Two Embarq subscribers are asking the U.S. Supreme Court to rule on whether the Internet service provider violated privacy laws by partnering with the defunct behavioral-targeting company NebuAd.
“The present case illustrates the significant harm to societal interests in communication privacy if an ISP is considered to be permitted, in the ordinary course of its business, to sell its customer’s private communications to the highest bidder,” Kathleen and Terry Kirch argue in their petition to the Supreme Court.
Embarq was one of six ISPs to test NebuAd's behavioral advertising technology in late 2007 and 2008. The ISPs allowed NebuAd to install a device on the networks that enabled it to learn about users' Web-surfing history -- including activity at search engines and noncommercial sites. The ad company then served ads to people based on their Web activity. NebuAd paid Embarq around $30,000 for three months' worth of data from 26,000 customers, according to the court records.
The Kirches were among the consumers who sued NebuAd and its ISP partners for allegedly violating federal wiretap laws. NebuAd, which folded in 2008, agreed to pay $2.4 million to settle the litigation, but the ISPs fought the cases.
Late last year, the 10th Circuit Court of Appeals ruled that Embarq didn't itself violate any wiretap laws by allowing NebuAd to gather data about subscribers' Web activity. The court ruled that the federal wiretap law only imposes liability on companies that wrongly intercept traffic. That wiretap statute prohibits companies from intercepting or disclosing subscribers' electronic communications without their consent.
The appeals court said that NebuAd alone was responsible for any potentially unlawful interceptions. That 10th Circuit reached that decision based on its determination that NebuAd didn't share the raw data, or user profiles it created, with Embarq. The ruling upheld a decision by U.S. District Court Judge Julie Robinson in the District of Kansas, who granted summary judgment to Embarq in August of 2011.
The Kirches are now asking the Supreme Court to accept the case. The subscribers argue that the 10th Circuit's ruling leaves consumers with no recourse if ISPs sell their users' clickstream data. “Given the entrusted role ISPs play in daily communications, both personal and business, it is critical that the ECPA (Electronic Communications Privacy Act) be interpreted as prohibiting ISPs from redirecting communications at will,” the Kirsches argue.
NebuAd's technology drew criticism from lawmakers -- who held hearings on Capitol Hill about the company -- as well as privacy advocates. One of the biggest criticisms was that ISPs were able to provide data about everything consumers did online -- including their activity at sensitive sites, like pages operated by hospitals or religious organizations. NebuAd said its data collection was anonymous, and that consumers could opt out of the program.
The other ISPs to test NebuAd's program were CenturyTel, Knology, Bresnan, Cable One and Wide Open West. A privacy lawsuit against CenturyTel was dismissed in 2011, while a case against the ISP Knology was sent to arbitration. Litigation is still pending against Bresnan and Wide Open West.
Consumers in all of the cases are represented by lawyers Scott Kamber and Joseph Malley, who also have brought privacy lawsuits against Netflix, Facebook and other Web companies.