Test because you are treating different 

entities that do the same thing differently. So that’s the constitutional infirmity. 

I won’t dwell on it much longer, but it’s something that I’m sure 

the FCC is thinking about, and the more that they make their 

rules technology-neutral, I think the higher the decibel level goes 

down, the more—and I think the less they have constitutional infirmities. 

Senator MARKEY. Well, again, I would leave it up to the same 

lawyers at the FCC that were just upheld at the Circuit Court to 

determine what is, in fact, constitutional or not, and so far their 

record has been very good in terms of drawing those lines right 

where they can be upheld. 

The CHAIRMAN. Thank you, Senator Markey. 

Senator Moran. 

STATEMENT OF HON. JERRY MORAN, 

U.S. SENATOR FROM KANSAS 

Senator MORAN. Thank you, Mr. Chairman. 

Mr. Polka, I want to talk again about small business. In fact, I 

was reading the question as written in front of me, and it said we 

want to shield small business from the effects of harmful government regulations. The reality is, as I think about that statement, 

it’s not the business we want to shield from harmful government 

regulation, it’s the consequence that that harmful government regulation has to the consumer—— 

Mr. POLKA. Certainly. 

Senator MORAN.—and that’s particularly true for a state like 

Kansas. You visited with the Senator from Missouri, knew there 

are small companies. That is what dominates in our state. It is also 

a state in which we still struggle to have broadband services, a 

wide array, across our state, and some places have virtually none. 

So one of the things that we’ve thought about doing is to consider 

giving legislative clarification that the FCC has exemption and 

waiver authority to deal with those kinds of issues. And my question is, Do you believe that to be necessary and helpful? And if so, 

I assume you and others would work with us to try to get it right? 

Mr. POLKA. Without question. Companies like Eagle Communications out of Hays, Kansas, that are phenomenal providers of 

broadband service, have worked because our regulatory scheme has 

encouraged smaller businesses working with their consumers to 

flourish to provide these services in their marketplace. But under 

today’s circumstances, it’s becoming increasingly more difficult to 

do the same things. 

We’re here today talking about privacy where, with all due respect to my new friend, Professor Ohm, I wouldn’t say it’s an easy 

transition from one set of rules we’re under to the proposed new 

rules, particularly for smaller providers. But that’s one set of rules 

where we’re talking about the need to shift resources from providing more services to meeting a regulatory compliance burden. 

138 

But at the same time we’re sitting here, there are at least three 

other major rulemakings that are moving forward at the FCC that 

have the same impact, implementation of the Title II Order, the 

FCC’s rulemaking on set-top box reform, and also the FCC’s rulemaking on broadband business data, otherwise known as special 

access. Each of these in their own could have the kind of negative 

effects that we fear that our members would have to suffer by 

shifting resources from deployment to compliance and regulation. 

Now, again, it’s not a situation where our members are at all 

saying, ‘‘We’re not up to doing our duty,’’ but there is a balance 

that you have to reach when you talk about providing the service 

from a commercial perspective as well as protecting the consumers, 

and we’re here to hopefully be part of the answer to that. But certainly any greater understanding by the FCC or requirement for 

the FCC to even look at the impact on smaller businesses would 

be enormously helpful to achieving everything we want to achieve, 

which is more deployment in smaller markets. 

Senator MORAN. Sir, you make a good point. It never seems to 

me that it’s one regulation or one event that causes small business 

to struggle and/or fail, it’s the series of things, it’s death by 1,000 

cuts—— 

Mr. POLKA. That’s correct. 

Senator MORAN.—one more additional burden, and at some point 

in time the proverbial straw broke the camel’s back. 

Let me talk to Mr. Garfield about the cross-border data transfers, 

the EU Privacy Shield negotiations. I’m told it has just been announced that there is an agreement. This agreement is necessary, 

I suppose, because the EU and the U.S. have fundamental differences in the way we look at privacy, ours based upon our Constitution. It’s my understanding that Americans officials advocated 

standards based upon the longstanding FTC guideline for privacy. 

What effect would occur in those negotiations, the resulting agreement, if we now have the FCC regulations, the new standard? 

Mr. GARFIELD. Let me begin by thanking Congress for their role 

in getting the Privacy Shield passed. The passage of the Judicial 

Redress Act was critically important in getting that done. To answer your question, I think it would add a layer of confusion that 

would be unhelpful, and so the Privacy Shield recognizes that there 

is some distinction between the privacy regime in the U.S. and the 

security regime in the U.S. and Europe, but that they’re essentially 

equivalent, and that’s a recognition that the FTC’s framework and 

principles are well established. It would be highly ironic and certainly unhelpful if, because of another regulatory agency, that 

agreement that has just been put in place would be called in question because we’re now questioning whether the privacy regime in 

the U.S. is one that’s workable. 

Senator MORAN. Mr. Leibowitz, anything you want to add to 

that? 

Mr. LEIBOWITZ. No. I absolutely agree that the Commerce Department and others are relying on the FTC approach, and if it’s 

being questioned it’s not strong enough, I think that it does not potentially bode well as the Privacy Shield goes through the European Union vote. 

139 

Mr. GARFIELD. If I may just add one other thing that makes it 

particularly relevant, is that though the Privacy Shield has been 

passed, our expectation is that it will continue to get challenged in 

Europe, including in the courts, and so the actions that are taken 

here will certainly have impact, not only in Europe, but in other 

markets around the world. 

Senator MORAN. Thank you. 

Thank you, Mr. Chairman. 

The CHAIRMAN. Thank you, Senator Moran. 

Senator Klobuchar. 

STATEMENT OF HON. AMY KLOBUCHAR, 

U.S. SENATOR FROM MINNESOTA 

Senator KLOBUCHAR. Thank you very much, Mr. Chairman. 

Thank you. I’ve been going back and forth to a FOIA hearing in 

Judiciary in the same area of information and issues, so I want to 

thank you for this important hearing and all of you for coming 

today. 

I’ve been very involved in the broadband issue and, as has the 

Chairman especially in the rural areas, trying to get broadband 

out. We have many problems with a lot of our businesses, small 

businesses, farmers having to go to McDonald’s parking lots to get 

any kind of access. So this privacy concern with broadband is incredibly important, but to some of them may be a luxury because 

they can’t even get the access yet. But for most people who have 

access, this is an issue. 

Senator Hoeven and I actually have worked hard to include the 

Driver Privacy Act, it’s part of the FAST Act that was passed, to 

put in some privacy protections for data collected in cars. I’m not 

going to focus on that as much today. 

I guess I would start with you, Mr. Leibowitz, about data 

breaches continuing to jeopardize the security of consumers’ personal information. Data breaches can have, as we know, long-term 

financial consequences for consumers. How should we determine, 

Mr. Leibowitz, what kind of threat should lead to a consumer being 

notified of a data breach? We certainly had this issue with Target, 

my hometown company, and others. How do we ensure that consumers receive data breach information that’s useful to them? 

Mr. LEIBOWITZ. Well, I think that you have to have a harm trigger because—and, of course, in the example of Target and many of 

the 50 data breach cases that the FTC has brought, it involved 

harm. But the FCC’s approach for data breach doesn’t have a harm 

trigger at all. So our concern is under the approach they have, 

there would be massive overnotification to consumers, and consumers would become—would see so many notifications, and this 

is a problem in other disciplines as well that the FTC has commented on, that they won’t look at the real notification that they 

need to because they’ll be swamped with other notifications that 

don’t really have meaning. 

The other thing, less important because it’s not consumer related, but important nevertheless, is that a sort of a no harm approach for the ISPs is in some contrast with the cybersecurity 

framework that NIST has prepared, which is really about protecting critical information. 

140 

Senator KLOBUCHAR. I see. I get it. And you also argue about the 

FCC proposal to prohibit Internet service providers from allowing 

companies to pay for extra privacy protections, and you state that 

many of us may decide that the price to pay to avoid personalized 

marketing is worthwhile. Of course, not all consumers have the financial means to make that decision. How would you answer the 

criticism that allowing consumers to pay for privacy will result in 

weaker privacy protections for low-income consumers? 

Mr. LEIBOWITZ. Well, it’s not certain. I mean, it’s a reasonable 

question to be raised, but it’s not certain what ISPs would do if 

this—and this is an actual prohibition, as Professor Ohm knows, if 

this—or this would be, if they were allowed discounts. It may just 

be collecting data and using it with your similarly branded affiliates. 

These are not—ISPs are not data brokers. No one, I think, would 

ever propose something like that. And so I think the approach 

should be give consumers real informed notice so they know what 

they’re being offered, if they’re being offered a discount, and let 

them make the decision. And if I’m a family of four making $35,000 

a year and living in Minnesota, and I want, you know—I want 

home security service or I want music streaming or I want energy 

efficiency, I should have the right or the ability to make that determination. The FCC’s approach in that area, at least, seems to me 

very top-down and command-and-control. 

Senator KLOBUCHAR. OK. Mr. Ohm, maybe you want to respond 

to that? And do you think FCC regulation of broadband privacy can 

complement the FTC’s privacy work? 

Mr. OHM. Yes, thank you for both those questions. Number one, 

when it comes to pay for privacy, as it’s colloquially called, it does 

really give me a lot of pause, the idea that we’ve already talked a 

lot during this hearing about the paucity of choice that you have 

for a broadband provider, the idea that the only broadband service 

you could possibly have is one where you have to pay extra if you 

want the privacy version of it, is distressing to me and it’s something that I hope the FCC will strongly consider dealing with. 

It speaks to, I think, a broader undercurrent in this debate. I 

don’t have a lot of time, so let me say it briefly, which is, a lot of 

the arguments and criticism has come from the perspective of the 

well-paid D.C. lawyer. For example, a statistic that’s used often is 

the average American has 6.1 devices and three ISPs. Well, that 

may be true for the average American, but it’s not true for a lot 

of Americans, and, in fact, a Pew study shows that a lot of Americans who have one device and one ISP are disproportionately 

younger, they’re poorer, and they’re also representative of racial 

and ethnic minority groups. 

So as we think about the policy questions, I want to make sure 

we’re thinking about all Americans, not just the well-to-do. 

Second, if you could repeat the same question, if I have time to 

answer this. 

Senator KLOBUCHAR. Go ahead, yes. It looks like Mr. Leibowitz 

might want to respond. 

Mr. LEIBOWITZ. That might be a point of privilege. But, look, I 

spent—as you know, I spent most of my career in public service, 

and, look, don’t take my word for the concerns about the FCC’s 

141 

rule, just look at the FTC’s unanimous comment where it says 

some of the choices made by the FCC are not optimal, and it cites 

28 different instances where they’re in disagreement, in polite, diplomatic language. Don’t take my word for it, don’t take an academic’s word for it, we’re all—I think we are all articulate witnesses, I may be the one exception, but, you know, look at what 

the FTC thinks they have done—thank you—they have done—the 

FTC has been the Nation’s leading privacy agency for the last 30 

years, they’re informed, they know what they’re talking about. I 

would listen to them as well and perhaps more than all of us together. 

Mr. OHM. I think I’m out of time, but I invite the opportunity to 

talk about the FTC. I would love to do that. 

Senator KLOBUCHAR. Well, I guess that’s open for my colleagues 

to ask you, and maybe I’ll follow up with some of this in writing, 

including with you, Mr. Garfield. 

Mr. OHM. I appreciate it. 

Senator KLOBUCHAR. So thank you very much. 

Mr. OHM. Thank you. 

The CHAIRMAN. Thank you, Senator Klobuchar. 

Senator Daines. 

STATEMENT OF HON. STEVE DAINES, 

U.S. SENATOR FROM MONTANA 

Senator DAINES. Thank you, Mr. Chairman. 

Mr. Polka, I appreciate you highlighting in your testimony the 

burden that these privacy rules will place on small businesses. In 

a state like Montana, population and geography pose tremendous 

challenges for small ISPs. I think about Blackfoot Communications. 

They’re the sole provider for Elliston, Montana, population 225. Do 

small carriers even have the technical capability to engage in the 

conduct the FCC is trying to prevent? And if they do, do they have 

any incentive to do so? 

Mr. POLKA. Not really, Senator. The situation you talked about 

is typical, the company you referred to is typical. I’ve been inside 

the network operation centers, if you want to call them that, a 

small room in a head-end for a smaller provider, and they may 

have a board and a diagram up there, and that diagram has either 

a red signal or a green signal. Green means the network is operating. Red means there’s a problem they have to fix. That’s about 

the level that our members are looking at to make sure that they’re 

able to provide broadband service to their customers. 

The fact of the matter is, is that our members, the smaller providers, as I’ve said before, are in the business of trying to deliver 

that network service to their customer for the customer to then use 

as the customer sees fit. And typically our members have not been 

engaged, even under today’s rules, in the kinds of information 

gathering that would require opt-in consent by a consumer. 

Senator DAINES. Let me—I want to continue this discussion, and 

I think there has been talk about some of the inconsistency perhaps. I’m just—I’m concerned about as these regulatory bodies try 

to move at the speed of government when the world is moving the 

speed of business, how we’re just always playing catch-up, and as 

142 

Wayne Gretzky famously said, ‘‘Skate to where the puck is headed, 

not where it’s at.’’ 

When I send an e-mail, I add a Snapchat perhaps to a story, 

there are a number of entities collecting data. Snapchat is my 

browser, the ISP, they all have access. 

Mr. Leibowitz, the question is, Do you think consumers expect 

that all entities involved in sending an e-mail, snapping a photo, 

are held to the same privacy standards, and does it make sense to 

treat any one of these actors different than the other? 

Mr. LEIBOWITZ. No. I think from the perspective of the 21st Century Privacy Coalition, and I think from the perspective of the consumers themselves, you want the same rules applying across the 

board. 

Senator DAINES. So I was struck—I think, Mr. Leibowitz, you 

made a comment I think in the back-and-forth with regard to online ad marketing. Ten companies hold 70 percent of the market 

share, none of them are ISPs. 

Mr. LEIBOWITZ. That’s correct. 

Senator DAINES. In looking at the cross-context chart in Professor Swire’s report, it’s astonishing how much consumer information in the ad space, the social network space, have compared to 

the ISPs. I mean, look at our phones. And, by the way, if you want 

to see the behaviors, watch members during a hearing, where are 

they at? They’re camped out and probably oftentimes on apps even 

more so than surfing. And I think when you look at where young 

people are headed now, where, you know, there’s now more daily 

Snapchat users than Twitter users here, it just crossed in the last 

30 days. I mean, just profound quick shifts here, where they’re not 

out there surfing, they’re camped out on apps oftentimes. I realize 

the FCC does not have jurisdiction over the entire Internet ecosystem, but does it make any sense to have very prescriptive rigid 

rules for ISPs and more flexible rules for edge providers and apps 

when ISPs only see a fraction of what the edge providers see? 

Mr. LEIBOWITZ. No, it doesn’t, and I agree with you entirely. And 

it goes to another point as well, which is the constitutional question, because when you are treating the same information differently, you—it raises concerns under the seminal Central Hudson 

Test, which is a Supreme Court case from 1980. 

Senator DAINES. So, again, this is a concern where I think 

they’re chasing the ISP issue right now, but look to where are consumers increasingly headed more so? 

Mr. LEIBOWITZ. Yes, I agree with you, and the only other thing 

I would add is if you want to protect consumer privacy, which is 

critically important, and because the ISP—because the FCC invoked Title II, they took away jurisdiction from the FTC. The FTC 

has no jurisdiction over common carriers. ISPs are now designated 

common carriers and upheld under the D.C. Circuit decision, may 

be appealed. Because of that, they have to do a rule, but they 

should do an intelligent rule that is free from mistakes. We don’t 

think their rule is balanced. 

Senator DAINES. So let me get a point the FCC made, and this 

is my last question. In the FCC’s Notice of Proposed Rulemaking, 

it offered a justification for its approach, and it stated, and I quote, 

ISPs are the most extensive conduits of consumer information and 

143 

have access to very sensitive and very personal information, end 

quote. 

Professor Swire, does your research find this statement to be 

true? 

Mr. SWIRE. It depends on the word ‘‘conduit.’’ If they’re the only 

conduits, then they’ll be the most extensive conduit. So it might be 

a finely crafted sentence that you could technically say is true. 

Senator DAINES. So are ISPs the most extensive conduits of consumer information with access to highly sensitive information? 

Mr. SWIRE. They have access to location data, which is considered sensitive information, but overall, the point of our research is 

that there is a lot of other folks who also see it, and so—look, ISPs 

do see a bunch of information, so do a lot of the other companies 

you were talking about, and this committee and everyone has to 

figure out overall how we’re going to handle that. 

Senator DAINES. OK. Thank you. 

The CHAIRMAN. Thank you, Senator Daines. 

Senator Gardner. 

STATEMENT OF HON. CORY GARDNER, 

U.S. SENATOR FROM COLORADO 

Senator GARDNER. Thank you, Mr. Chairman. And thank you to 

the witnesses for being here today. 

Mr. Polka, why don’t I start with you a little bit? This committee, 

if you look around at the composition of the Committee, it’s a very 

rural committee, many members come from states that have the 

very, very sparse populated areas, at least in part, if not whole, of 

the state. I live in a little tiny town in the eastern plains, about 

3,000 people. The nearest big city is a town that’s 60 miles away, 

and it’s 10,000 people, and then you have to go another 60 miles 

after that to get to a town that may be 100,000 people. So these 

areas are very, very spread out, very rural. And, if Senator 

Klobuchar was here, I would say that having a McDonald’s is a 

luxury. 

[Laughter.] 

Senator GARDNER. That’s something that many of our small 

towns, we don’t have. But we talk about a lot of regulations here 

in Washington that have opt-outs and provisions, and then to say, 

you know what, we’re going to pass this rule, but we understand 

there are small businesses that would be overly adversely impacted 

by this, and so we’re going to give an opt-out for this. Look at the 

CFPB, I know there are conversations about whether community 

banks and credit unions ought to be tailored, regulations tailored, 

under CFPB, the regulations under Dodd-Frank, to address smaller 

banks and financial services. Here we are talking about, well, a 

new rule that would opt out for smaller providers, but it just seems 

like that opt-out never happens, the regulations pile on, and then 

you end up with higher costs and less service in many areas. So 

how many of these companies you’re talking about have full-time 

regulatory compliance officers? 

Mr. POLKA. Very few. As I said in my statement, most of our 

member companies have about 10 employees. Maybe they have one 

or one and a half technical people that are out actually putting 

service into the home or maybe climbing a pole or doing a service 

144 

call or maybe fine-tuning things in the head-end, so to speak, 

where all the signals come in. But it’s very, very difficult. That 

being said, our members, over the last couple of decades, have 

worked to comply with Section 631, the Cable Privacy Rule, Section 

222, for phone service of the CPNI rules, and they have worked to 

develop policies that have been open and that have been—provided 

disclosure to their customers. And they have worked to protect the 

sensitive data of their customers, whether, as Mr. Leibowitz was 

saying, whether it’s banking information, school information, 

health care information, et cetera. 

But to do what the FCC is requiring, would require under this 

rule, would go to a level of complexity that when we talk about 

shifting resources would be enormous in terms of legal time to revise policies, to revise notices, to send out notices that consumers 

aren’t expecting, to comply with higher standards of data security, 

which, as the FTC has said, is impossible to meet. 

Senator GARDNER. So take away time from expansion, investment, upgrades—— 

Mr. POLKA. Without question, and without even an idea yet from 

the FCC how much time, man-hours, paperwork, or cost it would 

take. And, frankly, from a small business perspective, I would have 

hoped that the FCC might have done a little bit of homework in 

that area before implementing these rules or moving forward because, in our view, there is none, and it’s not my word, it’s the 

Small Business Administration’s Office of Advocacy that said these 

would be overly burdensome for smaller ISPs. That’s a fear and a 

threat that our members face. 

Senator GARDNER. Thanks. Mr. Garfield, you spent a good deal 

of your testimony arguing about the FCC’s approach to privacy 

being both inconsistent with consumer expectations and inconsistent with existing privacy regulations at the Federal Trade Commission, FTC. I’ve supported numerous pro-privacy initiatives during my time in Congress, and I want to ensure my constituents 

that—I want to ensure their private information is protected. But 

do you believe the inconsistencies you mentioned could actually undermine consumer privacy protections? And if so, how might negative consumer reaction to concerns with their personal privacy impact your member companies’ businesses? 

Mr. GARFIELD. I made the point—thank you for the question, 

Senator Gardner—in my testimony that privacy and security are 

first principles for our companies, and so any rule or regulation 

that undermines our ability to advance both is highly problematic. 

Connecting your second to your first, I think this proceeding of 

the FCC is actually an opportunity, it’s an opportunity to do something that is not a framework based on exemptions for small business or exemptions generally, but to build on things that have 

worked in protecting consumer privacy and to call on the well-established history that has been built by the FTC. And so it’s incredibly important, and I want to ensure, and I think our companies in general want to ensure, that we don’t miss the opportunity 

to protect consumer privacy in a way that’s workable. 

Senator GARDNER. Thank you, Mr. Chairman. 

The CHAIRMAN. Thank you, Senator Gardner. 

Senator Heller. 

145 

STATEMENT OF HON. DEAN HELLER, 

U.S. SENATOR FROM NEVADA 

Senator HELLER. Mr. Chairman, thank you. 

And I’m another rural advocate over here, so I’ll probably go 

down the same line as the previous comments. But, frankly, anything that you really want to ask has probably been discussed here 

at one point or another. And I want to thank all of our witnesses 

for being here, for your comments, for your insight, because it has 

been very helpful. 

You know, we do have an answer to all this, and we actually saw 

this in this committee. We’ve already passed out the FCC Reform 

Act. The purpose of the FCC Reform Act was to make sure that the 

Commission, the FCC Commission, operates in a transparent and 

effective manner. And this FCC Act had two important principles, 

and one was that there would be a conducted cost-benefit analysis, 

and we’ve discussed that, and the Commission should demonstrate 

a market failure. And in neither of these cases can I tell by any 

discussion that we’ve had today that either of these have been the 

case. 

Even the Chairman, even the Chairman of the FCC, last year 

came in front of this committee and stated that consumers deserve 

a uniform expectation of privacy, in front of this committee he said 

that, and that the FCC will not be regulating the edge providers 

differently from Internet service providers. This is what the FCC 

Chairman said. So in March, there was a vote, a 3-to-2 vote, to 

switch that position. I’m wondering if there is anybody here on this 

committee, Mr. Leibowitz, perhaps yourself, that would tell me 

what has happened, what’s the change of heart, for the FCC to say 

exactly the opposite of what they’re doing today a year ago? 

Now, it doesn’t surprise me that the FCC changes or, for that 

matter, Mr. Wheeler changes his mind because he changes his 

mind on everything. I mean, we have seen this consistently over 

and over and over again, that the Chairman of this particular Commission changes his mind. Can someone tell me, what has changed 

in the last year when this Chairman came, the FCC Chairman, 

Wheeler, came in front of this committee and said that the consumers deserve a uniform expectation of privacy? Why has all this 

changed? 

Mr. LEIBOWITZ. Well, I mean, I can’t tell you why. I’m a former 

FTC Chairman, I’m not an FCC Commissioner—— 

Senator HELLER. But he was agreeing with you. He was agreeing 

with you a year ago. 

Mr. LEIBOWITZ. And in fairness to Chairman Wheeler, you know, 

they could modify their rule to make it look more like the FTC approach, that would be what the 21st Century Privacy Coalition 

would encourage them to do. But I do hear you. 

And I guess I would make one other point for those who have 

watched the FTC. At the FTC, we didn’t always have unanimity, 

but we always strived to have it, and on important votes involving 

rulemakings, involving major cases, we would typically end up with 

unanimity or a supermajority, bipartisan supermajority, and I 

think that makes rules much more enduring. 

Senator HELLER. I agree. 

146 

Mr. LEIBOWITZ. And you know this, when you have a bipartisan 

coalition, and all of you on this panel sitting here have put them 

together, it makes the rules more legitimate, it makes your bills 

more legitimate, your legislation, and it helps them last longer. 

Senator HELLER. Well, I would just argue that transparency is 

the difference between the FTC and the FCC. That is the difference, is the transparency, and I think that’s the reason, the most 

important reason, why we pushed this FCC Reform Act, Process 

Reform Act, is to make sure that we get this transparency into the 

FCC. 

I just want to touch on one other point before my time runs out, 

and that is the Small Business Administration, their advocacy office came out with concerns about this particular proposal, and, 

Mr. Polka, I would like you to respond, but they were knowing that 

the costs would include consulting fees, attorneys fees, hiring and 

training in-house privacy personnel, consumer notification costs, 

and probably opportunity costs, if you want to do the economics behind that also. These are the costs. So the question is, one, there 

hasn’t been a cost-benefits analysis because the FCC does not believe in a cost-benefits analysis. But, two, do you believe that the 

FCC has considered the economic harm to small providers like 

those in my state of Nevada? 

Mr. POLKA. And not to mention what you said, but also risk management assessments, which smaller providers don’t do today, 

which would take significant legal and consultant times as well as 

other items. 

I do not believe that the specific concerns of smaller companies 

and the economic impact has been considered. And we were very 

pleased to see that the SBA noted that from the Office of Advocacy. 

Frankly, the rules relating to the FCC and implementation of a 

rulemaking does require it, to do at least some sort of analysis 

about the impact on smaller businesses. The FCC in its rulemaking 

has asked questions about the impact on smaller business, but to 

our knowledge, no type of cost-benefit analysis, and as I said before, no estimation of man-hours, paperwork hours, et cetera. And 

when we look at other opportunity costs that would be shifted, one 

of the things that the FCC would require us to a point would be 

a senior privacy officer, senior data security officer, someone who 

has that title within our company. As I said before, when you have 

10 or fewer employees, I think we’re going to be looking around the 

office to say, ‘‘Do you want it?’’ because it’s going to be hard to fill. 

Mr. SWIRE. Can I just very briefly, as a point of information, 

under HIPAA, there’s a whole part of the HIPAA rule called 

‘‘scalability,’’ which is the Mayo Clinic has to be super strict and 

big, but two doctors in a little office have a different level of privacy and cybersecurity, and it may be, and I don’t think this was 

fully fleshed out in the FCC’s proposed rule, that there could be 

some learning done from 15 years of experience there and how to 

handle small versus large organizations. 

Mr. POLKA. And that’s consistent with what the FTC has done 

over the years as well, to take size into account. 

Senator HELLER. Thank you. I want to thank all of the witnesses. 

Mr. Chairman, thank you. 

147 

The CHAIRMAN. Thank you, Senator Heller. 

Senator Blumenthal. 

STATEMENT OF HON. RICHARD BLUMENTHAL, 

U.S. SENATOR FROM CONNECTICUT 

Senator BLUMENTHAL. Thanks, Mr. Chairman. 

Mr. Leibowitz, you mentioned in your testimony how ISPs want 

to enter the online advertising market, not really a new phenomenon. You and I probably both recall, although you may not because it may have been just a minor blip on your radar, but in 

2008, Charter Communications announced plans to launch a pilot 

program in Newtown, Connecticut, that would target advertising to 

subscribers based on their Internet traffic through an invasive 

technique called deep-packet inspection. 

I was Attorney General at the time. I sent a letter to Charter 

with serious concerns about the legal and privacy implications, and 

fortunately in this case, Charter reversed course, abandoned the 

plan, and there was also, parenthetically I should mention, a public 

outcry from consumers, consumer advocates, and lawmakers, including none other than Congressman Edward Markey, of the great 

state of Massachusetts, although he may not remember it either 

because it was probably a minor blip on his radar of many accomplishments in the area of consumer protection. 

So what I guess I’m asking you and Mr. Ohm is, is what the 

ISPs are trying to do today different from what they were trying 

to do in 2008? In what ways has the technology for tracking a subscriber’s browsing history and deep-packet inspection, DPI, grown 

more sophisticated and potentially more intrusive on consumer privacy since 2008 when Charter tried to do it in Connecticut? 

Mr. OHM. So I welcome the question. It actually wasn’t a blip on 

my radar. I wrote I think the only extended Law Review article 

analyzing the work of your office and others, in which I came down 

pretty hard on ISPs for the moves that they were making. 

The Swire report does establish that deep-packet inspection will 

not work to the same level of efficacy as it has in the past with 

encrypted communications, but it’s again important to underscore 

that there are a lot of communications that remain unencrypted, 

and deep-packet inspection remains a problem that looms large on 

the horizon, and, in fact, today there is a rich ecosystem of vendors 

just chomping at the bit to sell deep-packet inspection systems to 

ISPs. 

The second thing I would say is there was a time in the not so 

distant past, in fact, 2008, 2009, where because of the relative processing speeds of computers versus the speeds of these fiber optic 

cables, it was really hard to do surveillance on everybody all at 

once. That curve has completely flipped, and today a company that 

really does want to compile a dossier about every single one of 

their customers, even one with relatively constrained resources, 

like a small ISP, can absolutely off the shelf buy the technology to 

do something like that. 

Senator BLUMENTHAL. Mr. Leibowitz, I would ask you the same 

question also about perhaps the ISPs you represent voluntarily 

committing to refrain from using deep-packet inspection. 

148 

Mr. LEIBOWITZ. So I think that’s a great question, and we had 

discussions, and you were involved, and very successful, I think, 

enforcement advocacy and jawboning, and the DPI never got off the 

ground. 

We addressed this issue in our 2012 FTC Privacy Report because 

we thought that all large-platform providers, that is, companies 

that collect data, including ISPs, shouldn’t collect sensitive information, so health information, financial information, kids’ information, and we talked about deep-packet inspection. And, in fact, in 

2012, ISPs—two ISPs committed, and I’ll get you this, and it is in 

our Privacy Report, two ISPs committed to not using deep-packet 

inspection without advanced opt-in consent. So we thought that 

was really important to follow up on your work, and because we 

had concerns about it at the FTC, as a commission. 

So I think I would have to go back to our companies, but I think 

if what’s on the table is a prohibition on deep-packet inspection, 

that would be great to know from the FCC, and a second iteration 

of their draft, if they went in that direction, I think would be tremendously meaningful. 

Senator BLUMENTHAL. Thank you. Well, I would very much like 

to work with you on this issue, and as the FTC Chairman, you certainly helped to make the FTC the primary champion of privacy in 

the Federal Government, so I think your leadership then and now 

is profoundly important. Thank you. 

Mr. GARFIELD. If I may just add, your question speaks to the importance of having an approach and a paradigm that has some 

flexibility to it, which is part of the problem with the FCC’s approach, is that it’s very much based on rigid, mandatory, mechanical approach, unlike the approach the FTC has taken and that 

NIST is taking when it relates to privacy and cybersecurity. 

Mr. SWIRE. Very briefly on deep-packet inspection. So three 

points. This first is, as Professor Ohm said, there is some good 

news here, which is where there is encryption, DPI doesn’t work. 

So some things have gotten better in life, even though we don’t 

usually notice that. 

The second point is that deep-packet inspection has been used by 

ISPs for cybersecurity purposes to look for signatures in malware, 

and so whatever your views are on marketing, there are some 

cybersecurity things to take into consideration about that. 

And the third and related point is there’s comments by a group 

of network researchers trying to improve overall network performance who have said that having a research exception so that it can 

really analyze the data has some public benefits. So an across-theboard ban might run into cybersecurity and research problems, so 

there should be some nuance as people consider that. 

Senator BLUMENTHAL. Thank you. 

The CHAIRMAN. Thank you, Senator Blumenthal. 

Senator Markey, do you have other questions? 

Senator MARKEY. May I, Mr. Chairman? 

The CHAIRMAN. Yes. 

Senator MARKEY. Thank you. Tell me, Professor Ohm, if you 

could, how you view this issue of what information can ISPs collect 

about consumers, and how can that information be used to paint 

a detailed picture of their lives? 

149 

Mr. OHM. I like when I talk to my students about this, I like to 

ask them to imagine, if they will, a stream of information just 

streaming behind you, always connected to you, that in a very detailed way really does kind of amount to the sum and substance 

of who you are. I think you actually said this earlier in the hearing, 

right? This is detailed, this is persistent, and it’s very, very, very 

difficult to escape this, right? 

Senator MARKEY. So if a mother is searching for information 

about her 13-year-old daughter’s anorexia—— 

Mr. OHM. Yes. 

Senator MARKEY.—the ISP has that information. 

Mr. OHM. Absolutely, and—— 

Senator MARKEY. And so does the website that she went to—— 

Mr. OHM. Of course. 

Senator MARKEY.—but the ISP has the information as well. 

Mr. OHM. That’s right, and it speaks to proposals that some have 

suggested that the FCC just make this about what is sensitive or 

not, right? But that is getting at this problem the wrong way. I 

mean, it’s better to categorically say that this is intrinsically who 

you are, and, in fact, whether something is sensitive or not really 

might vary minute to minute, second to second. 

Senator MARKEY. So if the mother or the daughter, the 13-yearold, went to a religious website, the ISP has that information. 

Mr. OHM. Right. 

Senator MARKEY. Now, the daughter or the mother, they know 

that they went to the religious website, so they know what they’re 

doing. 

Mr. OHM. Right. 

Senator MARKEY. Now, the ISP has it as well. 

Mr. OHM. That’s right. That’s right. 

Senator MARKEY. Is that sensitive? 

Mr. OHM. Absolutely. Not just that they visited it once, but precisely to the second when they visited it, how much information 

they downloaded from it, perhaps if it’s not encrypted, exactly what 

sub-page they were looking at, what specific affliction or what specific religious question they were interrogating the website about, 

and I think, as importantly, how many times they revisit it, when 

they revisit it, and the name of the game here in a big data world 

is to correlate that with everything else in your life. 

Senator MARKEY. So how about if I need a loan and I’ve gone to 

one of those websites? 

Mr. OHM. Absolutely. 

Senator MARKEY. I know I’m going to that website, I need a loan, 

but the ISP knows it as well. 

Mr. OHM. And contrast this with 1996, when we were focused a 

little bit more on telephone numbers, right? There was a tiny bit 

of comfort from a privacy point of view in not knowing exactly what 

you did when you called a particular number, and, in fact, examples have been made, people call weather lines and they call for the 

lottery numbers. On the Web, often the domain name will reveal 

exactly what you are doing. In fact, I’ve sometimes described it as 

a machine that preserves the very last thought that you had in 

your head. So that’s what’s being logged. 

150 

Senator MARKEY. So how can ISPs use the information in a way 

that could harm the consumer? 

Mr. OHM. Yes, I mean, you know, the FTC itself has documented 

in their Big Data report that they would like to sell this information to data brokers, and just to be clear, that’s not what the FTC 

said about ISPs, but I’m talking about the advertising ecosystem 

more generally, and they would like to categorize you, and, you 

know, it might just be for marketing purposes. It might be that 

you’re the kind of person who is more likely to be interested in this 

product because of the things that you’ve been reading lately. 

Senator MARKEY. And so how would the FCC’s rules protect that 

personal information that I just outlined amongst thousands of 

other potential examples? 

Mr. OHM. Yes. In my mind, the most important, I would say, feature of the rule is the fact that in an opt-in world, you have the 

comfort of not having to think about this, that if you’re someone 

who is worried about this in any way, your choice by default is not 

to be tracked or for the information not to be used in this way. On 

the other hand, if you’re someone looking for a deal with your ISP, 

your ISP has ample opportunity to sell that service to you, and you 

can opt in to the tracking—— 

Senator MARKEY. In other words, the ISP says, ‘‘Please give us 

the right to sell all of your private information.’’ 

Mr. OHM. Yes. 

Senator MARKEY. You have the right to give them the permission. 

Mr. OHM. Absolutely. Like I said, there’s no ban here. And, in 

fact, I think ISPs are probably going to be successful convincing 

some consumers to undergo programs like this, but for the rest of 

the people, again, it’s the comfort of the bright line, it’s the ability 

to live under the default rule, which protects the expectation that 

a lot of consumers have and to address the fears that a lot of—— 

Senator MARKEY. And I find that in general as kind of a rule, 

there are some people, they have some disease, you know, they’re 

telling everyone about it. 

Mr. OHM. Right. 

Senator MARKEY. OK? 

Mr. OHM. Yes. 

Senator MARKEY. And there’s an equal number of people going, 

’’I’m not telling anybody about this. If you tell anyone I have this 

disease, I’m going to kill you.‘‘ Right? 

Mr. OHM. Right. 

Senator MARKEY. So you should have that right, you know, just 

to say, you know, if you want to brag about it, you know, then you 

go and do it, but if you want to keep it a complete secret, you 

should be able to do so as well, and this is the option that the FCC 

is giving to people. 

Mr. OHM. I think it’s not inaccurate at the end of the day to boil 

down this rulemaking as, how can we best give the opportunity for 

consumer choice, respect that consumer choice, and at the same 

time allow ISPs to engage in innovative and competitive economics? 

Mr. GARFIELD. Professor Ohm, what you’ve eloquently argued for 

in your writing and today is a reworking of the privacy framework 

151 

in the United States, and what I would humbly suggest is that the 

appropriate place for that discussion to occur is in Congress and 

not in an agency. 

Mr. OHM. And I would just submit that I think that debate was 

had at least in part in 1996, when this Section 222 was enacted, 

and, frankly, I think it’s continuing to happen. The House had a 

hearing on this last month. The Senate has a hearing today. There 

is ample opportunity to amend the statute if that’s the will of this 

body, but the law on the books is clear and unambiguous. 

Senator MARKEY. I guess the way I would view it is you put 

HIPAA on the books, you put FERPA on the books—— 

Mr. OHM. So there, well, the law is there for the FCC to act 

under. 

Senator MARKEY. They’re there as a section of the law, and 

they’re acting under that section of law, so it’s not a rewriting of 

the laws, it’s an interpretation of the law reflecting the change in 

technology, but not a change in the authority under which they are 

operating. 

Mr. OHM. And Mr. Garfield is right, it’s a distinctly American 

phenomenon that we do not have a lot of privacy laws. This body 

has been very deliberate about identifying those opportunities, 

those moments, those industries, those contexts where specific law 

is needed, and it did so when it comes to telecommunications providers. 

Senator MARKEY. And common carriers have always been. 

Mr. OHM. Absolutely. 

Senator MARKEY. Since 1934 in this special category. 

Mr. OHM. That’s right. 

Mr. GARFIELD. It is true that the U.S. approach is distinct, but 

the U.S. approach is not deficient, and so we shouldn’t confuse 

those two things. Even in Europe, which is viewed as heightened 

privacy protection, is based on the same FIPs framework that the 

United States is, and the Privacy Shield that was just advanced is 

a reflection of the rough equivalence of the approaches that are 

taken here in the United States and Europe. So to suggest that 

just because the U.S. is different in fact means it’s distinct is 

counterfactual. 

Senator MARKEY. Thank you. 

Thank you, Mr. Chairman. 

The CHAIRMAN. Thank you. 

Mr. Leibowitz, do you have anything to add on that? 

Mr. LEIBOWITZ. No. I mean, I think yours is a principal position, 

Senator Markey, as it always is, but, you know, the vast majority 

of data collection online is by non-ISPs, and we had a term for 

them at the FTC, for all collectors of data, we called them 

‘‘cyberazzi.’’ And the better approach to take, from my perspective, 

and again we can disagree, and from the 21st Century Privacy Coalition’s perspective, is try to keep your approach technology-neutral, and when you can’t, try as much as possible to adopt the FTC 

approach, which you’ve been supportive of and which has been tested for many years and deemed reasonably successful. 

Senator MARKEY. And again, I think that, while I agree with you 

on all these social media sites in terms of the protections which 

should be there, the ISP has a special relationship, it’s the only 

152 

way you can get online. You don’t have a choice. You know? If you 

want to reach 1 million websites, you’ve got to go through one company, and so that’s a special relationship. They’re gathering everything. And so that’s separate from an individual decision which a 

consumer is making to go to that social website or that one or that 

one. And so I just think there is a distinction that exists because 

they control the conduit. The content-conduit divide is quite profound, and that’s why this industry, this conduit industry, which 

is the ISPs, but it was the telephone company as we were growing 

up, was always under this special regime because everyone had to 

go through the same company. 

The CHAIRMAN. So, Mr. Leibowitz, is there any reason to think 

that consumers under the FCC proposal, having been given some 

greater control about how broadband providers use their information, may feel a false sense of security that other online entities are 

also going to be respecting those ISP-related control decisions? 

Mr. LEIBOWITZ. Well, I mean, they may feel a false sense of security, there may be consumer confusion. They may not understand 

why they can’t get discounted products from their ISPs online without either an opt-in, or if it’s for the broadband itself, why they 

can’t get it at all while they can get it from everyone else in the 

Internet ecosystem. So, yes, I think that’s a possibility. 

The CHAIRMAN. All right. Senator Blumenthal, do you have any 

more questions? 

Senator BLUMENTHAL. I have just a couple of quick questions, 

Mr. Chairman. 

To ask a somewhat mundane question, I’m impressed—maybe I 

should direct this to both you, Mr. Leibowitz, and any other members of the panel who want to respond—that there is often overlapping and disparate responsibility for enforcement of privacy protections. The example that comes to mind is HIPAA. The Department 

of Health and Human Services enforces the Health Insurance Portability and Accountability Act, I’m saying it just so I can remember 

what it stands for, HIPAA—— 

[Laughter.] 

Senator BLUMENTHAL.—the privacy rules that operate under that 

statute and regulate the use and disclosure of protected health information. The FTC exercises a complementary jurisdiction over all 

the entities or individuals with access to the personal medical information not covered by HIPAA, and for many people, their introduction to HIPAA and to privacy concerns is when they want information about a loved one and find obstacles to obtaining it. 

So my question is whether this system can be rationalized. I 

know it sounds like mundane and somewhat nuts and bolts. Would 

you say that the broadband privacy rule is analogous to this issue? 

Mr. LEIBOWITZ. Well, yes, Senator, I do think it is, or at least it 

was. So in the first Obama term, they came up with a Consumer 

Privacy Bill of Rights, and they wanted the FTC to be responsible 

for all privacy enforcement across the board, and they wanted it to 

focus on sensitive information. It’s now—the answer is, yes, of 

course, it could be, but now with the FTC having invoked Title II, 

it has created, it has designated ISPs as common carriers, and so 

as common carriers, it can’t forebear back to the FTC in this area. 

153 

What it can do—and as you know, we need a cop on the beat because when the FTC’s jurisdiction was taken away, there was no 

one left but the FCC. But what they can do, and it goes to your 

point about DPI and sensitive information, is they can make their 

rule sort of more rational and more reflective of the FTC’s approach. And, by the way, they have authority over practices that 

are unjust and unreasonable, and that’s not too far from the unfair 

and deceptive statute that you worked with when you were the 

Connecticut AG and that the FTC works with all the time. 

Mr. OHM. So if I may, Chairman Leibowitz receives a lot of welldeserved praise for the work that the agency did in privacy. He 

made one horrible misstep while he was there, he hired me—— 

Mr. LEIBOWITZ. Not at all. 

Mr. OHM.—to be a Senior Policy Advisor for privacy issues. I witnessed an agency that is operating at the top of its game, and it’s 

developed a well-earned reputation for being one of the savviest 

privacy enforcers probably globally. At the same time, there is 

nothing that the FCC is trying to do here which is inconsistent 

with the FTC rules. There is no company that is going to be told 

X by the FCC and Y by the FTC. In fact, some companies will actually have engagement with both of the agencies in a way that’s 

complementary, not contradictory. There’s an MOU that the staff 

of the two agencies entered into that kind of reflects this. 

I think people have read far too much into this staff comment, 

which 99 percent of it was supportive and offered little tweaks, and 

there was one sentence in there which I totally concede was mildly 

critical of the FCC. 

And then the last thing I’ll say, because I’m so glad you brought 

us back to the HIPAA analogy, one way to I think, I think, fairly 

characterize the way this debate has unfolded is to say we have 

this law, it protects health information, it obligates doctors and 

hospitals to respect it because we think they ought to respect it, 

but in today’s online ecosystem, it turns out Fitbit knows a lot of 

health information about you. Is the argument, is the result, really 

that we should now say, you know what, there is no use regulating 

privacy of hospitals and doctors any longer, that we ought to lower 

the standard of privacy just because there are online actors who 

now have comparable sets of information? I don’t think so. I think 

that would be an odd argument to try and make in the health context, and I think it’s equally odd in the online context. 

Mr. GARFIELD. And the argument is not to lower, the argument 

is to respect and recognize the work that’s been done from the 

agency that’s well versed in this area. 

Mr. LEIBOWITZ. Yes, and I would just add one thing. You have 

both probably read the FTC comment. You cited it, Chairman 

Thune, at the beginning of the hearing. All I would say is go back 

and read the FTC comment to the FCC. It uses the phrase, and it’s 

diplomatic, as it should be, but it uses the phrase ‘‘not optimal,’’ 

and I counted 28 separated instances where they’re in disagreement or where they question a potential policy of the FCC. Don’t 

take my word for it, don’t take Professor Ohm’s word for it, don’t 

take the very smart—don’t—— 

[Laughter.] 

154 

Mr. LEIBOWITZ.—I mean, listen to us because I think collectively 

we have something to say, but go back and just listen to the FTC. 

The CHAIRMAN. I think it would be incredibly complicated to 

have to answer to multiple agencies on this issue, but you pointed 

out, Mr. Leibowitz, that the law clearly prohibits the FTC from regulating communications common carriers. Is there any clear limitation in law that prevents the FCC from regulating the privacy 

practices of so-called edge providers? 

Mr. LEIBOWITZ. You would have to have a very expansive view 

of Section 706 to try to do that and—— 

Mr. GARFIELD. You may get some arguments from us. 

[Laughter.] 

Mr. LEIBOWITZ.—we would get some arguments from Mr. Garfield about that. 

Mr. SWIRE. Yes, I was going to say it may be challenged. 

Mr. LEIBOWITZ. I don’t want to say they couldn’t do it, and I don’t 

want to say this FCC couldn’t do it. I think it would be a bad policy, and I don’t—you know, and I think it would be just an extension of what we believe now is a flawed policy at the FCC, and you 

would extend it from a small group of collectors of information on 

the Internet to the vast and overwhelming majority. So I think we 

have agreement on that. 

Mr. GARFIELD. Yes, we do. 

The CHAIRMAN. All right. Well, with that, we’ll wrap up. We 

thank you all very much for your insights and your input. And 

we’ll keep the hearing record open for 2 weeks during which time 

Members are encouraged to ask or submit questions for the record, 

and upon receipt, we’re asking witnesses if they would submit their 

answers to the Committee as soon as possible. 

Thank you all very much. This hearing is adjourned. 

[Whereupon, at 12:09 p.m., the hearing was adjourned.] 

(155) 

A P P E N D I X 

RESPONSE TO WRITTEN QUESTION SUBMITTED BY HON. DEB FISCHER TO

PAUL OHM

Question. Professor Ohm, you have said that it is important to keep privacy protections in mind for rural Americans, because they may have access to only one 

broadband provider. Living on a ranch in Cherry County, Nebraska, I certainly understand the challenges facing rural America when it comes to broadband availability. That said, I am not clear how the number of broadband providers in a given 

area is related to the level of privacy protection that is needed. Are you suggesting 

that the providers that offer service to rural America should be subject to more 

stringent privacy protections than other providers? It seems like that would only 

hurt broadband deployment where we need it most. 

Answer. I did not mean to suggest that the privacy protections for providers 

should vary based on the amount of choice consumers have in a given region. I am 

sorry if I was not clearer about this. I think the limited choice that most American 

consumers have for broadband service strongly supports the need for special privacy 

rules for broadband providers, such as those proposed by the FCC. A consumer who 

is unhappy with the privacy practices of his or her broadband provider can often 

not switch to a more privacy-respecting competitor, because there often is no viable 

alternative on the market. This is especially a problem for the millions of Americans 

with only one choice for broadband, a population that includes many rural Americans and Americans living on tribal lands. 

The lack of choice in broadband service is only one justification for the FCC’s privacy rules. My testimony supplies at least three others (history, visibility, and sensitivity). These reasons justify a privacy rule for all providers, large and small, urban 

and rural, and irrespective of whether consumers in a covered region have one provider, two providers, or more. I once again applaud the FCC for proposing a strong 

privacy rule, one that implements Congress’s intent in Section 222 of the Communications Act. 

RESPONSE TO WRITTEN QUESTIONS SUBMITTED BY HON. DEB FISCHER TO

DEAN C. GARFIELD

Question 1. Mr. Garfield, as you know, the number of mobile devices in this country is growing at an exponential rate. The Internet of Things has the potential to 

grow our economy and make our workforce more productive. As we talk about the 

Internet of Things, concerns are inevitably raised about how we can protect the privacy of the data that is sent from device to device. While these are important concerns, I also worry that overly restrictive privacy regulations will stifle development 

of the Internet of Things. Do you believe that is the case for the FCC’s proposed 

regulations? 

Answer. I would like to begin by thanking you for your leadership on the Internet 

of Things and the DIGIT Act. That legislation recognizes the important and transformational impact the IoT will have in our communities, our economy, and society 

at large when we consider safety, health, and other applications we cannot yet fathom. We would agree that overly restrictive privacy regulations could, and likely will, 

prevent investment, innovation, and experimentation in the IoT. 

As you know given your significant work on IoT, in applications where data that 

identifies individuals is collected, the collection, use, sharing, and protection of such 

data are already subject to existing laws. For instance, IoT manufacturers fall within the jurisdiction of the Federal Trade Commission (FTC) and are thus subject to 

its unfair or deceptive acts or practices authority under Section 5 of the Federal 

Trade Commission Act. Grounded in Fair Information Practices Principles (FIPPs), 

the FTC’s approach to privacy helped enable the Internet to thrive and, as a consequence, ITI companies have been able to offer an expanding range of services and 

applications (including IoT applications), often times free or at a nominal expense 

156 

1Protecting the Privacy of Customers of Broadband and Other Telecommunications Services, 

WC Docket No. 16–106, Notice of Proposed Rulemaking, FCC 16–39, ¶¶ 276–77 (Apr. 1, 2016). 

to consumers. Depending on the data collected and the actors involved, other statutory authorities may also be applicable to IoT products or services. There are certain 

protections for health information under the Health Insurance Portability and Accountability (HIPAA) Act and the Health Information Technology for Economic and 

Clinical Health (HITECH) Act, while the Graham-Leach-Bliley (GLB) Act and the 

FTC’s Safeguards Rule govern the protection of information held by financial institutions. 

In addition to being overly prescriptive and not grounded in the FIPPS, which 

guides privacy frameworks around the globe, the FCC’s proposed rule also subjects 

the same data to different requirements based on which sector collects the data. We 

believe this is a bad precedent and will limit not just IoT development but innovation by companies that may operate in multiple spaces such as broadband Internet 

access service providers who may also offer IoT products or applications, or online 

content or services. 

Question 2. Mr. Garfield, in your testimony you describe how the FTC and state 

attorneys general work together to create a meaningful system of enforcement and 

consumer protection. For example, state attorneys general typically enforce laws addressing ‘‘unfair or deceptive acts or practices’’ at the state level, while the FTC will 

do the same on the Federal level. Under the new privacy regime proposed by the 

FCC, what will be the role of state attorneys general? Will their authority be 

changed in any way? 

Answer. The NPRM specifically proposes to ‘‘preempt state laws only to the extent 

they are inconsistent with any rules adopted by the Commission.’’ 1 If a state regulation or law conflicts with the Commission’s final rule, the role of that state’s Attorney General would be significantly diminished in that he or she would no longer 

be able to bring an enforcement action against broadband providers for violations 

of such existing state regulation or law until the state regulator or legislature acts 

to bring the rule or law into alignment with the FCC’s rule. Further, states may 

continue to enforce or adopt new regulations or laws that are more restrictive than 

the FCC’s rule so long as compliance with both the state regulation or law and the 

Federal regulation is feasible. 

RESPONSE TO WRITTEN QUESTION FROM HON. DEB FISCHER TO

MATTHEW M. POLKA

Question. Mr. Polka, in his written testimony, Professor Ohm said that it is important to keep privacy protections in mind for rural Americans, because they may 

have access to only one broadband provider. Living on a ranch in Cherry County, 

Nebraska, I certainly understand the challenges facing rural America when it comes 

to broadband availability. That said, I am not clear how the number of broadband 

providers in a given area is related to the level of privacy protection that is needed. 

It seems like putting more stringent requirements on rural providers would only 

hurt broadband deployment where we need it most. Do you have thoughts on this 

point? 

Answer. As a threshold matter, Professor Ohm is incorrect that rural consumers 

may have access to only one broadband provider. In virtually every community and 

in all but the most remote areas, consumers can access at least two wireline 

broadband providers, four wireless broadband providers, and two satellite 

broadband providers. In addition, as I discussed at the hearing, the question is not 

whether or not consumers get privacy protections. Of course, they do. The question 

is how to develop and implement robust privacy protections for customer proprietary 

network information consistent with other public interest objectives, including, as 

you state, enhancing broadband deployment. Broadband Internet access providers 

have been subject to the Federal Trade Commission’s privacy regime for many 

years, and it has successfully protected consumers and proven workable for providers. Rather than create extensive new requirements from whole-cloth, the Federal Communications Commission should use this model as the basis for its rules. 

Æ 

157 

This page intentionally left blank. 

158 

This page intentionally left blank. 

159 

This page intentionally left blank.