Here's how to protect your internet browsing data now that it's for sale

Congress voted this week to allow internet service providers to sell the browsing habits of their customers to advertisers. The move, which critics charge will fundamentally undermine consumer privacy in the US, overturns Obama-era rules issued last October designed to give people more control over their personal data.

Those rules, drawn up by the Federal Communications Commission (FCC), were scheduled to take effect by the end of 2017 and would have forced ISPs to get people’s consent before selling their data to advertisers and others.

Now that they have been scrapped, ISPs such as Comcast, Verizon and AT&T are free to track all your browsing behavior and sell it to advertisers without consent. ISPs have access to literally all of your browsing behavior – they act as a gateway for all of your web visits, clicks, searches, app downloads and video streams. This represents a huge treasure trove of personal data, including health concerns, shopping habits and porn preferences. ISPs want to use this data to deliver personalized advertising.

Fortunately, there are a number of options for protecting your browsing history.

Use a different ISP

Not all ISPs want to harvest their users’ data. In fact, a list of some of the smaller players – including Sonic, Cruzio Internet and Etheric Networks – wrote a letter opposing the repeal of the FCC’s privacy rules. The problem is, most Americans, particularly those in rural areas, have very little choice of broadband provider. About 80% are stuck with just one or two options, so even if they wanted to change, they couldn’t.

Opt out

Without the privacy rules in place, ISPs can track and sell your browsing data by default, but should offer a way for users to opt out. However, they haven’t always been clear about how and when they’ve been tracking users.

We know that AT&T already tried to use consumer data to inject personalized advertising into their browsing experience and then tried to charge an extra $744 per year to opt out, but the program was killed just before the FCC introduced the new privacy rules. Meanwhile, Verizon attempted to insert undetectable “supercookies” into all of its mobile customers’ traffic, which allowed the company to track all their browsing behavior – even if a web user was browsing in incognito mode or clearing their cookies and history. The company was sued for $1.35m by the FCC for not getting customer permission to track them.

AT&T has opt-out options here and Comcast here. Contact your ISP if they don’t have any information on their website.

Use a (paid) VPN

A VPN redirects your internet traffic to disguise where your computer, phone or other device is when it makes contact with websites. It also encrypts the information you send across the internet so that it’s unreadable to anyone who wants to intercept that traffic – including ISPs.

This creates a second layer to the problem: what if the VPNs choose to sell your real browsing behavior? Reputable VPNs won’t do this, but you need to be careful about which one you choose. Generally it’s wise to avoid the free ones – if you’re not paying for it, they must be making money out of you somehow. In 2015, the free VPN service Hola was revealed to be selling its users’ idle bandwidth to paying customers, including possible botnets. Cloak and TunnelBear are good options.

Unfortunately, VPNs typically slow down your internet speed and prevent you from using some web services, such as Netflix (which is trying to prevent people from accessing content not licensed in their home countries).

Tor

Tor creates browser software that prevents people from learning your location or tracking the sites you visit. It does this by bouncing web traffic through “relays” run by thousands of volunteers around the world.

Tor can be a little fiddly to set up and so adds complexity to browsing. It also leads to slower average internet speeds and needs regular updates to ensure the connection is secure. This is not an option for technophobes.