American data pimper exposes ad equation

26,000 tracked, 15 opt out

How much notice did American ISPs provide when testing NebuAd's Phorm-like behavioral ad targeter? Not as much as NebuAd CEO Bob Dykes would have you believe.

Responding to an open letter from three big-name US Congressman, Middle American ISP Embarq Corp. has admitted that before activating NebuAd's deep packet inspection hardware, it notified customers with no more than an update to its 5,000-word privacy policy.

Bob Dykes has always claimed that NebuAd's ISP partners provide "direct notice" to customers. Speaking to The Reg in April, he was adamant that a paragraph posted to an ISP's website or buried in its terms of service does not qualify as direct notification. And when he testified before Congress last week, he said that ISPs customers always receive an email or a letter or some extra words in their billing statements.

Of course, even these methods are less then adequate. As Ed Markey, chairman of the House Subcommittee on Telecommunications and the Internet, told Dykes during last week's Congressional hearing, NebuAd should always require an opt-in. In an effort to target online ads, NebuAd's deep packet inspection hardware tracks the search and browsing activity of web surfers from inside an ISP's network.

At one point during the hearing, Markey accused Dykes of "beating consumers." But Dykes insisted his system maintains user privacy by anonymizing IP addresses and offering an opt-out.

Earlier in the week, Markey and fellow Congressmen John D. Dingell (chairman of the House Committee on Energy and Commerce) and Joe Barton (ranking member of the House Committee on Energy and Commerce) fired a letter at the Kansas-based Embarq, demanding details on the NebuAd test it performed earlier this year. Since The Reg first contacted the company in April, it has openly acknowledged the test, but refused to give specifics.

As it turns out, Embarq tested the technology on about 26,000 broadband customers in Gardner, Kansas over the course of about two weeks. During that time, only 15 customers opt-ed out.

Chances are, most of the 26,000 didn't realize there was brand new language buried somewhere in the company's privacy policy.

Nonetheless, Embarq says it provided customers with adequate notice. "Embarq followed the prevailing industry practices of the most similar business model, that of online advertising networks, which also collect anonymous information across multiple unrelated web sites and use it to serve personalized display advertisements," the company explained this week in a letter to Markey, Dingell, and Barton.

But ordinary ad networks aren't tracking all your browsing activity from inside your ISP. In failing to require an opt-in, NebuAd and other behavioral ad targeters may run afoul of the Communications Act of 1934, the Cable Act of 1984, the Electronic Communications Privacy Act, and other wiretapping-related US statutes.

Of course, Embarq says it conducted its very own legal analysis of the situation, and the company has no doubt that an opt-out is enough.

It should be noted, however, that NebuAd's cookie-based opt-out isn't quite an opt-out. Ars Technica has spoken with a network engineer who's worked with NebuAd's hardware, and he confirmed that even if you opt-out, NebuAd continues to collect your browsing activity.

"When the user opts out, NebuAd does not collect the data on that user, and we do not serve targeted ads to that user," NebuAd has told us. "The data flowing through the system is immediately and permanently flushed out." The key words here are "data flowing through the system." Your info is still leaving your ISP for a third party. ®