• by Wendy Davis  @wendyndavis, August 12, 2008

In violation of longstanding online privacy practices, broadband provider Cable One recently tested a behavioral targeting platform without allowing users to refuse to participate. Cable One, which is owned by The Washington Post Company, disclosed the test to Congress in a letter that was made public Monday.

Cable One, based in Phoenix, Ariz., said in a letter to senior members of the House Energy and Commerce Committee that it tested the platform with 14,000 subscribers in Anniston, Ala. for 180 days beginning last November. For the initiative, Cable One allowed a behavioral targeting company to monitor users' Web activity and then serve them ads based on the sites they visited and searches conducted. Cable One said it ultimately decided not to move forward with the technology, and wouldn't have done so without obtaining subscribers' "additional opt-in consent."

But in a move that is inconsistent with the Federal Trade Commission's recommended approach, the company also said it did not notify subscribers about the test or let them decline to participate. The FTC last year issued proposed voluntary guidelines stating that companies engaged in behavioral advertising, or serving ads based on people's Web activity, should notify users about the practice and allow them to opt out. The Network Advertising Initiative, a voluntary self-regulatory group, has also long supported that principle.

Rep. Ed Markey (D-Mass), who led a Congressional hearing about online ad targeting last month, has gone even further. He says that companies should not deploy Internet service provider-based targeting platforms unless subscribers have explicitly consented. Markey also says that other, older forms of behavioral targeting require, at a minimum, notice and the chance to opt out.

Earlier this month, Markey--along with Reps. John Dingell (D-Mich.), Joe Barton (R-Tex.) and Cliff Stearns (R-Fla.)--sent a letter to 33 broadband providers and Web companies asking a host of questions about their online ad-targeting techniques. Among other questions, the lawmakers asked whether the companies allowed users to opt out of behavioral targeting.

In its response, Cable One said that subscribers consented to being tracked when they signed up for broadband service, because the company's terms of use say it may monitor online activity. "Cable One customers opted in to our monitoring of their Internet usage and content consistent with this third-party test when they agreed to our Acceptable Use Policy," the company wrote.

But digital rights advocates say that presenting customers with a take-it-or-leave-it policy doesn't provide the ability to meaningfully consent to tracking for ad-serving purposes.

"Giving people information in the acceptable use policy is just giving them notice," said Ari Schwartz, vice president and chief operating officer of the Center for Democracy & Technology. "That isn't consent at all."

Cable One did not name NebuAd in its response to Congress, but other broadband providers that answered the letter made it clear they were working with NebuAd, often because their response contained a link to NebuAd's opt-out mechanism.

The revelation is likely to cause even more problems for NebuAd, a Silicon Valley start-up that partners with Internet service providers to harvest data about users' Web activity and then serve them ads based on their presumed interests. Cable One did not name NebuAd in its response to Congress, but a Cable One spokesperson confirmed that the test was with NebuAd.

The platform alarms privacy advocates because Internet service providers have access to users' entire clickstream data, including all sites visited and search queries. With such comprehensive information, it's sometimes possible to identify people without even knowing their names. Older behavioral targeting companies, by contrast, only collect data about Web users from a limited number of sites.

NebuAd says it does not collect names, addresses or other personally identifiable information. The company also has said that users can always opt out of targeting--although that wasn't the case with Cable One. NebuAd did not respond to a request for comment for this article.