Feeds

NebuAd plays cat and mouse with data pimping opt-out

'We don't observe, but we may track'

Providing a secure and efficient Helpdesk

Though Phorm-like behavioral ad targeter NebuAd has vowed to replace its cookie-based opt-out mechanism with an opt-out that's less crumbly, it appears that neither opt-out would completely opt you out.

NebuAd tracks the online search and browsing activity of net surfers using deep packet inspection hardware installed inside American ISPs, before tossing this data to various online advertising networks. The company does not require an opt-in, but it has always offered a cookie-based opt-out.

Really, such a system should be opt-in only. But even the company's opt-out setup is a mess.

The cookie approach is problematic for many reasons. If you switch browsers or machines, you're no longer opted out. And those privacy-minded folk who periodically remove their cookies are out of luck. So the company is "developing a network-based opt-out mechanism that is not reliant on web browser cookies." But there's another problem.

Back in April, the company told us that "Once a user opts out, the user's surfing habits are no longer being observed by NebuAd. Once a user opts out, NebuAd removes the history on the user and will ignore the user's subsequent surfing habits." We took this to mean that if web surfers set that opt-out cookie, they're no longer tracked by NebuAd's hardware. But that may not be the case.

Some have speculated that NebuAd servers outside the ISP - and not the deep packet inspection (DPI) servers on inside - deal with opt-outs. Even if you opt-opt, these voices say, the deep packet inspection continues.

Robb Topolski, chief technology consultant for Free Press and Public Knowledge, two net watchdogs taking a stand against the likes of Phorm and NebuAd, argues that NebuAd has probably given the opt-out duties to those external servers in order to keep loads light on the DPI boxes.

"I...personally understand that these DPI boxes that are within the ISPs - while fast and capable - are kept to a minimum of processing load," he tells us. "ISPs won't tolerate anything that might limit or slow down the network, so these boxes are given quick and easy things to do."

So we've asked NebuAd yet again: If users opt-out, does their browsing history still leave the ISP's network? Are they still tracked by NebuAd hardware? And we received another carefully worded response: "When the user opts out, NebuAd does not collect the data on that user, and we do not serve targeted ads to that user. The data flowing through the system is immediately and permanently flushed out."

Does that mean your data leaves your ISP even if you opt-out? Sure sounds like it. But the company wouldn't comment further. And that's the trouble with NebuAd. It won't put its cards on the table. At the very least, web surfers deserve to know what's what. ®

Update

An earlier version of this story linked to a description of NebuAd's service that appeared to be from Juniper Networks. This link may be bogus, and we have removed it.

Choosing a cloud hosting partner with confidence

More from The Register

next story
Brit telcos warn Scots that voting Yes could lead to HEFTY bills
BT and Co: Independence vote likely to mean 'increased costs'
Phones 4u slips into administration after EE cuts ties with Brit mobe retailer
More than 5,500 jobs could be axed if rescue mission fails
New 'Cosmos' browser surfs the net by TXT alone
No data plan? No WiFi? No worries ... except sluggish download speed
Radio hams can encrypt, in emergencies, says Ofcom
Consultation promises new spectrum and hints at relaxed licence conditions
Blockbuster book lays out the first 20 years of the Smartphone Wars
Symbian's David Wood bares all. Not for the faint hearted
Bonking with Apple has POUNDED mobe operators' wallets
... into submission. Weve squeals, ditches payment plans
This flashlight app requires: Your contacts list, identity, access to your camera...
Who us, dodgy? Vast majority of mobile apps fail privacy test
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.