Recently, I reviewed a 2021 Federal Trade Commission report detailing the data collection practices of six internet service providers. The report examined AT&T, Verizon, T-Mobile, Google Fiber, Comcast Xfinity, and Charter Spectrum Communications. It found that standard consumer privacy measures, such as web browser tracking protections, are ineffective against ISPs because many utilize a “supercookie” to persistently track network activity.
In my latest video, I dive into this topic and look at what you can do to stop this data collection.
Because households share a single internet connection, this tracking encompasses all users on the network, including children. ISPs gather information by observing the websites a household visits, the frequency and duration of those visits, and the amount of data transferred. Providers can send a user’s IP address to an ad affiliate, who then passes it to a data broker to build an informational profile. This data extends beyond basic demographics, categorizing users by religious affiliation, ethnicity, and political leanings.
The sale of this information presents distinct privacy risks. Beyond targeted advertising, the FTC report indicates that scammers can purchase access to these profiles. Additionally, a 2019 Motherboard report revealed that bounty hunters were able to buy customer location data originating from AT&T, T-Mobile, and Sprint phones. Despite these practices, consumer engagement with ISP privacy policies remains low. The FTC found that the provider with the highest engagement saw only 6.7 percent of subscribers look at their privacy pages.
I examined my own provider, Comcast Xfinity, to understand their specific policies. Comcast stated in a 2017 blog post and on their current privacy pages that they do not sell personal information without affirmative opt-in consent. However, agreeing to their terms of service during the initial account sign-up functions as that consent.
Navigating Comcast’s privacy section reveals numerous documents and a complex process for managing data disclosures. Users can opt out of certain disclosures, such as participation in audience measurement or personalized ads, but the application of these settings to broader tracking methods is ambiguous.
The ability to view, change, or delete the specific data an ISP holds depends heavily on state laws. For residents in states with applicable laws, Comcast provides a form to request a download of stored data, which includes account information, behavioral inferences, and details about telecommunication usage.
I submitted a data download request over a week ago, a process Comcast notes can take up to 30 days to fulfill. Until comprehensive federal regulations are established, the responsibility remains on the individual subscriber to navigate these varied settings and actively opt out of data collection.
I will be back with an update once Comcast hands over my data. Stay tuned!
