Feeds

NebuAd plays cat and mouse with data pimping opt-out

'We don't observe, but we may track'

Secure remote control for conventional and virtual desktops

Though Phorm-like behavioral ad targeter NebuAd has vowed to replace its cookie-based opt-out mechanism with an opt-out that's less crumbly, it appears that neither opt-out would completely opt you out.

NebuAd tracks the online search and browsing activity of net surfers using deep packet inspection hardware installed inside American ISPs, before tossing this data to various online advertising networks. The company does not require an opt-in, but it has always offered a cookie-based opt-out.

Really, such a system should be opt-in only. But even the company's opt-out setup is a mess.

The cookie approach is problematic for many reasons. If you switch browsers or machines, you're no longer opted out. And those privacy-minded folk who periodically remove their cookies are out of luck. So the company is "developing a network-based opt-out mechanism that is not reliant on web browser cookies." But there's another problem.

Back in April, the company told us that "Once a user opts out, the user's surfing habits are no longer being observed by NebuAd. Once a user opts out, NebuAd removes the history on the user and will ignore the user's subsequent surfing habits." We took this to mean that if web surfers set that opt-out cookie, they're no longer tracked by NebuAd's hardware. But that may not be the case.

Some have speculated that NebuAd servers outside the ISP - and not the deep packet inspection (DPI) servers on inside - deal with opt-outs. Even if you opt-opt, these voices say, the deep packet inspection continues.

Robb Topolski, chief technology consultant for Free Press and Public Knowledge, two net watchdogs taking a stand against the likes of Phorm and NebuAd, argues that NebuAd has probably given the opt-out duties to those external servers in order to keep loads light on the DPI boxes.

"I...personally understand that these DPI boxes that are within the ISPs - while fast and capable - are kept to a minimum of processing load," he tells us. "ISPs won't tolerate anything that might limit or slow down the network, so these boxes are given quick and easy things to do."

So we've asked NebuAd yet again: If users opt-out, does their browsing history still leave the ISP's network? Are they still tracked by NebuAd hardware? And we received another carefully worded response: "When the user opts out, NebuAd does not collect the data on that user, and we do not serve targeted ads to that user. The data flowing through the system is immediately and permanently flushed out."

Does that mean your data leaves your ISP even if you opt-out? Sure sounds like it. But the company wouldn't comment further. And that's the trouble with NebuAd. It won't put its cards on the table. At the very least, web surfers deserve to know what's what. ®

Update

An earlier version of this story linked to a description of NebuAd's service that appeared to be from Juniper Networks. This link may be bogus, and we have removed it.

Providing a secure and efficient Helpdesk

More from The Register

next story
Net neutrality protestors slam the brakes on their OWN websites
Sites link up to protest slow lanes by bogging down pages
Blockbuster book lays out the first 20 years of the Smartphone Wars
Symbian's David Wood bares all. Not for the faint hearted
Drag queens: Oh, don't be so bitchy, Facebook! Let us use our stage names
Handbags at dawn over free content ad network's ID policy
Who us, SHARE infrastructure? Networks reject gov proposal
Execs pour scorn on 'national roaming' outline – report
Net neutrality fans' joy as '2.3 million email' flood hits US Congress
FCC invites opinions in CSV format, after Slowdown day 'success'
'Serious flaws in the Vertigan report' says broadband boffin
Report 'fails reality test' , is 'simply wrong' and offers ''convenient' justification for FTTN says Rod Tucker
This flashlight app requires: Your contacts list, identity, access to your camera...
Who us, dodgy? Vast majority of mobile apps fail privacy test
Apple Watch will CONQUER smartwatch world – analysts
After Applelocalypse, other wristputers will get stuck in
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.