Feeds

NebuAd plays cat and mouse with data pimping opt-out

'We don't observe, but we may track'

Internet Security Threat Report 2014

Though Phorm-like behavioral ad targeter NebuAd has vowed to replace its cookie-based opt-out mechanism with an opt-out that's less crumbly, it appears that neither opt-out would completely opt you out.

NebuAd tracks the online search and browsing activity of net surfers using deep packet inspection hardware installed inside American ISPs, before tossing this data to various online advertising networks. The company does not require an opt-in, but it has always offered a cookie-based opt-out.

Really, such a system should be opt-in only. But even the company's opt-out setup is a mess.

The cookie approach is problematic for many reasons. If you switch browsers or machines, you're no longer opted out. And those privacy-minded folk who periodically remove their cookies are out of luck. So the company is "developing a network-based opt-out mechanism that is not reliant on web browser cookies." But there's another problem.

Back in April, the company told us that "Once a user opts out, the user's surfing habits are no longer being observed by NebuAd. Once a user opts out, NebuAd removes the history on the user and will ignore the user's subsequent surfing habits." We took this to mean that if web surfers set that opt-out cookie, they're no longer tracked by NebuAd's hardware. But that may not be the case.

Some have speculated that NebuAd servers outside the ISP - and not the deep packet inspection (DPI) servers on inside - deal with opt-outs. Even if you opt-opt, these voices say, the deep packet inspection continues.

Robb Topolski, chief technology consultant for Free Press and Public Knowledge, two net watchdogs taking a stand against the likes of Phorm and NebuAd, argues that NebuAd has probably given the opt-out duties to those external servers in order to keep loads light on the DPI boxes.

"I...personally understand that these DPI boxes that are within the ISPs - while fast and capable - are kept to a minimum of processing load," he tells us. "ISPs won't tolerate anything that might limit or slow down the network, so these boxes are given quick and easy things to do."

So we've asked NebuAd yet again: If users opt-out, does their browsing history still leave the ISP's network? Are they still tracked by NebuAd hardware? And we received another carefully worded response: "When the user opts out, NebuAd does not collect the data on that user, and we do not serve targeted ads to that user. The data flowing through the system is immediately and permanently flushed out."

Does that mean your data leaves your ISP even if you opt-out? Sure sounds like it. But the company wouldn't comment further. And that's the trouble with NebuAd. It won't put its cards on the table. At the very least, web surfers deserve to know what's what. ®

Update

An earlier version of this story linked to a description of NebuAd's service that appeared to be from Juniper Networks. This link may be bogus, and we have removed it.

Internet Security Threat Report 2014

More from The Register

next story
Same old iPad? NO. The new 'soft SIMs' are BIG NEWS
AppleSIM 'ware to allow quick switch of carriers
Brits: Google, can you scrape 60k pages from web, pleeease
Hey, c'mon Choc Factory, it's our 'right to be forgotten'
Of COURSE Stephen Elop's to blame for Nokia woes, says author
'Google did have some unique propositions for Nokia'
FCC, Google cast eye over millimetre wireless
The smaller the wave, the bigger 5G's chances of success
It's even GRIMMER up North after MEGA SKY BROADBAND OUTAGE
By 'eck! Eccles cake production thrown into jeopardy
Mobile coverage on trains really is pants
You thought it was just *insert your provider here*, but now we have numbers
Don't mess with Texas ('cos it's getting Google Fiber and you're not)
A bit late, but company says 1Gbps Austin network almost ready to compete with AT&T
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.