• by Wendy Davis  @wendyndavis, August 11, 2008

In response to a Congressional inquiry, Google told members of the House Energy and Commerce Committee Friday that it saw a difference between behavioral targeting company NebuAd, which harvests data from Internet service providers, and other online ad companies.

"Given your Committee's recent focus on deep-packet inspection in connection with advertising, we feel it important to state clearly and for the record that Google does not deliver advertising based on deep-packet inspection," the company said in a letter to Reps. Ed Markey (D-Mass.), John Dingell (D-Mich.), Joe Barton (R-Texas) and Cliff Stearns (R-Fla.). "We understand that many of the questions that you have posed to us and a number of other companies stem from concerns about that particular model for online advertising, but we believe that the vast majority of online advertisers--like Google--is not engaged in these practices."

The letter came one week after the lawmakers posed questions about online ad targeting and privacy to 33 broadband providers and Web companies. While a Congressional committee recently held a hearing about the privacy implications of Internet service provider-based behavioral targeting, which uses deep packet inspection technology, the Aug. 1 letter indicated that concerns were broader than just that one form of ad targeting.

"Questions have been raised regarding the applicability of privacy protections ... and whether legislation is needed to ensure that the same protections apply regardless of the particular technologies or companies involved," the lawmakers stated in the letter.

Congress went on to pose a variety of questions, including whether they engaged in ad targeting, if they allowed consumers to opt out, and how many had done so.

In its response, Google said that paid search ads on its own properties, like Google.com, are not served based on Web-surfing history or other forms of behavioral targeting. The company said that when it serves third-party ads through DoubleClick, people can opt out of data collection. Google did not state how many users had opted out of the DoubleClick information collection system.

Google also repeatedly characterized the Aug. 1 letter as focused on issues raised by NebuAd, prefacing many of its answers with the sentence: "We understand this question to be focused primarily on the implementation of deep-packet inspection advertising practices by a small number of U.S. ISPs in partnership with a privately-held online advertising company."

Of course, Google is not alone in drawing a distinction between companies like NebuAd and those that use older forms of behavioral advertising. Markey has said that he believes NebuAd's platform requires opt-in consent, while companies that deploy other forms of behavioral targeting need only let users opt out.

Some digital rights groups like the Center for Democracy & Technology also see a difference. That organization argues that NebuAd should not deploy its platform unless users have explicitly consented, but has not advocated for an opt-in standard for other forms of behavioral targeting.

But other privacy advocates, including the Center for Digital Democracy, say that opt-in consent should be required for all forms for behavioral targeting.

NebuAd says it does not collect names, addresses or other personally identifiable information and that users can always opt out of targeting. But advocates are still concerned, primarily because Internet service providers have access to users' entire clickstream data, including all sites visited and search queries. With such comprehensive information, it is sometimes possible to identify people without even knowing their names.

Privacy advocates have tended to criticize Google for its retention of users' IP addresses more than its ad-serving practices. Some advocates have said they are afraid that Google will combine IP-based information about search activity with DoubleClick information about activity on third-party sites to create detailed user profiles. Google has said that DoubleClick's contracts prevent such data-sharing.

In its separate response to Congress last week, Yahoo said it will soon expand people's ability to opt out of targeting. Currently, users can only opt out of targeting on third-party sites, but by the end of the month Yahoo will also allow people to opt out of receiving targeted ads on its owned-and-operated sites. But the company still intends to collect information about users on its own sites.