ISPs have quietly been selling your browsing data without your consent for years, but only recently, with the advent of behavioral advertising, did Congress and the media really notice. The attention brought to the practice by companies like Phorm and NebuAD prompted Congress to question whether existing privacy and wiretap laws make such a practice illegal, and if not, whether they should pass a law that requires consumers opt in, instead of being forced to opt-out. Obviously the ISPs and ad companies don't want new restrictions on how they can make money, so they've recently been trying to convince Uncle Sam they should be allowed to self regulate.

Industry leadership through some form of oversight/self-regulatory model, coupled with competition and the extensive oversight provided by literally hundreds of thousands of sophisticated online users (will) help ensure effective enforcement of good practices and protect consumers. -Verizon

AT&T and Verizon recently proposed a voluntary code of conduct that involves making such systems opt-in. Today, Verizon PR man Link Hoewing posts to the Verizon blog (via GigaOM) to say that Verizon believes that new privacy rules aren't necessary, because public shame will keep them from doing anything stupid:

quote:

---

A couple of years back during the debate on net neutrality, I made the argument that industry leadership through some form of oversight/self-regulatory model, coupled with competition and the extensive oversight provided by literally hundreds of thousands of sophisticated online users would help ensure effective enforcement of good practices and protect consumers.

---

Public shame hasn't done much to stem the sale of user clickstream data -- largely because ISPs simply deny they do it. Sure, if the Comcasts and Verizons of the world do something incredibly stupid that happens to be easy to understand, the public backlash and media coverage can force them to change course. But studies indicate that the general public is utterly clueless when it comes to online privacy, which makes it relatively easy to trick them into supporting questionable policies.

ISPs certainly know this well -- recently arguing that selling your browsing history without oversight "empowers users," while delivering an "enhanced online experience" that's almost as good as faster speeds. These don't sound like companies that are particularly concerned about shame. While the public outcry over NebuAD did result in multiple ISPs canceling planned deployment of deep packet inspection ad delivery systems, ISPs didn't cancel those plans out of shame -- they canceled them because ISP lawyers believed there was a possibility they could be violating the law. That's not shame, it's fear.

That would seem to support plans by politicians like Edward Markey that would make it a law that users must opt-in to having their browsing data sold. Relying on an amoral corporation to be shamed into protecting user privacy is like hoping that guilt will deter a hungry bear. Equally absurd is allowing these companies to design voluntary codes of conduct that they can ignore or adhere to in equal measure. Of course it may be too much for Congress to pass an opt-in law without screwing it up -- or watering it down to the point it becomes meaningless.