Last week, the Federal Communications Commission (FCC) released landmark protections for internet users, requiring permission from broadband subscribers before broadband providers can collect data on the subscribers’ web browsing, app use, location information or financial information. Broadband providers rely on subscriber data like this to create sophisticated, targeted advertising. Tom Wheeler, Chairman of the FCC, said, “There is a basic truth: It is the consumer’s information. It is not the information of the network the consumer hires to deliver that information.”

Many privacy groups applaud the FCC’s efforts. The Center for Digital Democracy’s executive director, Jeffrey Chester, said, “For the first time, the public will be guaranteed that when they use broadband to connect to the internet, whether on a mobile device or personal computer, they will have the ability to decide whether and how much of their information can be gathered.”

However, these FCC regulations have their limits. Some web companies, like Facebook for example, are not subject to these regulations. The FCC does not have jurisdiction over those type of web companies; they are instead required to follow the Federal Trade Commission’s (FTC) general consumer protection laws. That means that consumers’ web browsing habits are not all protected from passive collection. Additionally, broadband providers who also provide digital services will still be able to collect data from those services –the broadband providers are only limited in their broadband business (e.g., users of the HBO Now app can still have their data collected since that type of data collection is not subject to the regulations).

Broadband providers have one year to make changes required by these new regulations. They must notify their customers of the new privacy options through email or pop-ups on their websites. Then once the rules are in effect, broadband providers will immediately cease collection of sensitive data (as defined by the FCC) such as Social Security numbers and health data, unless the subscriber provides consent.