A resolution was passed in the US Senate today, that allows US ISP's to sell its users' "browsing data" and private information to third parties.

If this resolution becomes a law, does this mean that a third party who buys data in bulk can just search for a given name/id in the private browsing data set, and if there is a strong match (e.g., Facebook or a service that uniquely identifies a user with high probability in the visited URLs), the buyer can identify the remaining visited pages of this particular user? Can this information then be realistically published, hacked, or leaked (a la Trolltrace)?

Or, is the information sold actually more detailed (downloaded website data), or is the data actually significantly less invasive than described above?

1 Answer 1


Congress repealed a rule that had not gone into effect, so 'allows' isn't quite right. The FCC had a rule that would've prevented ISPs from some commercial use of the data they collect. It was targeted at limiting the violation of ISP subscriber privacy.

ISP vs Destination site (Facebook etc):

Facebook already sells you to advertisers - but the rule would never have applied to Facebook, Google, or any destination site (except when Google fiber is your ISP).

Uniquely identify users:

As long as Facebook uses an encrypted channel (https) the ISP doesn't see your URLs. This leaves the ISP with destination, timing, and message size. Identifying a unique user based on that data alone would prove impossible*. Sites without encryption are an open book.

Since you like arstechnica: "https://arstechnica.com/information-technology/2017/03/how-isps-can-sell-your-web-history-and-how-to-stop-them/"

Information detail:

Technically you're asking a legal question about what data can be shared in absence of an FCC rule. Given that the laws of particular countries are typically only enforceable on entities within those countries, and given the amount of wrangling that usually accompanies laws, I don't believe anyone knows where the legal lines are drawn. IANAL

The practical truth is that ISPs want to profile you and sell you to marketers. This is the primary business model of Google and Facebook.

  • Arguably, ISPs know more about 'you' (absent a VPN) they can see every domain you visit, and when.
  • Arguably, Google and Facebook know more about 'you' because you have an individual account with them and they know specific information you access and 'like'.

IMHO Google and Facebook will remain more valuable to advertisers:

  1. Google and Facebook profile individuals instead of locations.
  2. Google and Facebook have a significant first mover advantage.
  3. ISP information will be limited by the increasing prevalence of secure communication, and is nearly eliminated by VPN.
  4. FCC rules aren't the only privacy laws. ISPs might be vulnerable to defamation suits if they aren't careful.

[*] Theoretically, a determined ISP with a deep understanding of an encrypted site might find ways to fingerprint the various connections required to render a particular URL. This metadata of the timing and pattern of content/ads served might be user and URL specific, but I doubt it would be economic to analyse as it would require privately held information about the inner workings of a dynamic site.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.