Feeds

American data pimper exposes ad equation

26,000 tracked, 15 opt out

Business security measures using SSL

How much notice did American ISPs provide when testing NebuAd's Phorm-like behavioral ad targeter? Not as much as NebuAd CEO Bob Dykes would have you believe.

Responding to an open letter from three big-name US Congressman, Middle American ISP Embarq Corp. has admitted that before activating NebuAd's deep packet inspection hardware, it notified customers with no more than an update to its 5,000-word privacy policy.

Bob Dykes has always claimed that NebuAd's ISP partners provide "direct notice" to customers. Speaking to The Reg in April, he was adamant that a paragraph posted to an ISP's website or buried in its terms of service does not qualify as direct notification. And when he testified before Congress last week, he said that ISPs customers always receive an email or a letter or some extra words in their billing statements.

Of course, even these methods are less then adequate. As Ed Markey, chairman of the House Subcommittee on Telecommunications and the Internet, told Dykes during last week's Congressional hearing, NebuAd should always require an opt-in. In an effort to target online ads, NebuAd's deep packet inspection hardware tracks the search and browsing activity of web surfers from inside an ISP's network.

At one point during the hearing, Markey accused Dykes of "beating consumers." But Dykes insisted his system maintains user privacy by anonymizing IP addresses and offering an opt-out.

Earlier in the week, Markey and fellow Congressmen John D. Dingell (chairman of the House Committee on Energy and Commerce) and Joe Barton (ranking member of the House Committee on Energy and Commerce) fired a letter at the Kansas-based Embarq, demanding details on the NebuAd test it performed earlier this year. Since The Reg first contacted the company in April, it has openly acknowledged the test, but refused to give specifics.

As it turns out, Embarq tested the technology on about 26,000 broadband customers in Gardner, Kansas over the course of about two weeks. During that time, only 15 customers opt-ed out.

Chances are, most of the 26,000 didn't realize there was brand new language buried somewhere in the company's privacy policy.

Nonetheless, Embarq says it provided customers with adequate notice. "Embarq followed the prevailing industry practices of the most similar business model, that of online advertising networks, which also collect anonymous information across multiple unrelated web sites and use it to serve personalized display advertisements," the company explained this week in a letter to Markey, Dingell, and Barton.

But ordinary ad networks aren't tracking all your browsing activity from inside your ISP. In failing to require an opt-in, NebuAd and other behavioral ad targeters may run afoul of the Communications Act of 1934, the Cable Act of 1984, the Electronic Communications Privacy Act, and other wiretapping-related US statutes.

Of course, Embarq says it conducted its very own legal analysis of the situation, and the company has no doubt that an opt-out is enough.

It should be noted, however, that NebuAd's cookie-based opt-out isn't quite an opt-out. Ars Technica has spoken with a network engineer who's worked with NebuAd's hardware, and he confirmed that even if you opt-out, NebuAd continues to collect your browsing activity.

"When the user opts out, NebuAd does not collect the data on that user, and we do not serve targeted ads to that user," NebuAd has told us. "The data flowing through the system is immediately and permanently flushed out." The key words here are "data flowing through the system." Your info is still leaving your ISP for a third party. ®

Providing a secure and efficient Helpdesk

More from The Register

next story
Brit telcos warn Scots that voting Yes could lead to HEFTY bills
BT and Co: Independence vote likely to mean 'increased costs'
Phones 4u slips into administration after EE cuts ties with Brit mobe retailer
More than 5,500 jobs could be axed if rescue mission fails
New 'Cosmos' browser surfs the net by TXT alone
No data plan? No WiFi? No worries ... except sluggish download speed
Radio hams can encrypt, in emergencies, says Ofcom
Consultation promises new spectrum and hints at relaxed licence conditions
Blockbuster book lays out the first 20 years of the Smartphone Wars
Symbian's David Wood bares all. Not for the faint hearted
Bonking with Apple has POUNDED mobe operators' wallets
... into submission. Weve squeals, ditches payment plans
This flashlight app requires: Your contacts list, identity, access to your camera...
Who us, dodgy? Vast majority of mobile apps fail privacy test
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.