吃瓜大本营

Without many of us even realizing it, our use of the Internet reveals deeply private information about us, ranging from the contents of our communications to details about our finances, health, and exact location. This information 鈥� especially when aggregated 鈥� provides an intimate window into our personal lives and can reveal a great deal of personal, private information about us, like our health care needs and personal or political beliefs.
 
For each of us, there鈥檚 at least one entity that can see perfectly through that window: our 鈥渂roadband information access service鈥� provider, more commonly known as an Internet service provider or ISP. In order to even access the Internet, we must each rely on an ISP; our computers and phones have to connect to their networks before we can send and receive information online. As a result, they are uniquely positioned to collect, retain, and analyze troves of personal information about us.
 
Without regulation, they can use our personal information in any manner they please. As their track record shows, they often choose to use it in privacy-invasive ways, like creating of their users鈥� online activity and injecting that allow third parties to track individual customers.
 
This perfect storm raises not only serious online privacy concerns, but free speech and information security concerns, too. Unwanted surveillance can chill us from speaking freely, deterring us from voicing unpopular or simply private opinions. Equally, access to personal information, should it end up in the wrong hands, could open us up to everything from personalized phishing emails to identity theft and bank account fraud.
 
In an effort to quell this storm and put some control back in consumers鈥� hands, Maine passed 鈥�.鈥� That law requires ISPs to get approval from customers before selling or using their personal information 鈥� everything from social security numbers and billing information to details derived from Internet use, like browsing histories and app usage, precise geolocation, financial and health information, and even the contents of communications.
 
A group of ISPs are now challenging this privacy law, claiming that it infringes on their First Amendment rights by unconstitutionally restricting how they use or disclose customer personal information.
 
They鈥檙e right that this law regulates their speech: It governs the use and dissemination of information. But they鈥檙e wrong to call it unconstitutional.
 
As we explain in a friend-of-the-court brief we filed with the ACLU of Maine, the Electronic Frontier Foundation, and the Center for Democracy and Technology, Maine鈥檚 law regulates commercial speech, a category of speech that relates solely to the economic interests of the speaker and its audience. And the law satisfies the scrutiny that applies to regulations of commercial speech because it is narrowly drawn to advance the state鈥檚 interests in protecting consumer privacy, free expression, and security.
 
The law focuses on ISPs: entities that are uniquely positioned to see everything we do, say, and even think online. Consumers have no choice but to use ISPs if they want to access the Internet. And the law does not ban their use of customer information entirely; it simply requires consent from customers first. Since we have no control over whether that information 鈥� which relates entirely to our use of a commercial service 鈥� is created and shared in the first place, surely we should at the very least have some say in what ISPs can do with it. It speaks volumes about the intent of the ISP companies 鈥� and the money they make off the collection and use of private customer information 鈥� that they would rather file an expansive lawsuit than simply ask their customers for permission to use their information.
 
As an organization deeply committed to the protection of both free speech and data privacy, we take these issues seriously. Maine鈥檚 law gives us the power to say yes or no to the collection and use of our private information. It puts the decision about when ISPs can use and disclose customers鈥� personal information back where it belongs: in the hands of Internet users. Despite the ISPs鈥� insistence to the contrary, Maine鈥檚 law does not violate their speech rights, and in fact does a great deal of good in protecting consumers鈥� privacy rights. Other states are already looking to follow in Maine鈥檚 legislative footsteps by requiring customers鈥� approval before allowing ISPs to share or sell their personal data 鈥� as they should. Perhaps that is what is scaring the ISP companies the most.