Minnesota Internet Provider Storing, Using ‘Sensitive Personal Data’ – What Can You Do?

Well, this is creepy.

In a recent article from the tech publication Wired, they revealed that one of the country's biggest internet providers - which provides service to places in Minnesota - collects some pretty personal information. But, are they the only ones?

In the Wired story, they say that Comcast's Xfinity service, which is a major provider in the Twin Cities metro area in Minnesota, collects a significant amount of personal data by default.

The story highlights that customers are automatically opted in to permit Xfinity to collect and store personal information that some customers might find objectionable for a company to collect and have about them.

We'll explore that policy, what you can do to limit collection, and whether other internet providers in Minnesota have similar policies below.

What is being collected by Xfinity, and why?

Included in the Xfinity privacy policy are details on the data collected. The company indicates that they do not sell the data, but they may collect and store personally-identifiable "sensitive personal information" like "race, ethnicity, political affiliation, or philosophical beliefs".

Get our free mobile app

The company says they collect and store this data "to support activities like personalized recommendations, marketing and advertising, and security and fraud monitoring."

While the company says they use the data purely for internal purposes to do things like they state above, Wired does point out that having this data collected and and stored makes it available for hackers to collect. They point out Xfinity was actually the victim of a hack in 2023 where over 30 million customers had data stolen.

How can I stop this data collection?

While customers are automatically opted-in, you can change your privacy preferences via the Xfinity Privacy page to reign in the usage and collection of data. It is worth noting that shutting off this "feature" does not completely stop the company from collecting and using this data.

Their privacy page says “Even when off, we may still use your sensitive personal information for certain purposes, including to provide your Services, security purposes, and fraud monitoring."

Are other internet providers doing this too?

While there are a sizable number of internet providers (both wired and wireless companies) operating in Minnesota, I looked into a couple of the other big players in the state to see how their privacy policies compare.

In looking at Charter-Spectrum, Midco (Midcontinent Communications), and CenturyLink, none of these providers specifically highlight the sensitive personal data Xfinity says they collect. That doesn't mean they aren't collecting anything, however.

All three of these providers say they collect basic information like device type, operating system, and approximate location, along with some level of web activity tracking, though it varies from provider to provider.

Of particular interest is that all three providers (all using different verbiage) say that they collect internet usage data, which can include personally-identifiable information like demographic data from the usage of cookies, beacons, and other tracking technologies.

While notably more vague than Xfinity's policy, this demographic data can similarly be used to identify users' political affiliations, beliefs, ethnicity, etc., like what is disclosed in the Xfinity policy.

If you want to read the specifics of any of these three company's privacy policies, you can find them here: Spectrum Privacy Policy  |  Midco Privacy Statement  |  CenturyLink Privacy Policy

The takeaway is that while most people either gloss over (or completely ignore) those privacy and usage policies, reading through them can be a good idea. Especially for stuff you are automatically opted-in for that you can opt out of.