American ISP giants: If we Phorm, we'll get consent
'No need to legislate'
After months of controversy over ISP-level ad targeting systems from the likes of Phorm and NebuAd, three of America's four largest ISPs have told Congress that such behavior tracking shouldn't exist unless web surfers give their explicit approval.
But the trio don't want legislation that ensures this actually happens. AT&T, Time Warner Cable, and Verizon would prefer to regulate themselves.
"Any technology that is used to track and collect customer online behavior for the purposes of targeting advertising - regardless of which company is doing the collecting - should only be used with the customer's knowledge and consent," Verizon executive vice president Thomas Tauke told the Senate Committee on Commerce, Science, and Transportation in a prepared testimony (PDF).
But when the Committee brought up federal privacy legislation, Tauke demurred. "At this juncture, we aren't prepared to embrace legislation," he said, speaking for AT&T and Time Warner as well. "We think there are already models on the books that could be useful. I mentioned in my testimony the advertising industry's model where the FTC is the enforcing agency.
"One of this reasons we are a little unsure about legislation at this juncture is that technology is developing so rapidly - and there are different technologies that are being used to do different things."
This morning's hearing - dubbed "Broadband Providers and Consumer Privacy" - is the Commerce Committee's second dive into the world of behavioral ad targeting. Earlier in the year, NebuAd was caught deploying its ad targeting system on several American ISPs without providing adequate notice - much less requiring an opt-in - and this soon sparked investigations on both sides of Capitol Hill.
In early July, a letter from a trio of big-name Congressmen urged American ISPs to halt their data-pimping experiments, questioning whether NebuAd's system violated federal law. And ISPs eventually complied.
As Congressional investigations continue, the company said it's concentrating on business opportunities that don't involve tracking the behavior of unsuspecting ISP users. "Our platform was architected to be a multi-channel ad system," a spokeswoman told The Washington Post. "With the Internet service provider channel currently on hold with the events of the summer, we have broadened the focus of our business but continue to enhance our technologies for that ISP channel."
When we contacted the company last month, it declined to elaborate on this new strategy. "We do not have any further business updates at this point," the same spokeswoman said. "However, we do plan to reach out to the media at the appropriate time."
The company has also jettisoned its PR firm and laid off what seems to be a considerable portion of its workforce. But, yes, it still hopes that Congress will OK its original ISP-based system, so it can get tracking again.
Of course, you have to wonder whether NebuAd's business is economically viable when an opt-in is required. And that's what AT&T, Time Warner, and Verizon are calling for.
"Verizon believes that before a company captures certain internet-usage data for targeted or customized advertising purposes, it should obtain meaning, affirmative consent from consumers. Meaningful consent requires: one - transparency, two - affirmative choice, and three - consumer control," Tauke said.
"A consumer's failure to consent should mean that there is no collection and use of that customer's information for online behaviorally targeted advertising based on tracking of the consumer's internet usage."
He stressed this should apply to all companies engaged in behavioral ad targeting, not just ISPs. And he said that such companies should adopt a third-party certification process that ensures these privacy standards are met. But if a company fails to comply with these principles, he's confident the FTC has the authority to take action.
AT&T and Time Warner are already on-board with this plan. But AT&T vice president Dorothy Attwood did say that if legislation is drawn up, it should apply to web players as well. "Any key element to any legislative proposal is that it apply to all actors. That's really the only way," she said.
"When the customer turns on the computer and goes to a web page and on that web page there is advertising [and] the customer had indicated to AT&T that he doesn't want to be tracked, I can't do anything to protect that customer from other entities who are appearing in that advertising space."
All three mega ISPs also said - as they're said before - that they have yet to deploy NebuAd-style deep packet inspection on their networks.
Another Valley startup, Front Porch, has deployed its own behavioral ad targeting system in the US, but it has suspended operations in this area as well. And it has always said the service is opt-in only. Like NebuAd's, Phrom's system is opt-out, and though the UK-based company once tracked users on ISPs in the US, this apparently stopped months ago.
Another outfit known as AdZilla has developed a similar technology, but it's unclear whether this was actually turned on. ®
Sponsored: The Nuts and Bolts of Ransomware in 2016