2017 Privacy Legislation Related to Internet Service Providers

12/29/2017

About half the states have introduced measures, largely in response to the repeal of federal Internet privacy protections that were approved by the Federal Communications Commission in the final days of the Obama administration.

The rules, which had not yet gone into effect, would have put tough restrictions on what internet service providers could do with consumer data collected. For example, under the FCC's rules, providers would have needed permission from customers before collecting and sharing data, including user's health and financial details, web browsing history, app usage and geo-location.

Currently, two states, Nevada and Minnesota, require internet service providers (ISPs) to keep private certain information concerning their customers, unless the customer gives permission to disclose the information. Both states prohibit disclosure of personally identifying information, but Minnesota also requires ISPs to get permission from subscribers before disclosing information about the subscribers' online surfing habits and Internet sites visited.

In 2017, Nevada also enacted S.B. 538, which requires operators of Internet websites or online services that collect personally identifiable information from residents of the state to notify consumers about how that information is used. (Similar to earlier laws in California and Delaware.)

 

2017 Legislation Related to Privacy Practices of Internet Service Providers

At least 22 states and the District of Columbia filed measures requiring internet or telecommunications service providers to keep specified information confidential, as listed below. Please check individual legislative websites for the most current status, summaries and versions of bill and amendment text.

Alaska

H.B. 230
Status: Pending - Carryover
Relates to the collection of customer information by telecommunications and Internet service providers; establishes an unfair trade practice under the Alaska Unfair Trade Practices and Consumer Protection Act.

H.B. 232
Status: Pending - Carryover
Relates to the collection of customer information by telecommunications and Internet service providers; establishes an unfair trade practice under the Alaska Unfair Trade Practices and Consumer Protection Act.

California

A.B. 375
Status: Pending - Carryover.
The California Broadband Internet Privacy Act would prohibit an Internet service provider from using, disclosing, selling, or permitting access to customer personal information, except as provided in that act. The bill would authorize a customer to give prior opt-in consent, which may be revoked by the customer at any time, to an Internet service provider to use, disclose, sell, or permit access to that customer's personal information. The bill would prohibit an Internet service provider from refusing to serve or to limit service to a customer who does not provide consent or charging a customer a penalty or offering a customer a discount or another benefit based on the customer's decision to provide consent.

Colorado

H.J.R. 1032
Status: Adopted
Concerns the protection of online privacy for Colorado citizens. 

Connecticut

S.B. 974
Status: Failed-Adjourned.
Creates an eight-member working group to study 1) broadband internet access service consumer data privacy, 2) broadband internet access service industry standards on consumer data protection, 3) how to define “sensitive customer personal information” and “nonsensitive customer personal information,” 4) ways to notify customers of consumer data privacy provisions, and 5) ways of enforcing consumer data privacy laws.

Hawaii

S.B. 1201
Status: Pending - carryover (but privacy provisions in section (h) of SB1201_HD3_PROPOSED are not included in current version.)
Establishes within the Department of Business, Economic Development, and Tourism a Broadband Task Force to develop a statewide broadband plan to address fee updates, regulations, and technological advancements in broadband. 

Kansas

H.B. 2423
Status: Pending - Carryover
Prohibits the collection and sale of personal data by internet service providers.

Maine

S. 566/ LD 1610
Status: Pending - Carryover
This bill prohibits a provider of broadband internet access service from using, disclosing, selling or permitting access to customer personal information unless the customer expressly consents to that use, disclosure, sale or access. The bill provides other exceptions under which a provider may use, disclose, sell or permit access to customer personal information. The bill prohibits a provider from refusing to serve a customer, charging a customer a penalty or offering a customer a discount if the customer does or does not consent to the use, disclosure, sale or access.

Maryland

S.B. 1200
Status: Failed--adjourned.
Makes it an unfair or deceptive trade practice under the Maryland Consumer Protection Act for an Internet service provider to sell or transfer a consumer's personally identifying information without the consumer's express and affirmative permission; makes it an unfair or deceptive trade practice under the Maryland Consumer Protection Act for an Internet service provider to display or send advertisements to a consumer based on the consumer's browsing history without the express and affirmative permission

Massachusetts

H.B. 3698
Status: Pending
Relates to the disclosure of customer proprietary information by internet service providers.

H.B. 3766
Status: Pending
Prohibits certain telecommunications or internet service providers from collecting personal information from customers without express written approval.

S.B. 2053
Status: Pending
Ensures internet security and privacy.

S.B. 2062
Status: Pending
Relates to internet service providers.

Minnesota

H.B. 2209
Status: Pending - Carryover
Relates to labor and industry; appropriates money for the labor standards and apprenticeship division. (See Article 9, section 4.)

H.B. 2579
Status: Pending - Carryover
Relates to telecommunications; data privacy; prohibits collection of personal information absent customer's express written approval.

H.B. 2606
Status: Pending - Carryover
Relates to telecommunications; data privacy; prohibits collection of personal information without customer's express written approval.

S.B. 1937
Status: Vetoed by governor.
Relates to state government; appropriates money for jobs and economic development; appropriates money for the Department of Employment and Economic Development, Housing Finance Agency, Department of Labor and Industry, Bureau of Mediation Services, Workers' Compensation Court of Appeals, Department of Commerce, Public Utilities Commission, Public Facilities Authority, and the Department of Iron Range Resources and Rehabilitation; makes policy and housekeeping changes to labor and industry provisions. (See Senate floor amendment.)

S.B. 2309
Status: Pending - Carryover
Relates to telecommunications; relates to data privacy; prohibits collection of personal information absent customer's express written approval.

S.B. 2323
Status: Pending - Carryover
Relates to telecommunications; relates to data privacy; prohibits collection of personal information absent customer's express written approval.

S.B. 2438
Status: Pending - Carryover
Relates to commerce; requires telecommunications service providers to comply with Internet privacy requirements; requires express approval of disclosure of personally identifiable information; increases civil liability threshold.

Montana

H.B. 2
Status: May 9, 2017; Signed by Governor; however, enacted version and S.B. 95 do not contain relevant provisions in earlier version.
General Appropriations Act of 2017. ISP contract restriction implementation is contingent on passage and approval of S.B. 95 containing a provision prohibiting a telecommunications or internet service provider from collecting a customer’s personal information without the customer’s consent. 

Nebraska

L.R. 136
Status: Failed - adjourned.
Allows for an interim study to examine the effect of the Congressional passage of Joint Resolution, S. J. 34, which disapproved the Federal Communications Commission final rules for Protecting the Privacy of Customers of Broadband and Other Telecommunications Services.

New Jersey

A.B. 2037
Status: Failed-adjourned.
Directs the Board of Public Utilities (BPU), in consultation with the Division of Consumer Affairs in the Department of Law and Public Safety, to develop a public awareness campaign to promote awareness among State residents about the disclosure of customer propriety network information by telecommunications carriers. The campaign may include print and electronic media. The public awareness campaign that the BPU is directed to develop includes, but is not limited to, the following information: (1) a comprehensive summary of State and federal law concerning the disclosure of customer proprietary network information by telecommunications carriers; (2) the circumstances under which a telecommunications carrier may disclose customer proprietary network information; and (3) information on accessing and understanding the privacy policies of telecommunications carriers.

A.B. 4800
Status: Failed-adjourned.
Requires internet service providers to keep confidential and prohibit any disclosure, sale, or unauthorized access to subscriber's personally identifiable information unless subscriber authorizes Internet service provider in writing to disclose information.

A.B. 4819
Status: Failed-adjourned.
Requires internet service providers to keep confidential subscriber's personally identifiable information unless subscriber authorizes Internet service provider in writing to disclose information.

A.B. 4838
Status: Failed-adjourned
Requires internet service providers to keep confidential subscriber's personally identifiable information unless subscriber opts-in when subscribing and renewing service to allow Internet service provider to disclose information.

A.B. 4897
Status: Failed-adjourned
Requires Internet service providers to keep confidential subscriber's personally identifiable information unless subscriber authorizes Internet service provider in writing or email to disclose information; prohibits subscriber penalty.

S.B. 3156
Status: Failed-adjourned
Requires internet service providers to keep confidential subscriber's personally identifiable information unless subscriber authorizes Internet service provider in writing to disclose information. 

New York

A.B. 7191
Status: Pending
Prohibits the disclosure of personally identifiable information by an internet service provider without the express written approval of the customer.

A.B. 7236
Status: Pending
Requires internet service providers to provide customers with a copy of their privacy policy and to obtain written and explicit permission from a customer prior to sharing, using, selling or providing to a third party any sensitive information of such customer.

A.B. 7495
Status: Pending
Relates to the sale of personal information by an internet service provider.

S.B. 3367
Status: Pending
Relates to internet service provider privacy requirements.

S.B. 5516
Status: Pending
Relates to the sale of personal information by an internet service provider.

S.B. 5576
Status: Pending
Requires internet service providers to provide customers with a copy of their privacy policy and to obtain written and explicit permission from a customer prior to sharing, using, selling or providing to a third party any sensitive information of such customer.

S.B. 5603
Status: Pending
Prohibits the disclosure of personally identifiable information by an internet service provider without the express written approval of the customer

North Dakota

H.B. 2015
Status: May 2, 2017; Enacted; however, the provision for the study is not included in current version.
Provides an appropriation. Provides for a study of the privacy policies of telecommunications service providers and internet service providers, and identifying potential issues for legislation. 

Oregon

H.B. 2813
Status: Failed--adjourned. 
Prohibits broadband Internet access service provider from disclosing, selling or permitting access to personal information of customers of provider. Creates exceptions, including exception for giving express consent.
 

Pennsylvania

H.B. 1863
Status: Pending

Prohibits a provider of broadband Internet access service from using, disclosing, selling or permitting access to customer personal information unless the customer expressly consents to that use, disclosure, sale or access. The bill provides other exceptions under which a provider may use, disclose, sell or permit access to customer personal information. The bill prohibits a provider from refusing to serve a customer, charging a customer a penalty or offering a customer a discount.

Rhode Island

H.B. 6086 
Status: Pending
Would prevent any state or municipal agency's telecommunications or Internet contractor from collecting and disseminating the personal information of customers. This act would take effect upon passage.

South Carolina

H.B. 4154
Status: Pending - Carryover
Provides that a telecommunications or internet service provider that has entered into a franchise agreement, right of way agreement, or other contract with the state of South Carolina or one of its political subdivisions, or that uses facilities that are subject to those agreements, even if it is not a party to the agreement, may not collect personal information from a customer resulting from the customers use of the telecommunications or internet service provider without express written approval from.

Washington

H.B. 2200
Status: Pending - Carryover
Protecting the privacy and security of internet users.

S.B. 5919
Status: Pending - Carryover
Concerns consumer protection of internet privacy.

Wisconsin

A.B. 123
Status: Pending
Relating to: the information technology block grant program, the broadband expansion grant program, waiving certain fees and appraisals, and making appropriations.(See Senate Amendment 1 for relevant provisions)

S.B. 49
Status: Pending
Relates to the information technology block grant program; relates to the broadband expansion grant program; relates to waiving certain fees and appraisals; makes appropriations. (See Senate Amendment 13 for relevant provisions)

S.B. 233
Status: Pending
Relates to privacy and security of customer information obtained by a broadband Internet access service provider; relates to providing a criminal penalty.

Vermont

H.B. 535
Status: Pending
Relates to privacy and data security rules applicable to telecommunications service providers, including Internet service providers.

S.B. 72
Status: Enacted
Requires the attorney general, on or before Dec. 15, 2018, to submit a recommendation or draft legislation to Senate and House Committees as to whether and to what extent the state should adopt privacy and data security rules applicable to telecommunications service providers.

S.B. 147
Status: Pending
Relates to privacy and data security rules applicable to telecommunications service providers, including Internet service providers.

District of Columbia

B. 403
Status: Pending
Creates the Broadband Internet Privacy Act of 2017.

State Net logo

 

LexisNexis Terms and Conditions

 
Note: Media reports have indicated that legislators in additional states have plans to introduce similar legislation. Those states include Michigan and Pennsylvania. Please contact Pam Greenberg with questions or updates. 
 

*Thie above list is limited to legislation related to ISPs. States also have introduced other types of digital privacy legislation, including, for example, the bills listed below (which do not constitute a complete list of this type of legislation). Contact Pam Greenberg for additional information.

Examples of Other Internet Privacy Legislation: Commercial Websites and Online Services

Alaska

S.B. 118
Status: Pending - Carryover
Relates to the disclosure of personal information.

Illinois

*H.B. 2774
Status: Pending
Creates the Right to Know Act; provides that an operator of a commercial website or online service that collects personally identifiable information through the internet about individual customers residing in Illinois who use or visit its commercial website or online service shall notify those customers of certain specified information pertaining to its personal information sharing practices; requires an operator to make available certain specified information upon disclosing a customer's personal information.

*S.B. 1502
Status: Pending
Provides that an operator of a commercial website or online service that collects personally identifiable information through the internet about individual customers residing in Illinois who use or visit its commercial website or online service shall notify those customers of certain specified information pertaining to its personal information sharing practices; requires an operator to make available certain specified information upon disclosing a customer's personal information; provides for rights of action.

Nevada

S.B. 538
Status: Enacted, Chap. 570.
Requires the operator of an Internet website or online service that collects certain information from residents of Nevada to provide notice of certain provisions relating to the privacy of the information collected by the operator.  

New Jersey

A.B. 4817
Status: Pending
Requires commercial Internet website and online service operators to notify customers of collection and disclosure of personally identifiable information to third parties.

Rhode Island

*H.B. 6087
Status: Pending
‚Äč
Would protect individuals of this state from disclosure of personally identifiable information through the Internet by operators of commercial websites or online services and would create a right of action for any operator violations. This act would take effect on July 1, 2017.