2019-20 Privacy Legislation Related to Internet Service Providers

6/29/2020

Beginning in 2017, several states began introducing legislation to restrict how internet service providers can collect or share consumer data. These states introduced legislation largely in response to the repeal of federal rules that would have put in place certain internet privacy protections.

The rules, which had not yet isp datagone into effect, would have placed restrictions on what internet service providers could do with consumer data collected. For example, under the FCC's rules, providers would have needed permission from customers before collecting and sharing data, including user's health and financial details, web browsing history, app usage and geo-location.

Although about half the states in 2017 and 2018 introduced state legislation to reimpose privacy protections, none of the ISP-related privacy provisions in the bills passed.

In 2019 Maine enacted legislation requiring ISPs to keep information private unless the customer expressly consents to its sharing. It also provides other exceptions under which a provider may use, disclose, sell, or permit access to customer personal informatio and prohibits a provider from refusing to serve a customer, charging a customer a penalty, or offering a customer a discount. The new law has been challenged, in U.S. District Court in Portland, as violating the First Amendment.

Two other states, Nevada and Minnesota, also require internet service providers (ISPs) to keep private certain information concerning their customers, unless the customer gives permission to disclose the information. Both states prohibit disclosure of personally identifying information, but Minnesota also requires ISPs to get permission from subscribers before disclosing information about the subscribers' online surfing habits and internet sites visited.

2020 Legislation Related to Privacy Practices of Internet Service Providers

At least 14 states in 2020 introduced or are considering measures requiring internet or telecommunications service providers to keep specified information confidential, as listed below.

California

CA AB 523
Status: Pending
Prohibits a provider of mobile telephony services, or any direct or indirect affiliate or agent of the provider, from disclosing a subscriber's historical, current, or prospective cell site location without first obtaining the express consent of the subscriber. Exempts from the disclosure requirement of the Public Record Act, records of cell site locations obtained by certain public agencies for specified purposes.

Connecticut

CT SB 5
Status: Failed - Adjourned
Concerns internet service providers and net neutrality principles, requires Internet service providers to register and pay registration fees and to require the Public Utilities Regulatory Authority to apply net neutrality principles to Internet service providers and enforce such principles with civil penalties.

Illinois

IL HB 5638
Status: Pending
Amends the Consumer Fraud and Deceptive Business Practices Act, provides that Internet service providers must keep all customer information confidential unless written consent is provided by the customer.

Kentucky

KY SB 246
Status: Failed - Adjourned
Prohibits a provider of broadband Internet access service from using, disclosing, selling, or permitting access to customer personal information unless the customer expressly consents to that use, disclosure, sale, or access, provides other exceptions under which a provider may use, disclose, sell, or permit access to customer personal information.

Massachusetts

MA HB 382
Status: Pending
Relates to the collection, use, disclosure or dissemination of personal information from customers of telecommunications or internet service providers.

MA SB 1936
Status: Pending
Promotes net neutrality and consumer protection.

Maryland

MD SB 1005
Status: Failed - Adjourned
Specifies the circumstances under which a broadband Internet access service provider may handle certain customer personal information in a certain manner, establishes a mechanism through which a broadband Internet access service provider may obtain customer consent to have certain personal information handled in a certain manner.

Minnesota

MN HB 1030
Status: Failed - Adjourned
Relates to telecommunications and data privacy, prohibits the collection of personal information absent a customer's express written approval.

MN SB 433
Status: Failed - Adjourned
Relates to telecommunications, data privacy, prohibits collection of personal information absent customers express written approval.

MN SB 1553
Status: Failed - Adjourned
Relates to commerce, requires telecommunications service providers to comply with Internet privacy requirements, defines terms and modifying definitions, requires express approval of disclosure of personally identifiable information, increases civil liability threshold.

New Jersey

NJ AB 558
Status: Pending
Requires Internet service providers to keep confidential subscriber's personally identifiable information unless subscriber authorizes Internet service provider in writing to disclose information.

NJ AB 1175
Status: Pending
Requires Internet service providers to keep confidential and prohibit any disclosure, sale, or unauthorized access to subscriber's personally identifiable information unless subscriber authorizes Internet service provider in writing to disclose information.

NJ AB 2171
Status: Pending
Requires Internet service providers to keep confidential subscriber's personally identifiable information unless subscriber authorizes Internet service provider in writing or email to disclose information, prohibits subscriber penalty.

NJ AB 2489
Status: Pending
Prohibits commercial mobile service providers and mobile application developers from disclosing customer's location data to third parties.

NJ SB 1238
Status: Pending
Requires Internet service providers to keep confidential subscriber's personally identifiable information unless subscriber authorizes Internet service provider in writing to disclose information.

NJ SB 1657
Status: Pending
Prohibits commercial mobile service providers and mobile application developers from disclosing customer's location data to third parties.

New York

NY AB 2420
Status: Pending
Prohibits the disclosure of personally identifiable information by an internet service provider without the express written approval of the consumer.

NY AB 3612
Status: Pending
Requires internet service providers to provide customers with a copy of their privacy policy and to obtain written and explicit permission from a customer prior to sharing, using, selling or providing to a third party any sensitive information of such customer.

NY AB 8530
Status: Pending
Establishes a prohibition on sharing location data with third parties, allows municipalities to enact local Laws or ordinances prohibiting location data sharing.

NY SB 518
Status: Pending
Prohibits the disclosure of personally identifiable information by an internet service provider without the express written approval of the consumer.

NY SB 1180
Status: Pending
Prohibits internet service providers from disclosing personally identifiable information where a consumer requests that his or her information not be disseminated, defines terms, makes exceptions, imposes a civil penalty.

NY SB 1464
Status: Pending
Requires that internet service provider requirements keep all customer information confidential unless written consent is provided by the customer.

NY SB 5245
Status: Pending
Relates to the sale of personal information by an internet service provider.

Pennsylvania

PA HB 246
Status: Pending
Regulates electronic mail solicitations, protects privacy of Internet consumers, regulates use of data about Internet users, prescribes penalties.

South Carolina

SC HB 3339
Status: Pending
Provides that a telecommunications or internet service provider that has entered into a franchise agreement, right of way agreement, or other contract with the state of South Carolina or one of its political subdivisions, or that uses facilities that are subject to those agreements, even if it is not a party to the agreement, may not collect personal information from a customer resulting from the customer's use of the telecommunications.

SC HB 3701
Status: Pending
Enacts the state Cellular Data Privacy Protection Act, defines relevant terms, prohibits a mobile telecommunications provider from selling a customer's personal data to a third party, imposes a penalty, authorizes the attorney general to investigate and enforce alleged violations of this act.

South Dakota

SD SB 101
Status: Failed - Adjourned
Prohibits internet service providers from selling certain customer data without consent.

Vermont

VT SB 260
Status: Pending
Relates to the Vermont Broadband Internet Access Service Privacy Act.

Wyoming

WY HB 101
Status: Failed
Relates to consumer protection, provides for the protection of customer personal information for broadband internet access service, defines terms, provides for penalties and other enforcement, provides for an effective date.

State Net logo

 

LexisNexis Terms and Conditions

 

2019 Legislation Related to Privacy Practices of Internet Service Providers

At least 14 states introduced or are considering measures requiring internet or telecommunications service providers to keep specified information confidential, as listed below. Maine was the only state to enact legislation in 2019. 

California

A.B. 523
Status: Pending-carryover
Prescribes the circumstances under which telephone and telegraph corporations may release specified information, including customer proprietary network information, regarding noncommercial subscribers without their written consent. Specifically includes geolocation information in the information that may only be released with a noncommercial subscriber's written consent.

Connecticut

S.B. 6
Status: Failed
Requires Internet service providers to register and pay registration fees and require the Public Utilities Regulatory Authority to apply net neutrality principles to Internet service providers and enforce such principles with civil penalties and to prohibit certain telecommunications companies, certified telecommunications providers, certified competitive video service providers and Internet service providers from collecting personal information.

Kentucky

S.B. 243
Status: Failed
Creates a new section of KRS Chapter 365 prohibiting telecommunications companies from disclosing or transmitting to a third party any location data derived from a cellular phone without the consent of the customer.

Louisiana

H.B. 465
Status Failed
Relates to internet privacy and protection.

Maine

LR 2222
Status: Failed-adjourned
Regards net neutrality and internet privacy.

S.B. 275 / LD 946
Status: Enacted, Chap. 216
Prohibits a provider of broadband Internet access service from using, disclosing, selling, or permitting access to customer personal information unless the customer expressly consents to such, provides other exceptions under which a provider may use, disclose, sell, or permit access to customer personal information, prohibits a provider from refusing to serve a customer, charging a customer a penalty, or offering a customer a discount.

Maryland

H.B. 141
Status: Failed
Specifies the circumstances under which a broadband Internet access service provider may handle certain customer personal information, establishes a mechanism through which a broadband Internet access service provider may obtain customer consent to have certain personal information handled in a certain manner.

Massachusetts

H.B. 382
Status: Pending
Relates to the collection, use, disclosure or dissemination of personal information from customers of telecommunications or internet service providers.

S.B. 1936
Status: Pending
Promotes net neutrality and consumer protection.

Minnesota

H.B. 1030
Status: Pending-carryover
Relates to telecommunications and data privacy, prohibits the collection of personal information absent a customer's express written approval.

S.B. 433
Status: Pending-carryover
Relates to telecommunications, data privacy, prohibits collection of personal information absent customers express written approval.

S.B. 1553
Status: Pending-carryover
Relates to commerce, requires telecommunications service providers to comply with Internet privacy requirements, defines terms and modifying definitions, requires express approval of disclosure of personally identifiable information, increases civil liability threshold.

Montana

H.B. 457
Status: Failed
Protects personal information of internet customers, require opt in consent, relates to consumer protection, relates to information technology, relates to privacy, relates to state revenue, relates to rule making.

New Jersey

A.B. 1527
Status: Pending
Requires Internet service providers to keep confidential and prohibit any disclosure, sale, or unauthorized access to subscriber's personally identifiable information unless subscriber authorizes Internet service provider in writing to disclose information.

A.B. 1927
Status: Pending
Requires Internet service providers to keep confidential subscriber's personally identifiable information unless subscriber authorizes Internet service provider in writing or email to disclose information, prohibits subscriber penalty.

A.B. 2958
Status: Pending
Directs Board of Public Utilities to undertake public awareness campaign concerning telecommunications carriers, including mobile and Voice over Internet Protocol service providers, and disclosure of customer information.

A.B. 3711
Status: Pending
Requires Internet service providers to keep confidential subscriber's personally identifiable information unless subscriber authorizes Internet service provider in writing to disclose information.

S.B. 1754
Status: Pending
Requires Internet service providers to keep confidential subscriber's personally identifiable information unless subscriber authorizes Internet service provider in writing to disclose information.

S.B. 1754
Status: Pending
Requires Internet service providers to keep confidential subscriber's personally identifiable information unless subscriber authorizes Internet service provider in writing to disclose information.

S.B. 2641
Status: Pending
Requires Internet service providers to keep confidential and prohibit any disclosure, sale, or unauthorized access to subscriber's personally identifiable information unless subscriber authorizes Internet service provider in writing to disclose information.

S.R. 46
Status: Pending
Affirms right to privacy despite federal authorization of expansion government surveillance and deregulation of electronic information sharing.

New York

A.B. 2420
Status: Pending
Prohibits the disclosure of personally identifiable information by an internet service provider without the express written approval of the consumer.

A.B. 3612
Status: Pending
Requires internet service providers to provide customers with a copy of their privacy policy and to obtain written and explicit permission from a customer prior to sharing, using, selling or providing to a third party any sensitive information of such customer.

S.B. 518
Status: Pending
Prohibits the disclosure of personally identifiable information by an internet service provider without the express written approval of the consumer.

S.B. 1180
Status: Pending
Prohibits internet service providers from disclosing personally identifiable information where a consumer requests that his or her information not be disseminated, defines terms, makes exceptions, imposes a civil penalty.

S.B. 1464
Status: Pending
Requires that internet service provider requirements keep all customer information confidential unless written consent is provided by the customer.

S.B. 5245
Status: Pending
Relates to the sale of personal information by an internet service provider.

Pennsylvania

H.B. 246
Status: Pending-carryover
Regulates electronic mail solicitations, protects privacy of Internet consumers, regulates use of data about Internet users, prescribes penalties.

South Carolina

H.B. 3339
Status: Pending
Provides that a telecommunications or internet service provider that has entered into a franchise agreement, right of way agreement, or other contract with the state of South Carolina or one of its political subdivisions, or that uses facilities that are subject to those agreements, even if it is not a party to the agreement, may not collect personal information from a customer resulting from the customer's use of the telecommunications.

H.B. 3701
Status: Pending-carryover
Enacts the state Cellular Data Privacy Protection Act, defines relevant terms, prohibits a mobile telecommunications provider from selling a customer's personal data to a third party, imposes a penalty, authorizes the attorney general to investigate and enforce alleged violations of this act.

Utah

H.B. 490
Status: Failed
Enacts provisions related to broadband Internet access service.

State Net logo

 

LexisNexis Terms and Conditions

Additional Resources