Security

Groups: Targeted Ad Program May Be Illegal

A behavioral advertising program that collects information about Internet service provider subscribers' Web surfing habits may be illegal, two privacy groups said Tuesday.

State and federal laws may prohibit a targeted ad program adopted by several U.S. ISPs, officials with the Center for Democracy and Technology and Public Knowledge said. The targeted ad program, offered by California vendor NebuAd, has been tested or implemented by more than a dozen ISPs, according to Robert Topolski, technical consultant for Public Knowledge.

The targeted ad program, which was tested but dumped by Charter Communications, one of the largest cable broadband suppliers in the U.S., may violate federal and state wiretap laws, the CDT said in a memo released Tuesday.

The Electronic Communications Privacy Act (ECPA) could allow ISPs to monitor customers' Internet traffic, with consent from customers, but the law suggests the consent should be active, not buried in a terms of service agreement or a billing statement, said CDT Vice President Ari Schwartz. Several state laws require affirmative consent from all affected parties, in the case of the NebuAd program, both ISP subscribers and the owners of the Web sites they visit, Schwartz added.

The NebuAd program requires ISP subscribers to opt out of having their data collected. Objections to the program gained momentum after Charter announced in May it was testing the NebuAd service. Charter announced in late June it had suspended the program, citing subscriber privacy concerns.

"Consumers do not expect their ISP to be copying their Internet communications and selling them to third parties," Schwartz said. "We have concluded that the advertising network model at issue here requires clear notice and prior consent, and that may be impossible if state laws apply requiring all parties to consent."

Without consent from ISP subscribers and the Web sites they visit, the targeted ad program is possibly illegal, CDT said. It would be impossible to get consent from all Web sites, CDT officials said.

The NebuAd service offered to ISPs is different than traditional online behavioral advertising, because it inserts a third party into the relationship between Web users and the sites they visit, said Leslie Harris, CDT's president and CEO.

Public Knowledge and Free Press, another advocacy group, published a report in June that accused NebuAd of using several common Internet attacks to get information on users' Web surfing habits. The report said NebuAd hijacks browsers, employs man-in-the-middle attacks and uses packet forgery to get information from users and deliver ads.

NebuAd has denied using such tactics, saying it uses "industry-standard techniques for standard ad serving purposes."

NebuAd on Tuesday announced it was rolling out a new notification and opt-out program as part of the targeted ad service. The program would give consumers periodic reminders that they are enrolled in the ad system, the company said. NebuAd's announcement about new privacy measures came a day before a U.S. Senate Commerce, Science and Transportation Committee hearing on Internet advertising privacy, where NebuAd Chairman and CEO Robert Dykes is scheduled to testify.

The changes detailed by NebuAd Tuesday aren't enough, because the company still requires ISP subscribers to opt out of information collection, Schwartz said. "Even if they went with opt in [consent], there'd still be state concerns," he added.

NebuAd disputed the CDT interpretation of wiretap laws, but it supports current privacy standards, said company spokeswoman Janet McGraw. NebuAd agrees with the industry standard of implementing more rigorous disclosure and consent practices when sensitive data is collected, she said.

In addition, the company does not collect personally identifiable information and does not store data linked to individuals, she said. NebuAd uses "state-of-the-art security" for any information it collects, she added.

"NebuAd's service is designed so that no one-- not even the government -- can determine the identity of our users," McGraw said.

By tracking Web surfing habits, it would be easy for NebuAd to identify users, CDT and Public Knowledge officials countered. They called on Congress and the Federal Trade Commission to make rules addressing behavioral advertising programs operated by ISPs.

Subscribe to the Security Watch Newsletter

Comments