A legal battle, possibly one reaching the Supreme Court, is the likely result of new privacy rules limiting broadband service providers' use of customer data.
The new rules, proposed by the Federal Communications Commission in March, were approved by its commissioners 3-2 along a party line vote Thursday.
The rules restrict how service providers such as AT&T (T) - Get Report and Verizon Communications (VZ) - Get Report use and sell customer data. They do not affect "edge providers" such as Google (GOOGL) - Get Report and Facebook (FB) - Get Report .
Broadband providers and their industry trade groups lobbied aggressively against the rules, whereas consumer advocacy organizations cheered their approval.
The rules could upend the business plans of broadband providers, particularly AT&T, which just placed a $107 billion bet on the value of its customer data by agreeing to acquire Time Warner (TWX) . AT&T believes the data from its more than 100 million customers can be used to target advertising to viewers of Time Warner's CNN, HBO and other content. Other big cable and broadband providers believe that model will work for them too and have said they will ask regulators to make AT&T share its customer data with them as a condition of regulatory approval of the Time Warner deal -- a request likely to be rejected if the privacy rules survive legal challenge.
The industry opponents say they haven't officially decided whether to challenge the privacy rules -- the first step would be to ask the FCC to reconsider them -- but players on both sides say they expect a federal appeals court eventually will be asked to overturn them. A related case against an earlier FCC decision claiming the agency's right to regulate broadband is already before the federal appeals court in Washington.
A three-judge panel of the court upheld the FCC's claim to jurisdiction over broadband service in June. The full line of the appeals court now is reviewing that decision. Regardless of how the appeals court ultimately rules, the U.S. Supreme Court is expected to be asked to rule on the FCC's authority to regulate broadband service. If the high court strikes down the commission's authority to oversee internet service, the new privacy rules would be struck down too.
Under the new privacy rules, internet service providers such as AT&T, Verizon and Comcast (CMCSA) - Get Report must get their customers' permission to use and share "sensitive" personal information such as precise geolocation; financial, health and children's information; social security numbers; web browsing and app usage history; and the content of communications.
"Google and Facebook have built combined trillion dollar digital - specifically mobile - advertising empires, although that growth hardly came overnight. They not only have access to an unbelievable trove of data but have figured out how to extract meaningful insights from that data and apply it to their respective platforms - Facebook in social media/community engagement and Google in search - in order to better target users and in return deliver high ROI for advertisers," said Jack Mohr, TheStreet's chief investment strategist. Mohr and Jim Cramer also co-manage Action Alerts PLUS, a charitable trust that counts GOOGL and FB among its holdings. "AT&T and Verizon certainly have troves of data but are so far behind in their ability to utilize it effectively. AT&T's acquisition of Time Warner is an attempt to create a media powerhouse with leverageable data to provide better targeted advertising to its ad buyers (one of the main rationales behind the deal) but they will never be able to compete with FB/GOOGL at targeting, they're too far behind at this point so we expect FB and GOOGL to continue to take share away from traditional and digital TV cable/broadcast ad budgets (which still command vast majority of total U.S. ad spend) over foreseeable future."
According to the FCC's new rules, "nonsensitive" information such as email addresses or service tier information could be used and shared without upfront customer consent, but providers must allow users to opt out.
The only exemption to the restrictions are the providers' use of billing and collection information.
Although FCC Chairman Thomas Wheeler was confident in the commission's authority to impose the privacy protections, statements from industry groups and from the two dissenting Republican FCC members highlighted the grounds on which a possible legal challenge to the rules would be made.
Joan Marsh, AT&T senior vice president of federal regulatory, said there's no legal rationale for imposing a stricter regulatory regime on broadband providers than on Google and Facebook. "Consumers want their information protected based on the sensitivity of the information collected, not the entity collecting it," she wrote in a blog post reacting to the FCC move. "The FCC's divergent approach will ultimately serve only to confuse consumers, who will continue to see ads based on their web browsing history generated by edge providers even after they have been told by their service provider that their consent is required for use of such information."
AT&T shares were little changed Friday, down 1 cent to $36.51.
Republican FCC member Michael O'Rielly said even setting aside the dubious legality of the FCC's previous decision to declare jurisdiction over broadband service, the new privacy rules face "serious deficiencies" withstanding legal scrutiny. For starters, the FCC failed to adequately justify the rules, he said, highlighting that they go beyond the online privacy restrictions already established by the Federal Trade Commission and that they leave ISPs with greater burdens than Google and Facebook.
The FCC explanation that ISPs are able to see more information about their customers than edge providers is a "ridiculous notion that has been thoroughly debunked," he said.
"Requiring opt-in notice for web browsing history and application usage data is a significant departure from the FTC approach, which is the basis for current expectations," O'Rielly said, noting that there has been no evidence of any privacy harms, and businesses have been able to "provide great value to consumers in the form of discounts, convenient features and other new and innovative services."
Consumer advocates, however, say that the best way to level the playing field is for Google, Facebook and other websites to fall under a regime just like the one the FCC just passed for broadband service providers. Neither the FCC nor the FTC has authority to take that step, they acknowledge, but they plan to press Congress for legislation that would do just that. They also point out that Europe already was headed in the FCC's direction and it makes good business sense for ISPs to accept a global privacy framework rather than different ones for the U.S. and Europe.
"Europe is pressing the U.S. to do a better job protecting private data, and companies need to think about how aggressively they want to try overturning these rules," said Jeff Chester, executive director of the Center for Digital Democracy. "They'll be making a big mistake to take action that's out of touch with what their customers want and, ultimately, what their shareholders want."