2018 Privacy Legislation Related to Internet Service Providers

5/13/2019

About half the states introduced measures in 2018, largely in response to the repeal of federal Internet privacy protections that were approved by the Federal Communications Commission in the final days of the Obama administration.

The rules, which had not yet gone into effect, would have put tough restrictions on what internet service providers could do with consumer data collected. For example, under the FCC's rules, providers would have needed permission from customers before collecting and sharing data, including user's health and financial details, web browsing history, app usage and geo-location.

Currently, two states, Nevada and Minnesota, require internet service providers (ISPs) to keep private certain information concerning their customers, unless the customer gives permission to disclose the information. Both states prohibit disclosure of personally identifying information, but Minnesota also requires ISPs to get permission from subscribers before disclosing information about the subscribers' online surfing habits and Internet sites visited.

2018 Legislation Related to Privacy Practices of Internet Service Providers

At least 24 states and the District of Columbia considered measures requiring internet or telecommunications service providers to keep specified information confidential, as listed below. Calif. is the only state that enacted legislation, A.B. 375, which applies broadly to certain companies that collect and maintain personal information from Calif. residents, and that have 1) annual gross revenues exceeding $2.5 million, or 2) obtain personal information 50,000 or more Calif. residents, or 3) derive 50 % or more of their annual revenues from selling Calif. residents' personal information.

Please check individual legislative websites for the most current status, summaries and versions of bill and amendment text.

Alaska

H.B. 230
Status: Failed--adjourned.
Establishes an unfair trade practice under the Alaska Unfair Trade Practices and Consumer Protection Act.

H.B. 232
Status: Failed--adjourned.
Establishes an unfair trade practice under the Alaska Unfair Trade Practices and Consumer Protection Act.

California

A.B. 375
Status: Enacted. Chap. 2018-55
Enacts the California Consumer Privacy Act of 2018. Grants a consumer a right to request a business to disclose the categories and specific pieces of personal information that it collects about the consumer, the categories of sources from which that information is collected, the business purposes for collecting or selling the information, and the categories of 3rd parties with which the information is share. 

S.B. 460
Status: Failed
Amends the Consumers Legal Remedies Act. Prohibits specified actions by an internet service provider that provides broadband internet service, makes a violation of those prohibitions subject to certain remedies, prohibits a state agency from contracting with an internet service provider for the provision of broadband internet access service unless that provider certifies under penalty of perjury that it will not engage in specified activities.

Connecticut

S.B. 335
Status: Failed
Concerns internet service providers and consumer personally identifying information; prohibits Internet service providers from taking certain actions with respect to consumer's personally identifying information.

Florida

S.B. 1854
Status: Failed
Relates to broadband service privacy; defines terms; prohibits Internet service providers from using, disclosing, selling, or permitting external access to certain customer information, except under specified conditions; specifies an effective date for the prohibition; requires providers to furnish a prior opt-in consent; specifies requirements and disclosures for the consent; prohibits providers from retaining customer information any longer than necessary.

Hawaii

H.B. 2296
Status: Failed--adjourned
Prohibits internet service providers from using the personal information of customers for specific purposes without the prior written consent of customers.

Indiana

H.B. 1300
Status: Failed--adjourned
Requires a communications service provider to provide notice to its Indiana customers of its privacy policies, requires that the provider's notice include specified information about the provider's use and disclosure of customer proprietary information, sets forth a customer's opt-out and opt-in approval rights for giving consent for a provider to use, disclose, or permit access to the customer's proprietary information.

Kansas

H.B. 2423
Status: Failed--adjourned
Prohibits the collection and sale of personal data by internet service providers.

Kentucky

H.B. 332
Status: Failed--adjourned
Includes a definition of personally identifiable information; provides that no telecommunications or Internet service provider shall collect personally identifiable information from a customer as a result of the customer's use of the telecommunications or Internet services without the customer's express written approval.

S.B. 11
Status: Failed--adjourned
Prohibits a telecommunications or internet service provider from collecting personally identifiable information from a customer as a result of the customer's use of the telecommunications or internet services without the customer's express written approval, provides penalties for violations.

Louisiana

H.B. 679
Status: Failed--adjourned
Creates the Internet Privacy and Protection Act.

Maine

S. 566/ LD 1610
Status: Failed.
This bill prohibits a provider of broadband internet access service from using, disclosing, selling or permitting access to customer personal information unless the customer expressly consents to that use, disclosure, sale or access. The bill provides other exceptions under which a provider may use, disclose, sell or permit access to customer personal information. The bill prohibits a provider from refusing to serve a customer, charging a customer a penalty or offering a customer a discount if the customer does or does not consent to the use, disclosure, sale or access.

Maryland

H.B. 1654
Status: Failed--adjourned
Specifies the circumstances under which a broadband Internet access service provider may handle certain customer personal information in a certain manner; establishes a mechanism through which a broadband Internet access service provider may obtain customer consent to have certain personal information handled in a certain manner.

H.B. 1655
Status: Failed
Specifies the circumstances under which a broadband Internet access service provider may handle certain customer personal information in a certain manner; establishes a mechanism through which a broadband Internet access service provider may obtain customer consent to have certain personal information handled in a certain manner; prohibits a broadband Internet access service provider from taking certain actions based on whether a customer has consented to have certain customer personal information handle.

Massachusetts

H.B. 3698
Status: Failed--adjourned.
Relates to the disclosure of customer proprietary information by internet service providers.

H.B. 3766
Status: Failed--adjourned.
Prohibits certain telecommunications or internet service providers from collecting personal information from customers without express written approval.

S.B. 2053
Status: Failed--adjourned.
Ensures internet security and privacy.

S.B. 2062
Status: Failed--adjourned.
Relates to internet service providers.

S.B. 2376
Status: Failed--adjourned.
Submits a report from the Special Senate Committee on Net Neutrality entitled Net Neutrality and Consumer Protection, a Commonwealth Concern.

S.B. 2610
Status: Failed--adjourned.
Protects consumers by prohibiting blocking, throttling, or paid prioritization in the provision of internet service, and provides incentives to give customers a mechanism to easily opt-out of third-party access to customer proprietary information.

Minnesota

H.B. 2209
Status: Failed--adjourned
Appropriates money for the labor standards and apprenticeship division. (See Article 9, section 4.)

H.B. 2579
Status: Failed--adjourned
Prohibits collection of personal information absent customer's express written approval.

H.B. 2606
Status: Failed--adjourned
Prohibits collection of personal information without customer's express written approval.

H.B. 4182
Status: Failed--adjourned
Relates to commerce; requires telecommunications service providers to comply with internet privacy requirements; defines terms and modifying definitions; requires express approval of disclosure of personally identifiable information; increases civil liability threshold.

S.B. 2309
Status: Failed--adjourned
Prohibits collection of personal information absent customer's express written approval.

S.B. 2323
Status: Failed--adjourned
Prohibits collection of personal information absent customer's express written approval.

S.B. 2438
Status: Failed--adjourned
Requires telecommunications service providers to comply with internet privacy requirements; requires express approval of disclosure of personally identifiable information; increases civil liability threshold.

Nebraska

L.R. 453
Status: Failed-adjourned
Allows for an interim study to examine net neutrality.

New Jersey

A.B. 1527
Status: Pending
Requires internet service providers to keep confidential and prohibit any disclosure, sale, or unauthorized access to subscriber's personally identifiable information unless subscriber authorizes internet service provider in writing to disclose information.

A.B. 1927
Status: Pending
Requires internet service providers to keep confidential subscriber's personally identifiable information unless subscriber authorizes internet service provider in writing or email to disclose information, prohibits subscriber penalty.

A.B. 2958
Status: Pending
Directs Board of Public Utilities to undertake public awareness campaign concerning telecommunications carriers, including mobile and Voice over Internet Protocol service providers, and disclosure of customer information.

A.B. 3711
Status: Pending
Requires Internet service providers to keep confidential subscriber's personally identifiable information unless subscriber authorizes Internet service provider in writing to disclose information.

S.B. 1754
Status: Pending
Requires Internet service providers to keep confidential subscriber's personally identifiable information unless subscriber authorizes Internet service provider in writing to disclose information.

S.B. 2641
Status: Pending
Requires Internet service providers to keep confidential and prohibit any disclosure, sale, or unauthorized access to subscriber's personally identifiable information unless subscriber authorizes Internet service provider in writing to disclose information.

S.R. 46
Status: Pending
Affirms right to privacy despite federal authorization of expansion government surveillance and deregulation of electronic information sharing.

New York

A.B. 7191
Status: Failed--adjourned.
Prohibits the disclosure of personally identifiable information by an internet service provider without the express written approval of the customer.

A.B. 7236
Status: Failed--adjourned.
Requires internet service providers to provide customers with a copy of their privacy policy and to obtain written and explicit permission from a customer prior to sharing, using, selling or providing to a third party any sensitive information of such customer.

A.B. 7495
Status: Failed--adjourned.
Relates to the sale of personal information by an internet service provider.

S.B. 3367
Status: Failed--adjourned.
Relates to internet service provider privacy requirements.

S.B. 5516
Status: Failed--adjourned.
Relates to the sale of personal information by an internet service provider.

S.B. 5576
Status: Failed--adjourned.
Requires internet service providers to provide customers with a copy of their privacy policy and to obtain written and explicit permission from a customer prior to sharing, using, selling or providing to a third party any sensitive information of such customer.

S.B. 5603
Status: Failed--adjourned.
Prohibits the disclosure of personally identifiable information by an internet service provider without the express written approval of the customer.

S.B. 8161
Status: Failed--adjourned.
Prohibits internet service providers from disclosing personally identifiable information where a consumer requests that his or her information not be disseminated; defines terms; makes exceptions; imposes a civil penalty.

Oregon

H.B. 4155
Status: Enacted, Chap. 88 (Note: provisions in earlier bill versions related to disclosure of personal information were amended out.)
Prohibits public bodies from contracting with broadband Internet access service providers that engage in certain network management activities based on paid prioritization, content blocking or other discrimination

Pennsylvania

H.B. 1863
Status: Failed--adjourned.
Prohibits a provider of broadband internet access service from using, disclosing, selling or permitting access to customer personal information unless the customer expressly consents to that use, disclosure, sale or access. The bill provides other exceptions under which a provider may use, disclose, sell or permit access to customer personal information. The bill prohibits a provider from refusing to serve a customer, charging a customer a penalty or offering a customer a discount.

S.B. 1093
Status: Failed--adjourned.
Amends Titles 12 Commerce and Trade and 66 Public Utilities of the Pennsylvania Consolidated Statutes, in commercial protection; provides for personal information; relates to alternative form of regulation of telecommunications services; provides for definitions; makes an editorial change.

Rhode Island

H.B. 6086
Status: Failed--adjourned.
Would prevent any state or municipal agency's telecommunications or internet contractor from collecting and disseminating the personal information of customers. This act would take effect upon passage.

H.B. 6087
Status: Failed--adjourned.
Would protect individuals of this state from disclosure of personally identifiable information through the internet by operators of commercial websites or online services and would create a right of action for any operator violations. This act would take effect on July 1, 2017.

South Carolina

H.B. 4154
Status: Failed--adjourned.
Provides that a telecommunications or internet service provider that has entered into a franchise agreement, right of way agreement, or other contract with the state of South Carolina or one of its political subdivisions, or that uses facilities that are subject to those agreements, even if it is not a party to the agreement, may not collect personal information from a customer resulting from the customers use of the telecommunications or internet service provider without express written approval from.

Vermont

H.B. 535
Status: Failed--adjourned
Relates to privacy and data security rules applicable to telecommunications service providers, including internet service providers.

H.B. 863
Status: Failed--adjourned
Relates to the Vermont Broadband Internet Privacy Act.

S.B. 147
Status: Failed--adjourned
Relates to privacy and data security rules applicable to telecommunications service providers, including internet service providers.

S.B. 289
Status: Enacted (Note: provisions in earlier bill versions related to disclosure of personal information were amended out.)
Relates to the Broadband Internet Privacy Act.

Virginia

H.B. 1329
Status: Failed
Relates to Government Data Collection and Dissemination Practices Act; relates to dissemination of information concerning religious preferences and affiliations; prohibits any state agency maintaining an information system that includes personal information from disseminating to federal government authorities information concerning the religious preferences and affiliations of data subjects for the purpose of compiling a list, registry, or database of individuals.

S.B. 719
Status: Failed
Relates to data sharing; relates to substance abuse data; establishes a Substance Abuse Data Sharing and Analytics Clearinghouse (the Clearinghouse), to be administered by the Secretary of Health and Human Resources in consultation with the Substance Abuse Data Sharing and Analytics Advisory Committee (the Advisory Committee), also created by the bill.

S.B. 948
Status: Failed
Provides that an entity engaged in the provision of broadband internet access service in the Commonwealth shall not block lawful content, applications, services, or non-harmful devices, subject to reasonable network management, provides that impair or degrade lawful internet traffic on the basis of internet content, application, or service, or use of a non-harmful device, subject to reasonable network management.

S.B. 949
Status: Failed
Limits public procurement of internet access services to service providers that meet certain requirements related to internet neutrality and privacy.

Washington

H.B. 2200
Status: Failed-adjourned
Protecting the privacy and security of internet users.

S.B. 5919
Status: Failed-adjourned
Concerns consumer protection of internet privacy.

Wisconsin

A.B. 123
Status: Failed
Relating to: the information technology block grant program, the broadband expansion grant program, waiving certain fees and appraisals, and making appropriations. (See Senate Amendment 1 for relevant provisions)

A.B. 788
Status: Failed
Relates to privacy and security of customer information obtained by a broadband internet access service provider, provides a penalty.

A.B. 908
Status: Failed
Relates to state contracts for broadband Internet access service. Prohibits release of customer proprietary network information--information that relates to the quantity, technical configuration, type, destination, location, and amount of use of broadband Internet access service subscribed to by a customer and that is made available to the broadband Internet access service provider by the customer solely by virtue of the provider-customer relationship. Also includes information contained in the bills pertaining to the broadband Internet access service received by the customer, except for subscriber list information.

A.B. 909
Status: Failed
Relates to requirements and prohibited practices for Internet service providers; grants rule-making authority. Prohibits release of customer proprietary network information--information that relates to the quantity, technical configuration, type, destination, location, and amount of use of broadband Internet access service subscribed to by a customer and that is made available to the broadband Internet access service provider by the customer solely by virtue of the provider-customer relationship. Also includes information contained in the bills pertaining to the broadband Internet access service received by the customer, except for subscriber list information.

S.B. 49
Status: Failed
Relates to the information technology block grant program; relates to the broadband expansion grant program; relates to waiving certain fees and appraisals; makes appropriations. (See Senate Amendment 13 for relevant provisions)

S.B. 233
Status: Failed
Relates to privacy and security of customer information obtained by a broadband internet access service provider; relates to providing a criminal penalty.

S.B. 740
Status: Failed
Relates to state contracts for broadband Internet access service. Prohibits release of customer proprietary network information--information that relates to the quantity, technical configuration, type, destination, location, and amount of use of broadband Internet access service subscribed to by a customer and that is made available to the broadband Internet access service provider by the customer solely by virtue of the provider-customer relationship. Also includes information contained in the bills pertaining to the broadband Internet access service received by the customer, except for subscriber list information.

S.B. 743
Status: Failed
Relates to requirements and prohibited practices for Internet service providers; grants rule-making authority. Prohibits release of customer proprietary network information--information that relates to the quantity, technical configuration, type, destination, location, and amount of use of broadband Internet access service subscribed to by a customer and that is made available to the broadband Internet access service provider by the customer solely by virtue of the provider-customer relationship. Also includes information contained in the bills pertaining to the broadband Internet access service received by the customer, except for subscriber list information.

District of Columbia

B. 403
Status: Failed
Creates the Broadband internet Privacy Act of 2017.

State Net logo

 

LexisNexis Terms and Conditions


*The above list is limited to legislation directed toward ISPs. States also have introduced other types of digital privacy legislation, including, for example, the bills listed below (which do not constitute a complete list of this type of legislation). Contact Pam Greenberg for additional information.

Examples of Other 2018 Internet Privacy Legislation: Commercial Websites and Online Services

Alaska


S.B. 118
Status: Failed-adjourned
Relates to the disclosure of personal information.

Illinois

H.B. 2774
Status: Failed-adjourned
Creates the Right to Know Act; provides that an operator of a commercial website or online service that collects personally identifiable information through the internet about individual customers residing in Illinois who use or visit its commercial website or online service shall notify those customers of certain specified information pertaining to its personal information sharing practices; requires an operator to make available certain specified information upon disclosing a customer's personal information.

S.B. 1502
Status: Failed-adjourned
Provides that an operator of a commercial website or online service that collects personally identifiable information through the internet about individual customers residing in Illinois who use or visit its commercial website or online service shall notify those customers of certain specified information pertaining to its personal information sharing practices; requires an operator to make available certain specified information upon disclosing a customer's personal information; provides for rights of action.

Rhode Island

H.B. 6087
Status: Failed-adjourned
Would protect individuals of this state from disclosure of personally identifiable information through the internet by operators of commercial websites or online services and would create a right of action for any operator violations. This act would take effect on July 1, 2017.