August 2016

A new federal court ruling leaves some doubt as to who can enforce consumer protections on search engines and other edge providers and perhaps other parts of the economy as well. A panel of the US Court of Appeals for the Ninth Circuit ruled that the Federal Trade Commission was precluded from using its consumer protection authority to sue AT&T for not telling customers of its grandfathered mobile broadband "unlimited" data plans that their data use was being throttled once it reached a certain threshold. The Federal Communications Commission is pursuing a similar complaint against AT&T, which is not affected by the ruling.

But the decision could have wider implications for consumer protection and privacy regulations. The court ruled that the FTC could not enforce consumer protections—including against unfair and deceptive practices on the privacy front—on any of the activities of a common carrier, including its noncommon carrier businesses. That could conceivably immunize the non-common carrier holdings of broadband common carriers like AT&T and Verizon—or Google Fiber—from Federal Trade Commission consumer protection regulations, and, if those holdings were edge providers, the FCC could not regulate them either, at least under the current interpretation of FCC Chairman Tom Wheeler, who says the FCC lacks authority to regulate the edge.

In 2013, Yahoo announced that it would begin scanning its users' e-mail for targeted advertising purposes—just as Google does. As is par for the course, class-action lawsuits were filed. The Silicon Valley media giant, according to one of the lawsuits, was violating the "personal liberties" of non-Yahoo Mail users. That's because non-Yahoo Mail users, who have sent mail to Yahoo mail users, were having their e-mail scanned without their permission. The suit, which was one of six that were co-mingled as a single class action, demanded that a judge halt the scanning and award each victim "$5,000 or three times actual damages" in addition to "reasonable attorneys' fees and costs."

Fast forward three years. The case is now closed. Days ago, a Silicon Valley federal judge signed off on a settlement. The lawyers won, they were awarded $4 million (£3 million), and the public got nothing. What's more, the settlement allows Yahoo to continue to scan e-mails without non-Yahoo users' consent. (Yahoo Mail customers have granted consent to the scanning as a condition of using the service.) The major change the lawsuit produced was that Yahoo is agreeing to scan the e-mail while it's at rest on its servers instead of while the mail is in transit. This, according to the settlement, satisfies the California Invasion of Privacy Act (CIPA) claims. The deal spells out that Yahoo only has to do this for three years, but Yahoo said it would continue with the new scanning protocol after the three years expire.