gdpr personal-information
Can ISPs in the EU (covered by GDPR) record the device IDs on a home network?
<p>In theory an ISP who provides a integrated router/Wifi point could sniff and record the traffic from individual devices on a home network. These devices (like PCs, phones and tablets) could be identified by internal IP address or MAC address of the device so are almost certainly counted as a personal identifier.</p>
<p>Are ISPs in the EU allowed to record this data and provide metrics on activity and bandwidth usage by device? what about websites accessed from each device?</p>

<p>Information about devices in a network is traffic data within the meaning of the EU ePrivacy Directive. Such traffic data can only be used under limited circumstances, in particular if the data has been anonymized or if the user has given consent.</p>
<p>Traffic data can also be used for billing purposes. E.g. the ISP might have a billing model where the access point is actually a public access point open to all of the ISP's customers, and the customer pays for per-device access. In that setting, it would be clearly permissible to process MAC addresses etc from the local WiFi network.</p>
<p>The ISP can provide “value added services”, but only if the user gives their consent. The ISP must explain for what purposes which data will be processed for how long. While the subscriber would perform the opt-in, I think the subscriber would then have to inform other participants on the private network, e.g. family members. Consent has to fulfil the GPDR's requirements, i.e. must be freely given, informed, specific, and must be easy to withdraw.</p>
<p>If the ISP provides a router that is capable of collecting metrics like bandwidth usage or collecting a clickstream, but it is the user who configures this router to enable the feature, then I don't necessarily think that the ISP would be responsible in any way for this data processing. From a GDPR perspective, the ISP might not be data controller for this processing. From an ePrivacy perspective, that is not processing on a public communications network and therefore largely out of scope. In other words, a user can surveil themselves but the ISP might not be involved in this in any legally relevant way.</p>
<p>Technical notes:</p>
<ul>
<li>IP addresses are usually assigned in a local network based on the MAC address of the device joining a network (DHCP protocol). Thus, MAC addresses are the most important identifier.</li>
<li>However, MAC addresses can be freely chosen by devices.</li>
<li>Due to HTTPS Server Name Identification, the domain names of websites you visit are always visible to the ISP, even when using HTTPS encryption. They don't need access to your local network for this. But as discussed above they are limited in how they can use this information. E.g. they could create anonymous statistics, or offer value added services if given consent. Billing purposes like zero-rating also come to mind, though that would be more straightforward to do based on server IP addresses.</li>
</ul>
