S.J.Res. 34 — FCC Broadband Privacy Rules Repeal (2017)

• Law: Senate Joint Resolution 34 — Congressional Review Act repeal of FCC Broadband Privacy Rules
• Senate vote: 50–48, straight party line
• House vote: 215–205
• Signed by: President Donald Trump, April 3, 2017
• Effect: Permanent elimination of FCC authority to require ISP opt-in consent for sale of browsing data

Your internet service provider knows every website you visit. Every app you open. Every search you run. Every news article you read. Every medical symptom you look up at 2 AM. Every political opinion you research. Every support group forum you check. They have a complete, timestamped record of your digital life — and in 2017, every Senate Republican voted to let them sell it without asking you first.

How It Passed

The backstory starts in October 2016, when the FCC under Chairman Tom Wheeler passed broadband privacy rules requiring internet service providers to obtain opt-in consent from customers before collecting and selling sensitive data including browsing history, app usage, location, financial information, health information, and Social Security numbers. The rules were set to take effect in late 2017.

They never did.

Republicans won control of Congress and the White House in November 2016. Within the first 100 days of the new Congress, the telecom industry's lobbying machine went into full operation. AT&T, Comcast, Verizon, and their trade associations — the NCTA and USTelecom — spent $22 million on lobbying in the first quarter of 2017 alone. Their message to the Republican majority was straightforward: these rules would prevent ISPs from competing with Google and Facebook in the digital advertising market. Free the market.

Congress used the Congressional Review Act to repeal the rules. The CRA is a mechanism that allows Congress to overturn recent agency regulations by simple majority vote. There is no filibuster. No 60-vote threshold. A party-line majority is sufficient. And once a CRA repeal passes, the agency is prohibited from ever passing "substantially similar" regulations again. This was not a temporary setback for broadband privacy rules. It was a permanent prohibition on the FCC ever requiring this kind of consent protection in the future.

The Senate voted 50–48. Every Republican voted yes. Every Democrat voted no. There were no defections in either direction. It was the most nakedly partisan possible vote, on a question of whether your ISP can sell your private internet history without asking you.

The House voted 215–205. Fifteen Republicans voted NO — breaking with their party to vote against selling their constituents' browsing data to data brokers. Two hundred fifteen members of Congress voted YES.

Trump signed it April 3, 2017. No fanfare. No press conference explaining to Americans that their browsing history could now be commercially sold without their knowledge or consent.

What It Does To You

Before this vote, internet service providers were going to be required to ask your permission before collecting and selling your:

• Complete web browsing history — every URL you visit, every site, every page, timestamped
• App usage data — every application you open on any device using your internet connection, how long you use it, when
• Location data — your device's physical location, derivable from network connection patterns
• Financial information — banking sites, investment accounts, financial services
• Health information — medical research, symptom searches, pharmacy sites, mental health resources, addiction recovery sites
• Content of communications — subject lines, metadata from email and messaging services accessible through your connection
• Social Security numbers and other sensitive identifiers if transmitted over your connection

After the vote, none of that requires your consent. Your ISP does not have to ask you. You have no legal right to opt out. The rules requiring opt-in consent were eliminated. The FCC is permanently prohibited from reimposing them.

What this means practically: Comcast, AT&T, Verizon, Charter, Cox, and every other ISP that serves your home or provides your mobile data connection can take everything they observe about your internet behavior and sell it. To data brokers. To insurance companies. To employers. To political campaigns. To market research firms. To advertisers. To anyone who will pay.

You cannot stop them. You cannot opt out under federal law. You can use a VPN to encrypt your traffic — which is why VPN adoption surged dramatically after April 2017. But a VPN is a technical workaround that requires cost, setup, and ongoing management. The default position for the average American who does not use a VPN is: their ISP has a complete, commercially available profile of their digital life.

The "substantially similar" ban is the permanent injury. When Congress uses the Congressional Review Act to repeal a regulation, the agency is permanently prohibited from passing "substantially similar" rules in the future. This means the FCC cannot simply re-adopt these rules under a new administration. Congress would need to pass new affirmative legislation granting the FCC explicit authority to require ISP consent — legislation that the same telecom lobby that spent $22 million in one quarter to pass this repeal would immediately target. The 2017 vote did not just kill one set of rules. It locked in the ISP's right to sell your data indefinitely.

Rights It Strips

Fourth Amendment — Privacy in Personal Data

The Fourth Amendment protects against unreasonable government searches and seizures. While the Fourth Amendment's direct application is to government action, the broader constitutional principle is that Americans have a reasonable expectation of privacy in their personal information and communications. Your browsing history is the most intimate map of your mind available — it records what you fear, what you desire, what you research, what you believe. A legal framework that allows commercial entities to sell that map without your consent — and permanently prohibits the agency from requiring consent — treats your privacy as having no legal value at all.

Informational Privacy — A Right the Supreme Court Has Recognized

The Supreme Court in Carpenter v. United States (2018) held that the government needs a warrant to access cell phone location records because of the comprehensive picture such records provide of a person's life. The logic of Carpenter — that detailed, comprehensive behavioral records deserve heightened privacy protection — applies directly to ISP browsing data. Congress, in 2017, legislated in the opposite direction: not just permitting commercial sale of this data, but permanently removing any mechanism for requiring consent.

The Right to Medical Privacy

When you research symptoms, visit telehealth platforms, check mental health resources, or look up information about addiction, chronic illness, or reproductive health, your ISP records it. After the 2017 repeal, your ISP can sell that data to insurance companies, employers, or data brokers. Health information privacy under HIPAA protects information held by healthcare providers. It does not protect the same information as observed by your ISP. The gap Congress created with this vote is the gap through which your most sensitive health data can be commercially exploited without your knowledge or consent.

Political Privacy

Your browsing history includes the political news you read, the campaigns you research, the candidates you look up, the political organizations you investigate. An ISP or data broker with this information can build a detailed political profile of you — your positions, your sympathies, your areas of concern. That profile can be sold to political campaigns, to opposition researchers, to employers making hiring decisions, to anyone with money to buy it. Political privacy — the ability to form and explore political opinions without having those opinions commercially tracked and sold — is foundational to democratic participation. Congress voted to end it.

Documented Abuses

ISP Data Brokering Confirmed

Following the repeal, telecom companies including AT&T and Verizon were documented selling customer location data to data brokers and third-party aggregators. A 2019 investigation found that major US carriers were selling real-time location data to aggregators, who resold it to bail bondsmen, bounty hunters, and others. Verizon's Precision Market Insights program and AT&T's Data Patterns Analytics program are documented commercial data products built on customer behavior data. These programs existed before the FCC rules would have applied. The repeal ensured they could not be constrained.

VPN Market Explosion as Civic Response

VPN subscriptions in the United States surged immediately after the April 2017 signing. Market research firms documented that US consumer VPN adoption grew more than 100% in 2017 compared to 2016. Americans, understanding what had been done to them, began paying private companies to encrypt their traffic — effectively building a private market workaround to a privacy right their government had eliminated. This is civic evidence of the harm: when millions of people immediately begin paying to work around a policy change, those people understand the change harmed them.

Data Broker Market Growth

The US data broker industry grew from approximately $200 billion in 2017 to over $300 billion by 2022. ISP behavioral data — browsing history, app usage, location patterns — is a significant input into data broker products sold to advertisers, employers, insurers, political campaigns, and government agencies. The removal of the consent requirement was a commercial windfall for an industry whose product is information about Americans that Americans have no practical ability to control.

The FCC's Permanent Disability

Under subsequent administrations, the FCC attempted to address broadband privacy through alternative regulatory frameworks. Those attempts were constrained by the CRA's "substantially similar" prohibition. The 2017 vote did not merely delay broadband privacy protection — it disabled the primary regulatory mechanism for providing it. Every subsequent year in which Americans lack meaningful ISP privacy protection traces directly to the 50 Senate Republicans who voted YES in 2017.

Who Pushed This

AT&T, Comcast, Verizon, and Charter were the primary direct beneficiaries and primary lobbyists. Their trade associations — the NCTA (National Cable and Telecommunications Association) and USTelecom — coordinated the lobbying campaign. The telecom industry's argument was that ISPs were being regulated more stringently than Google or Facebook for the same type of data collection. That argument ignored that ISPs occupy a fundamentally different position: they are the pipe through which all internet traffic flows, including traffic to and from Google and Facebook. An ISP can observe everything. Google and Facebook can only observe what you do on their services.

Senator Jeff Flake (R-AZ) introduced the CRA resolution in the Senate and was its lead sponsor. Flake has presented himself as a civil libertarian and opponent of government overreach. He authored legislation to eliminate the government's requirement that corporations ask permission before selling your private data. His campaign contributions from the telecom and cable industry were substantial throughout his Senate career.

Every Senate Republican who voted YES cast a recorded vote, on a question with no procedural ambiguity, to eliminate broadband privacy protections. There was no budget bill cover, no omnibus vehicle, no complexity to hide behind. The vote was: does your ISP need your permission to sell your browsing history? 50 Republicans said no.

The FTC as Ineffective Alternative: After the FCC privacy rules were eliminated, the Trump administration indicated that the FTC — not the FCC — would be the primary privacy regulator for ISPs. The FTC's authority over common carriers like ISPs was legally questionable (courts had held ISPs were excluded from FTC jurisdiction as common carriers), and in any event the FTC's enforcement mechanisms are fundamentally different from and weaker than FCC rule-making authority. The "FTC will handle it" response was not a substitute protection. It was a reassurance designed to reduce public outcry while providing no meaningful privacy guarantee.

Key Votes

Senate: 50–48 — Clean party-line vote.

• Every Republican senator voted YES. 50 votes, zero defections. This is one of the most complete party-line votes in recent Senate history on a consumer rights question.
• Every Democrat and independent voted NO. Zero defections on the opposition side either.

The Senate record on this vote is unambiguous. If your senator is a Republican who served in 2017, they voted to let your ISP sell your browsing history without consent. There is no ambiguity, no complexity, no both-sides framing possible. It was 50-48 on party lines.

House: 215–205

• 215 YES votes — predominantly Republican, with near-uniform party support
• 205 NO votes — predominantly Democratic, with 15 Republicans voting NO

The 15 House Republicans who voted NO against their party on this question have a cleaner record. Their names are documented in the congressional record.

President Trump signed the resolution April 3, 2017.

Why This Matters for We The Citizens

This vote is one of the most straightforwardly documented examples of Congress voting for corporate interests against citizen interests available in recent history. There was no national security rationale. No terrorism framing. No complexity about civil liberties tradeoffs. The question was clean: should your ISP be required to ask your permission before selling your browsing history? Every Senate Republican voted no.

The outcome is permanent. The FCC cannot restore these protections without new legislation that the telecom lobby will vigorously oppose. Every year that passes without broadband privacy legislation is a year in which your ISP has a commercially saleable record of everything you do online.

For We The Citizens, this vote exists in the congressional record, clean and unambiguous. If your senator was a Republican in 2017 and voted on this resolution, they voted YES. Check the record. Ask them why. And understand what it means when a politician tells you they believe in individual liberty and limited government while voting to eliminate your right to control who sees your most intimate behavioral data.

See also: Bad Laws Overview | FISA Section 702 | PATRIOT Act | CLOUD Act