• by Wendy Davis  @wendyndavis, November 12, 2008

Lawmakers and regulators are currently considering behavioral targeting and whether to enact laws specifically mandating Internet service providers to obtain users' express consent before monitoring their Web activity for marketing purposes.

But now, thanks to a lawsuit filed Monday against NebuAd and six Internet service providers--Bresnan Communications, Cable One, CenturyTel, Embarq, Knology and WOW--the courts could end up deciding that issue before Congress decides whether to pass new legislation.

"It could be a landmark case," said attorney Bennet Kelley, founder of the Internet Law Center in Santa Monica, Calif. and former privacy director at ValueClick. He added that a victory for the plaintiffs could mean that broadband providers will be left with no choice but to seek users' affirmative consent before selling information about people's Web activity to ad companies.

Kelley said the lawsuit "pushes the boundary in an area we've been debating." "The plaintiffs are trying to draw the line much further to favor the consumers than the industry and even the consensus might dictate."

But privacy advocates say that the case doesn't invite courts to make new standards as much as to clarify that existing laws already prevent Internet service providers from selling users' clickstream data without their consent.

"There's a very high likelihood that some of these new advertising proposals that take advantage of Web traffic are illegal," said Marc Rotenberg, executive director of the Electronic Privacy Information Center.

On Monday, 15 Web users filed a class-action lawsuit in federal district court in San Jose, Calif. alleging that behavioral targeting conducted by NebuAd and the Internet service providers violated a variety of privacy laws, including a federal wiretap law. That statute generally prevents companies from intercepting Internet communications without users' consent.

Most of the broadband providers named in the complaint only informed users about the NebuAd test by quietly revising their privacy policies; some also included an opt-out link in those new policies, but did not conspicuously alert consumers to the test or the opt-out link. The plaintiffs allege those procedures were not adequate.

"Defendants have intentionally obtained and/or intercepted ... electronic communications without plaintiffs' or class members' knowledge, consent, or authorization," the suit alleges.

If the court accepts that theory, it would signal an endorsement of the concept that broadband provider-based behavioral targeting requires either opt-in consent or something more than the chance to opt-out via "mouseprint"--that is, an opt-out provision buried in legalese that most people never see.

Ethan Ackerman, a lawyer in Washington, D.C. and former legislative and technology counsel in the U.S. Senate, said the court is likely to take the plaintiffs' concerns seriously. "This is definitely not a way-out-of-left-field lawsuit" he said. "There's a pretty good argument that clicking on a button with 13 pages of legal writing is not consent."

The Redwood City, Calif.-based NebuAd has retreated from its plan to purchase information from Internet service providers--but one rival, Phorm, has said it intends to launch in the U.S.

Phorm, with offices in New York, London and Moscow, is currently testing its platform in the U.K., but is seeking users' opt-in consent for that trial.

Three of the four largest Internet service providers recently testified that they would not work with behavioral targeting companies unless subscribers consented. In addition, some lawmakers, including Rep. Ed Markey (D-Mass.) have said they believe that companies that engage in behavioral targeting based on information gleaned from Internet service providers should first seek users' consent.