This week, the 60-person Silicon Valley company confirmed it had shed some staff. That news comes shortly after last week's revelation that the company had stopped using its former outside PR firm pending the hiring of a new public relations shop that could focus on policy issues.

It's not surprising that NebuAd would be feeling an economic squeeze, given that several broadband providers have suspended plans to work with the company while Congress investigates. Lawmakers are now questioning whether companies like NebuAd and Phorm, which purchase data about users' Web-surfing activity to send them targeted ads, violate federal wiretap laws. Rep. Ed Markey, for one, has said he believes ISP-based behavioral targeting requires users' opt-in consent.

Still, the layoffs, combined with the new PR strategy, make clear that NebuAd didn't anticipate the degree of pushback it's now facing, both from policymakers and privacy advocates. Of course, until this summer, NebuAd didn't have much reason to think Washington would take an interest in its activities.

For the most part, online behavioral targeting seemed to fly under lawmakers' radar earlier this decade, when companies like Tacoda and Revenue Science were getting started. That situation had started to change by 2006, when the Center for Digital Democracy and U.S. Public Interest Research Group filed an FTC complaint about behavioral targeting techniques. The FTC held a town hall meeting last November, but few people were yet discussing NebuAd and other companies that rely on data purchased from ISPs.

But when news that NebuAd was testing its ISP-based targeting model trickled out earlier this year, it was clear that behavioral targeting was entering new territory. Older companies only know when users visit a site within one of their networks, but ISPs know about all sites that are visited and all search queries entered.

That ISP-based platform clearly made regulators more aware of the privacy issues, triggering the extra scrutiny. NebuAd insists that it doesn't collect personally identifiable information or "sensitive" data, and also says it allows users to opt out. But NebuAd's prior tests cast doubt on how committed they are to privacy principles. When Embarq conducted a test of NebuAd earlier this year, the broadband company notified subscribers by quietly changing its online description of its privacy policy -- a method that guarantees that virtually no one will notice the difference.

Decisions like that are clearly haunting the companies now. The upshot is that regardless of whether Congress or the FTC impose new requirements, NebuAd, Phorm and others are going to have to become more sensitive to people's privacy concerns if they expect to stay in business.

This commentary is insightful. I recommend it to others.