Feeds

American data pimper exposes ad equation

26,000 tracked, 15 opt out

Beginner's guide to SSL certificates

How much notice did American ISPs provide when testing NebuAd's Phorm-like behavioral ad targeter? Not as much as NebuAd CEO Bob Dykes would have you believe.

Responding to an open letter from three big-name US Congressman, Middle American ISP Embarq Corp. has admitted that before activating NebuAd's deep packet inspection hardware, it notified customers with no more than an update to its 5,000-word privacy policy.

Bob Dykes has always claimed that NebuAd's ISP partners provide "direct notice" to customers. Speaking to The Reg in April, he was adamant that a paragraph posted to an ISP's website or buried in its terms of service does not qualify as direct notification. And when he testified before Congress last week, he said that ISPs customers always receive an email or a letter or some extra words in their billing statements.

Of course, even these methods are less then adequate. As Ed Markey, chairman of the House Subcommittee on Telecommunications and the Internet, told Dykes during last week's Congressional hearing, NebuAd should always require an opt-in. In an effort to target online ads, NebuAd's deep packet inspection hardware tracks the search and browsing activity of web surfers from inside an ISP's network.

At one point during the hearing, Markey accused Dykes of "beating consumers." But Dykes insisted his system maintains user privacy by anonymizing IP addresses and offering an opt-out.

Earlier in the week, Markey and fellow Congressmen John D. Dingell (chairman of the House Committee on Energy and Commerce) and Joe Barton (ranking member of the House Committee on Energy and Commerce) fired a letter at the Kansas-based Embarq, demanding details on the NebuAd test it performed earlier this year. Since The Reg first contacted the company in April, it has openly acknowledged the test, but refused to give specifics.

As it turns out, Embarq tested the technology on about 26,000 broadband customers in Gardner, Kansas over the course of about two weeks. During that time, only 15 customers opt-ed out.

Chances are, most of the 26,000 didn't realize there was brand new language buried somewhere in the company's privacy policy.

Nonetheless, Embarq says it provided customers with adequate notice. "Embarq followed the prevailing industry practices of the most similar business model, that of online advertising networks, which also collect anonymous information across multiple unrelated web sites and use it to serve personalized display advertisements," the company explained this week in a letter to Markey, Dingell, and Barton.

But ordinary ad networks aren't tracking all your browsing activity from inside your ISP. In failing to require an opt-in, NebuAd and other behavioral ad targeters may run afoul of the Communications Act of 1934, the Cable Act of 1984, the Electronic Communications Privacy Act, and other wiretapping-related US statutes.

Of course, Embarq says it conducted its very own legal analysis of the situation, and the company has no doubt that an opt-out is enough.

It should be noted, however, that NebuAd's cookie-based opt-out isn't quite an opt-out. Ars Technica has spoken with a network engineer who's worked with NebuAd's hardware, and he confirmed that even if you opt-out, NebuAd continues to collect your browsing activity.

"When the user opts out, NebuAd does not collect the data on that user, and we do not serve targeted ads to that user," NebuAd has told us. "The data flowing through the system is immediately and permanently flushed out." The key words here are "data flowing through the system." Your info is still leaving your ISP for a third party. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Brit telcos warn Scots that voting Yes could lead to HEFTY bills
BT and Co: Independence vote likely to mean 'increased costs'
Phones 4u slips into administration after EE cuts ties with Brit mobe retailer
More than 5,500 jobs could be axed if rescue mission fails
New 'Cosmos' browser surfs the net by TXT alone
No data plan? No WiFi? No worries ... except sluggish download speed
Radio hams can encrypt, in emergencies, says Ofcom
Consultation promises new spectrum and hints at relaxed licence conditions
Google+ GOING, GOING ... ? Newbie Gmailers no longer forced into mandatory ID slurp
Mountain View distances itself from lame 'network thingy'
ISPs' post-net-neutrality world is built on 'bribes' says Tim Berners-Lee
Father of the worldwide web is extremely peeved over pay-per-packet-type plans
Vodafone to buy 140 Phones 4u stores from stricken retailer
887 jobs 'preserved' in the process, says administrator PwC
Bonking with Apple has POUNDED mobe operators' wallets
... into submission. Weve squeals, ditches payment plans
Drag queens: Oh, don't be so bitchy, Facebook! Let us use our stage names
Handbags at dawn over free content ad network's ID policy
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.