Feeds

American data pimper exposes ad equation

26,000 tracked, 15 opt out

Next gen security for virtualised datacentres

How much notice did American ISPs provide when testing NebuAd's Phorm-like behavioral ad targeter? Not as much as NebuAd CEO Bob Dykes would have you believe.

Responding to an open letter from three big-name US Congressman, Middle American ISP Embarq Corp. has admitted that before activating NebuAd's deep packet inspection hardware, it notified customers with no more than an update to its 5,000-word privacy policy.

Bob Dykes has always claimed that NebuAd's ISP partners provide "direct notice" to customers. Speaking to The Reg in April, he was adamant that a paragraph posted to an ISP's website or buried in its terms of service does not qualify as direct notification. And when he testified before Congress last week, he said that ISPs customers always receive an email or a letter or some extra words in their billing statements.

Of course, even these methods are less then adequate. As Ed Markey, chairman of the House Subcommittee on Telecommunications and the Internet, told Dykes during last week's Congressional hearing, NebuAd should always require an opt-in. In an effort to target online ads, NebuAd's deep packet inspection hardware tracks the search and browsing activity of web surfers from inside an ISP's network.

At one point during the hearing, Markey accused Dykes of "beating consumers." But Dykes insisted his system maintains user privacy by anonymizing IP addresses and offering an opt-out.

Earlier in the week, Markey and fellow Congressmen John D. Dingell (chairman of the House Committee on Energy and Commerce) and Joe Barton (ranking member of the House Committee on Energy and Commerce) fired a letter at the Kansas-based Embarq, demanding details on the NebuAd test it performed earlier this year. Since The Reg first contacted the company in April, it has openly acknowledged the test, but refused to give specifics.

As it turns out, Embarq tested the technology on about 26,000 broadband customers in Gardner, Kansas over the course of about two weeks. During that time, only 15 customers opt-ed out.

Chances are, most of the 26,000 didn't realize there was brand new language buried somewhere in the company's privacy policy.

Nonetheless, Embarq says it provided customers with adequate notice. "Embarq followed the prevailing industry practices of the most similar business model, that of online advertising networks, which also collect anonymous information across multiple unrelated web sites and use it to serve personalized display advertisements," the company explained this week in a letter to Markey, Dingell, and Barton.

But ordinary ad networks aren't tracking all your browsing activity from inside your ISP. In failing to require an opt-in, NebuAd and other behavioral ad targeters may run afoul of the Communications Act of 1934, the Cable Act of 1984, the Electronic Communications Privacy Act, and other wiretapping-related US statutes.

Of course, Embarq says it conducted its very own legal analysis of the situation, and the company has no doubt that an opt-out is enough.

It should be noted, however, that NebuAd's cookie-based opt-out isn't quite an opt-out. Ars Technica has spoken with a network engineer who's worked with NebuAd's hardware, and he confirmed that even if you opt-out, NebuAd continues to collect your browsing activity.

"When the user opts out, NebuAd does not collect the data on that user, and we do not serve targeted ads to that user," NebuAd has told us. "The data flowing through the system is immediately and permanently flushed out." The key words here are "data flowing through the system." Your info is still leaving your ISP for a third party. ®

The essential guide to IT transformation

More from The Register

next story
Déjà vu: Virgin Media jacks up broadband prices
Screw copper phone lines, we're UNIQUE, bleats telco
UK fuzz want PINCODES on ALL mobile phones
Met Police calls for mandatory passwords on all new mobes
Netflix swallows yet another bitter pill, inks peering deal with TWC
Net neutrality crusader once again pays up for priority access
Fifteen zero days found in hacker router comp romp
Four routers rooted in SOHOpelessly Broken challenge
New Sprint CEO says he will lower axe on staff – but prices come first
'Very disruptive' new rates to be revealed next week
US TV stations bowl sueball directly at FCC's spectrum mega-sale
Broadcasters upset about coverage and cost as they shift up and down the dials
UK mobile coverage is BETTER than EVER, networks tell Ofcom
Regulator swallows this line and parrots it back out at us. What are they playing at?
What's the nature of your emergency, Vodafone?
Oh, you've dialled the wrong number for ad fibs, rules ASA
EE network whacked by 'PDP authentication failure' blunder
Carrier is 'aware' of cockup, working on a fix NOW
ROAD TRIP! An FCC road trip – Leahy demands net neutrality debate across US
You crashed watchdog's site, now time to crash its ears
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.