FCC approves privacy rules requiring ISPs get customer permission before sharing sensitive data like location, financial information, and browsing history
New privacy rules require opting-in to sensitive sharing — In a win for privacy advocates, the FCC voted this morning to place …
Context & Ripple Effects
This vote closes out a year-long FCC run-up: chairman Tom Wheeler first proposed forcing ISPs to ask permission before sharing personal data with outside parties in March, the commission advanced the draft in April, and the October 27 vote was teed up earlier this month. Approval makes opt-in consent the legal default for sensitive categories — location, financial information, children's data, browsing history.
The aftermath matters as much as the vote itself: by spring 2017 the federal posture had reversed hard enough that Seattle wrote its own municipal broadband privacy rules requiring user opt-in, with ISPs told to comply by May 24. The city ordinance is a direct descendant of today's rule — same consent standard, different level of government.
First-order effects
- ISPs must now obtain affirmative customer opt-in before sharing location, financial information, or browsing history with advertisers and other third parties, converting data sharing from a default into a permissioned transaction.
- Privacy advocates score a win at the commission level, while ISP data-monetization programs face an immediate compliance redesign around consent flows.
Second-order effects
- Advertisers and data brokers lose a passive supply channel for browsing and location data sourced from carriers, shifting value toward consent-gathering ISPs who can lawfully broker opted-in audiences.
- When the federal framework was subsequently pushed back on, Seattle's municipal opt-in ordinance showed compliance teams would have to track a growing set of local rules rather than one national standard.
Third-order effects
- If the pattern holds, broadband privacy governance fragments: federal rulemaking sets the template, political reversal opens gaps, and cities and states fill them with their own opt-in mandates — raising multi-jurisdiction compliance costs that favor large ISPs over small ones.
- The opt-in-for-sensitive-data structure pioneered here becomes a transferable template other regulators can lift for adjacent data categories, entrenching consent as the default boundary for consumer information.
The trend: Consumer data privacy is moving from a single federal rulebook toward a patchwork of state and local opt-in mandates built on the FCC's consent-first template.