July 18th, 2008
NebuAd: Galileo or pariah?
So, it would seem we have found the outer limits of user tracking and ad-serving. At a House hearing yesterday, NebuAd ran into universal condemnation for its plans to monitor broadband customers’ web visits and deliver targeting advertising, reports News.com’s Declan McCullagh.
Contemptible. Goes against everything America’s been founded upon. That sort of thing. “Why do I have to opt out? Why should the burden be on the American consumer?” asked one congressman.
NebuAd CEO Robert Dykes was on the hotseat but said he felt like “Galileo when he was viewed with skepticism on demonstrating that the Earth revolved around the sun,” Dykes said. “The science exists today and NebuAd is using it to create truly anonymous profiles that cannot be hacked or reverse-engineered.”
Galileo of course was excommunicated, which is what the behavioral tracking industry might like to do to Dykes now that he has brought congressional scrutiny to practices.
In any case, Rep. Ed Markey said he thinks NebuAd is breaking the law. “We need to have remedial legal courses for some corporate general counsels,” Markey said.
Cable companies especially have to worry about breaking the law, because they are governed by Cable TV Privacy Act of 1984, but the the Electronic Communications Privacy Act of 1986 (ECPA) and the Communications Act of 1934 also play into the landscape, McCullaug reported.
“They have to worry about it more,” said Gidari, the attorney at Perkins Coie, referring to cable operators. “Their rules are much more restrictive. They have the obligation to give notice to their customers before they disclose information. They have the obligation not to collect information without prior consent…Cable operators have the most exposure in doing this.”
And case law supports the idea that opt-out is not good enough.
The court ruled in In re Pharmatrack “that it makes more sense to place the burden of showing consent on the party seeking the benefit of the exception.” The judges approvingly cited a second case, which said “consent can only be implied when the surrounding circumstances convincingly show that the party knew about and consented to the interception.”
In other words, NebuAd’s target market may actually be legally barred from using its services. Nebu-Ad posted a legal memo that claims to address such issues, but the bottom line is they’re sticking with opt-out.
NebuAd’s ISP Partners are required to provide notice to users in advance of launch of the service. The notice, which must be direct and robust, discloses to the user that the ISP is working to ensure that advertisements shown will be more relevant advertisements, that to deliver these ads its partner creates anonymous profiles based on part of the user’s web surfing behavior, which does not include the collection of PII, and that the user may opt-out of the service. For existing subscribers, the notice is required to be delivered 30 days prior to the launch of the service by postal mail, email, or both. For new subscribers, the notice is required to be placed clearly and conspicuously in the new subscriber sign-up flow and outside the privacy policy. All subscribers can opt-out at any time, and on-going disclosure and opportunity to opt-out is required to be provided within the ISP’s privacy policy.
