An advocacy group connected with the University of Ottawa Law School has requested that the Canadian privacy commissioner investigate whether it's legal for Internet service providers to sell information about subscribers' Web habits to companies like NebuAd.
Philippa Lawson, director of the Canadian Internet Policy and Public Interest Clinic, said the organization filed the request in response to reports that NebuAd is in talks with Canadian Internet service providers.
No reports of tests in Canada have yet surfaced, but Lawson said the clinic didn't want to wait until the platform was deployed. "It's obvious that this is happening south of the border, and in England, and now is the time for the privacy commissioner to examine it," she said.
NebuAd has conducted tests with several U.S. Internet service providers, including Embarq and Wide Open West. Plans for a test with Charter Communications were suspended after lawmakers questioned whether such targeting violates federal wiretap laws. In the U.K, NebuAd rival Phorm has also tested the platform.
NebuAd says it doesn't collect Web users' names or other personal data and that users can opt out of receiving targeted ads. The company says its platform places users into marketing buckets based on their Web surfing activity, including search queries, and then sends targeted ads to their computers.
But privacy advocates are concerned because Internet service providers have comprehensive information about subscribers' Web activity. Advocates say that even without knowing users' names or IP addresses, their Web activity alone can be enough to identify them. Older behavioral targeting companies, by contrast, only collect information about activity at a limited number of sites.
In the U.S., Rep. Ed Markey (D-Mass.) has indicated he believes that Internet service providers should not provide information about subscribers' Web activity unless they have expressly consented.
In its request for an investigation, the Canadian clinic argues that behavioral targeting based on information gleaned from Internet service providers violates the country's privacy law, which limits companies' ability to collect personal information about consumers.
At minimum, companies like NebuAd should not operate without obtaining users' explicit consent, Lawson said. But she also said that the clinic is asking Canada's privacy commissioner to investigate whether the platform is legal even if consumers opt in to it.
"We're suggesting that maybe it shouldn't be happening at all," Lawson said. "Companies shouldn't be collecting or disclosing personal information for purposes that a reasonable person would consider inappropriate in the circumstances."
A NebuAd spokesman did not respond to a request for comment.