A judge has dismissed a class-action privacy lawsuit against the Internet service provider Embarq, one of six companies that partnered with the defunct behavioral targeting company NebuAd.
U.S. District Court Judge Julie Robinson in the District of Kansas ruled late last week that NebuAd alone was responsible for any wiretap law violations, although Embarq allowed NebuAd to learn about subscribers' Web activity. "Embarq did not itself intercept any communications," Robinson wrote. "Accordingly, Embarq is entitled to summary judgment on this ground."
Robinson also ruled that Embarq was entitled to dismissal of the case since its subscribers consented to NebuAd's behavioral targeting platform by failing to opt out of the program.
NebuAd partnered with ISPs to gather data about Web users' activity for ad-serving purposes. To accomplish this, ISPs allowed NebuAd to install a device on their networks that enabled NebuAd to learn about users' Web-surfing.
The technology drew criticism from privacy advocates for several reasons. One of the major ones was that ISPs were able to provide data about everything consumers did online -- including their searches and activity at non-commercial sites. NebuAd said its data collection was anonymous, and that consumers could opt out of the program.
Like most of the ISPs that tested NebuAd's platform in 2007 and 2008, Embarq notified subscribers about the technology by quietly revising its privacy policy shortly before conducting the test. In Embarq's case, the change consisted of adding a "preference advertising" paragraph, which said that Embarq might use information about sites visited in order to "deliver or facilitate the delivery of targeted advertisements." That paragraph had an opt-out link.
Robinson rejected the Web users' argument that Embarq should have more proactively alerted them to the new technology. "Plaintiffs' argument that the notice was not conspicuous enough is belied by their admission that the prevailing industry practice among Web sites is to disclose their relationship with advertising networks and the type of information those networks collect, in their privacy policies," Robinson wrote.
Justin Brookman, director of the Consumer Privacy Project for the digital rights group Center for Democracy & Technology, criticized Robinson's decision. "I do not believe a buried update to a privacy policy is sufficient notice and consent to the monitoring of Internet traffic by an ISP partner for profiling purposes," he says in an email to Online Media Daily.
Brookman adds that other courts have rejected terms of service that give companies the right to revise their terms at any time. "How can it be an above-board, fairly negotiated contract if one side can just change the contract's terms whenever it wants?" he asks.
Internet law specialist Venkat Balasubramani added that the decision "may be debatable under existing rules." He also said that the ruling "certainly shows judicial skepticism toward these types of privacy lawsuits."
The dismissal came several days after NebuAd agreed to pay $2.4 million to settle a lawsuit alleging that it violated federal wiretap and computer fraud laws. A similar lawsuit against CenturyTel was also dismissed, while a case against the ISP Knology was sent to arbitration. Litigation is still pending against three other ISPs: Bresnan, Cable One and Wide Open West.