Feeds

NebuAd plays cat and mouse with data pimping opt-out

'We don't observe, but we may track'

HP ProLiant Gen8: Integrated lifecycle automation

Though Phorm-like behavioral ad targeter NebuAd has vowed to replace its cookie-based opt-out mechanism with an opt-out that's less crumbly, it appears that neither opt-out would completely opt you out.

NebuAd tracks the online search and browsing activity of net surfers using deep packet inspection hardware installed inside American ISPs, before tossing this data to various online advertising networks. The company does not require an opt-in, but it has always offered a cookie-based opt-out.

Really, such a system should be opt-in only. But even the company's opt-out setup is a mess.

The cookie approach is problematic for many reasons. If you switch browsers or machines, you're no longer opted out. And those privacy-minded folk who periodically remove their cookies are out of luck. So the company is "developing a network-based opt-out mechanism that is not reliant on web browser cookies." But there's another problem.

Back in April, the company told us that "Once a user opts out, the user's surfing habits are no longer being observed by NebuAd. Once a user opts out, NebuAd removes the history on the user and will ignore the user's subsequent surfing habits." We took this to mean that if web surfers set that opt-out cookie, they're no longer tracked by NebuAd's hardware. But that may not be the case.

Some have speculated that NebuAd servers outside the ISP - and not the deep packet inspection (DPI) servers on inside - deal with opt-outs. Even if you opt-opt, these voices say, the deep packet inspection continues.

Robb Topolski, chief technology consultant for Free Press and Public Knowledge, two net watchdogs taking a stand against the likes of Phorm and NebuAd, argues that NebuAd has probably given the opt-out duties to those external servers in order to keep loads light on the DPI boxes.

"I...personally understand that these DPI boxes that are within the ISPs - while fast and capable - are kept to a minimum of processing load," he tells us. "ISPs won't tolerate anything that might limit or slow down the network, so these boxes are given quick and easy things to do."

So we've asked NebuAd yet again: If users opt-out, does their browsing history still leave the ISP's network? Are they still tracked by NebuAd hardware? And we received another carefully worded response: "When the user opts out, NebuAd does not collect the data on that user, and we do not serve targeted ads to that user. The data flowing through the system is immediately and permanently flushed out."

Does that mean your data leaves your ISP even if you opt-out? Sure sounds like it. But the company wouldn't comment further. And that's the trouble with NebuAd. It won't put its cards on the table. At the very least, web surfers deserve to know what's what. ®

Update

An earlier version of this story linked to a description of NebuAd's service that appeared to be from Juniper Networks. This link may be bogus, and we have removed it.

The Power of One Infographic

More from The Register

next story
Google Nest, ARM, Samsung pull out Thread to strangle ZigBee
But there's a flaw in Google's IP-based IoT system
Orange spent weekend spamming customers with TXTs
Zero, not infinity, is the Magic Number customers want
Want to beat Verizon's slow Netflix? Get a VPN
Exec finds stream speed climbs when smuggled out
US freemium mobile network eyes up Europe
FreedomPop touts 'free' calls, texts and data
'Two-speed internet' storm turns FCC.gov into zero-speed website
Deadline for comments on net neutrality shake-up extended to Friday
GoTenna: How does this 'magic' work?
An ideal product if you believe the Earth is flat
NBN Co execs: No FTTN product until 2015
Faster? Not yet. Cheaper? No data
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Mobile application security vulnerability report
The alarming realities regarding the sheer number of applications vulnerable to attack, and the most common and easily addressable vulnerability errors.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.