• by Wendy Davis  @wendyndavis, June 16, 2008

Internet service providers should obtain users' consent before collecting information about their Web-surfing activity for ad purposes, the digital rights group Center for Democracy and Technology said last week.

"Finding out that a middleman sits between consumers and the Web sites they visit would likely come as a huge surprise to most Internet users," the organization said in comments filed with the industry association Network Advertising Initiative. "We believe that the use of Internet traffic content from [Internet service providers] for behavioral advertising purposes requires unavoidable notice and affirmative, express opt-in consent."

The self-regulatory Network Advertising Initiative is updating its privacy principles for ad companies that serve ads to people based on their Web-surfing history. In most circumstances, the organization requires companies that engage in such targeting to notify Web users about the practice and inform them about how to opt-out.

The organization recently proposed an update to its 7-year-old guidelines, but the new standards do not treat targeting based on information gleaned from Internet service providers differently from older forms of targeting. Advocates, however, say there are significant differences, justifying tighter rules for the providers.

"It really defies users' expectations that their service providers would be looking into their packets and sharing all or a portion of their Web traffic with a third party that they don't have a relationship with," said Alissa Cooper, chief computer scientist with the Center for Democracy and Technology.

In the U.S., ad company Charter Communications has said it intends to share information about its broadband subscribers' Web surfing with ad company NebuAd. Bob Dykes, CEO of NebuAd, has said that the platform is anonymous, and that users will be able to opt-out.

But the Center for Democracy and Technology proposes that companies like NebuAd should only be allowed to join the Network Advertising Initiative if the Internet service providers they partner with deploy the system on an opt-in basis.

Charter's plan with NebuAd also has drawn the attention of Washington. Reps. Ed Markey (D-Mass.) and Joe Barton (R-Texas) recently asked Charter to delay its plans while they gather information.

Digital rights groups are especially wary of programs that draw on data from Internet service providers because those companies have access to users' entire click-stream data. Older behavioral targeting companies, by contrast, tended to collect information about Web activity on a limited number of sites.

A spokesperson for NebuAd said Dykes was unavailable to comment about the Center for Democracy and Technology's proposals.

The Network Advertising Initiative has received about 10 substantive responses to its proposed guidelines. The organization will spend the next few months reviewing them before issuing final guidelines and a report, said Trevor Hughes, executive director of the group.