As reported by Bloomberg Government (paywall), at an open FTC meeting today, the Commission “released the findings of a study on data collection practices of the country’s biggest internet service providers.”  The Commission issued a press release covering a staff report.  According to Bloomberg Government, “[c]ompanies are ‘surveilling’ consumers across a range of activities and collecting a ‘staggering array of data’ to engage in targeted advertising, FTC Chair Lina Khan said Thursday at an agency meeting.”  

In the press release,

the report found the privacy protections many of the companies offer raised several concerns. Even though several of the ISPs promise not to sell consumers personal data, they allow it to be used, transferred, and monetized by others and hide disclosures about such practices in fine print of their privacy policies. For example, several news outlets noted that subscribers’ real-time location data shared with third-party customers was being accessed by car salesmen, property managers, bail bondsmen, bounty hunters, and others without reasonable protections or consumers’ knowledge and consent, according to the report.

Many of the ISPs also claim to offer consumers choices about how their data is used and allow them to access such data. The FTC found, however, that many of these companies often make it difficult for consumers to exercise such choices and sometimes even nudge them to share even more information. In addition, while several of the ISPs promise to only keep the data for as long as needed for business purposes, the definition of what constitutes a “business purpose” varies widely among the companies.

The report concludes that many of the ISPs’ data collection and use practices mirror problems identified in other industries and underscore the importance of restricting data collection and use.

The report discussed how “‘digital redlining’ could reverse any progress on civil rights issues if a business is able to discriminate in its advertising buys based on, for example, a person’s color or religion, or based on a proxy that effectively discriminates against certain races or religions.  Even where businesses do not intend to discriminate, certain uses of consumers’ personal information could disparately impact certain groups.”