The Case Of The Too-Private Privacy Notice

by Wendy Davis, Jul 23, 2008, 4:16 PM

• Comment
• Recommend (1)
• Tweet
• 

To defend itself from charges that it sold subscribers' Web-surfing data without their consent, Internet service provider Embarq has issued the absurd defense that it notified subscribers by posting a revision to its privacy policy online.

Even more ludicrous, Embarq attempts to argue that such a procedure is consistent with the Federal Trade Commission's proposed voluntary guidelines for behavioral advertising.

Embarq earlier this year tested NebuAd's behavioral targeting platform. NebuAd, unlike network-based behavioral targeting companies, works with ISPs to collect data about Web sites users visit and then send them targeted ads.

Digital rights advocates say this program violates federal wiretap laws, and some lawmakers have said that it should require users' explicit consent. NebuAd says that users can always opt out of the program -- but, of course, that's only an option for users who are aware of it.

Embarq, like most companies that have tested NebuAd's platform, "notified" subscribers by quietly changing its privacy policy. When lawmakers learned of this test and demanded answers, Embarq justified its procedure as consistent with FTC proposed guidelines and with the way ad networks notify users about behavioral targeting. Embarq is wrong on both counts.

Yes, many Web publishers that participate in ad networks inform visitors about that via policy privacies. Whether anyone reads those policies is open to debate, but at least they're posted at the sites where the data is being collected.

Embarq simply revised the privacy policy on its own site -- a site that it's hard to imagine Embarq customers have much reason to frequently visit. Even if some subscribers go to Embarq's site to pay their Internet access bills online, it's not likely that this happens more than once a month. But Embarq only revised its policy around two weeks before conducting the test.

Additionally, the FTC's proposed voluntary guidelines call for notice at "every website where data is collected for behavioral advertising." Embarq wasn't collecting data on its own sites. It was collecting data at sites like Google, Yahoo and NYTimes.com. It's safe to assume that very few if any Embarq subscribers who visited those sites had no inkling that Embarq was selling that information. Clearly Embarq wanted it that way.

Congress member Ed Markey has already made it clear he's not happy with how the NebuAd tests were conducted. "We need to have remedial legal courses for some corporate general counsels," he said at a hearing last week. Embarq's response to Markey isn't likely to change his mind about that.

• Comment
• Recommend (1)
• Tweet
• 

Be the first to comment on "The Case Of The Too-Private Privacy Notice"

Leave a Comment