• by Wendy Davis  @wendyndavis, November 6, 2007

A flurry of online advertising initiatives unveiled this week have some privacy advocates renewing calls for government regulation.

Social network Facebook is expected to offer a new program that will allow marketers to serve ads to members based on information in their profiles, while MySpace is expanding its behavioral targeting offering. In addition, Monday saw the official launch of NebuAd, a start-up that partners with Internet service providers to serve ads to people based on both their search queries and the Web sites they have visited.

The moves trouble privacy groups, who argue that consumers don't realize that companies use data about their Web use to compile marketing intelligence.

Marc Rotenberg, executive director of the Electronic Privacy Information Center, said the recent activity "shows the urgency for the FTC to set out baseline standards to protect online privacy.

"From our perspective, secret profiling is a harm in itself," he said, adding that marketers potentially can use profiles not just to target ads, but also to blacklist consumers or otherwise act to their detriment.

MySpace will offer consumers a way to opt out of the targeting programs, and Facebook is expected to do the same--but that alone doesn't satisfy all privacy advocates. Jeff Chester, founder and executive director of the Center for Digital Democracy, argues that rather than give people the chance to opt out of targeting, companies shouldn't create profiles without first obtaining opt-in consent.

"You don't want to create, by default, a series of data-mining factories that can churn out digital dossiers on each and every one of us with the touch of a button," he said.

The new programs are coming just as the FTC wrapped up a two-day town hall meeting addressing behavioral targeting and online privacy. At the meeting, privacy advocates stressed that consumers don't understand enough about behavioral targeting to effectively consent to it.

In a move timed to coincide with the meeting, the Center for Democracy & Technology led a coalition of privacy advocates in proposing that the government create a do-not-track list for people who don't want to receive ads based on their Web-surfing history. Internet industry executives countered that government regulation would stifle innovation online.

Meanwhile, NebuAd, which has raised more than $30 million in venture funds, boasted Monday that it can use ISP data to compile far more detailed profiles than other behavioral targeting companies. "We see all of the pages you go to and all of the searches you do," CEO Bob Dykes said. When combined, that information provides marketers with a "much greater level of insight into what you're doing," he said.

Dykes stresses that the profiles are anonymous, since NebuAd isn't compiling names or email addresses of users, and that users can opt out of the program. Still, the sheer comprehensiveness of the information available through ISPs troubles privacy advocates. In fact, one of the biggest concerns that privacy groups have with the proposed Google-DoubleClick merger is that the companies will combine people's search history with their Web-surfing activity to create detailed marketing profiles.

"When you sit around and think what scenarios would be so bad that you don't want to think about them, this is it," said Pam Dixon, executive director of the World Privacy Forum.

Dykes downplays the privacy concerns, emphasizing that the company doesn't store records of search queries. "We don't want the government on our door saying, 'Tell us all people who do a search on guns,'" he said.

NebuAd also doesn't keep records of Web-surfing activity indefinitely, although the length of time it keeps information varies depending on the nature of the activity. For example, people who indicate they're interested in buying flowers will usually make a purchase within an hour of conducting a search or visiting a site, Dykes said. For cars, the purchase window is closer to one month.

Dykes says NebuAd is working with ISPs across the country, but declined to name which ones. The company also is working with a number of ad networks, and while Dykes declined to name them, he said that together they account for 25% of impressions served by ad networks in the United States.

Dykes also said the company isn't accepting ads for products that raise clear red flags for privacy. For instance, NebuAd isn't accepting ads for medications used to treat HIV, so the company has no reason to target likely HIV-positive Web users. But the company isn't ruling out the entire pharmaceutical industry.

"I would imagine that we could take an ad for aspirin, but not for a sensitive drug," Dykes said.