• by Wendy Davis  @wendyndavis, July 18, 2008

Several lawmakers said Thursday that NebuAd and other companies that want to serve targeted ads to Web users based on info gathered from Internet service providers should first obtain users' express consent.

Rep. Ed Markey (D-Mass.), who chaired the hearing of the House Subcommittee on Telecommunications and the Internet, said that at a minimum, companies engaged in Internet service based-targeting must provide "clear, conspicuous and constructive notice" of the practice and then seek "meaningful, 'opt-in' consent."

He compared NebuAd's system to a package carrier inspecting people's deliveries and selling information about the contents to marketers. "We all have an expectation when we put something in FedEx that Mr. FedEx won't open it up before he puts it at our door," Markey said.

A number of other Congressional Democrats agreed that broadband provider-based behavioral targeting requires opt-in consent, including Gene Green (D-Texas), Bart Stupak (D-Mich.) and Mike Doyle (D-Pa.).

"Why do I have to opt out?" Stupak asked. "Why should the burden be on the American consumer?"

NebuAd CEO Bob Dykes attempted to reframe the discussion into a definition of proper notice, saying that notice should be "robust" and not buried in "some big 20-page document." But the Congress members kept coming back to the question of opt-in vs. opt-out.

"I don't know how you define robust notice, but I know you should have to check the box that says, 'I want you to do this,'" Doyle said.

Green went so far as to call it "contemptible" to track people through Internet service providers for marketing purposes without their consent.

Not all lawmakers felt that way. Rep. Cliff Stearns (R-Fla.) fretted that new limits on advertising techniques could hurt businesses. "Overreaching privacy regulations at this time could possibly do more damage to this fragile economy," he said.

Stearns also said that any new laws should apply across the board, to search engines like Google as well as behavioral targeting companies like NebuAd. "Whatever the appropriate standards are, they should all apply to everyone," he said.

The hearing was triggered by the emergence of Internet service provider-based behavioral targeting company NebuAd, which recently conducted tests of its platform with Embarq, WOW and several other networks.

While behavioral targeting is not new, the idea of gathering data from Internet service providers is. Privacy advocates find this type of platform especially troubling because Internet service providers have access to comprehensive clickstream data, while older behavioral targeting companies only track users across a limited number of sites.

Markey Thursday said he agreed that NebuAd's platform is fundamentally different from older methods. "There is a distinction in the detail, type, and amount of data collected. As opposed to individual websites that know certain information about visitors to its websites and affiliates, deep packet inspection technologies can indicate every website a user visits and much more about a person's web use," Markey said in his opening statement.

The hearing was specifically about deep packet inspection and privacy--but one witness, Scott Cleland, founder of the consultancy Precursor, took the opportunity to attack Google. Cleland called Google "the worst privacy offender on the Internet" for the vast amount of information it retains about users. (Cleland also works for Internet service providers that oppose Google's pro-net neutrality stance.) He argued against singling out NebuAd or other broadband provider-based targeting companies for legislation.

But Markey turned Cleland's arguments against NebuAd. He turned to Dykes and said: "You get access to all of Google. You get access to EBay, Amazon, everyone. You're Google times one hundred."