How Should I.S.P.s Tell You if They Want to Track Your Surfing? By Saul Hansell

April 9, 2008, 3:41 pm

How Should I.S.P.s Tell You if They Want to Track Your Surfing? By Saul Hansell
The term “unavoidable notice” has been bandied about by a group of Internet advertising executives recently as they explored whether to endorse proposals for Internet service providers to keep track of where their customers surfed and what they searched for.

One theory goes that such systems would be acceptable if customers were informed of the plan in a way that they were sure to see, with a clear way for users to choose not to have their activities recorded. (There are some who say that it is simply unacceptable for an I.S.P. to record the content of its customers’ communications under any circumstances.)

One of the leading companies involved in this concept, Phorm, says it is developing a plan that would in fact force users to see an explanation of its program and give them an explicit choice about whether to participate. Since the company won’t start operations for a few weeks, the details, which are very important, haven’t been disclosed.

The other company, NebuAd, which started operation last fall, seems to be going out of its way to avoid being noticed by the users it monitors. It won’t disclose the Internet providers or advertising companies it is working with. And after The Washington Post discovered two Internet providers it works with — Embarq and Wide Open West — those companies have refused to answer any questions about their relationship with NebuAd.

It always struck me that one good test of an idea is whether the people behind it are willing to stand up in public and say exactly what they are doing and why. And that seems a particularly apt way to look at these companies, which claim that their seemingly invasive plans are in fact very sensitive to the privacy of Internet users.

Both NebuAd and Phorm understand this. Both have hired public relations consultants and reached out to privacy advocates. Indeed, as I’ve written, the chief executives of both Phorm and NebuAd reached out to me and spent a long time discussing their companies and how their systems worked.

It’s early, but so far Phorm appears to be more committed to openness than NebuAd. It may have more of a hurdle to overcome to build trust. The company, under its previous name 121 Media, distributed software that displayed pop-up ads on users’ computers. Privacy groups, like the Center for Democracy and Technology, said the company’s software was spyware because it wasn’t disclosed properly when it was installed and was hard to remove.

Now that it has changed its business, Phorm says it is pursuing an open approach. It has published the names of the I.S.P.s it is working with and some sites that will use its advertising system. It has hired Ernst & Young to audit its system. And it says it will allow others to examine the system as well.

Most significantly, Kent Ertugrul, Phorm’s chief executive, told me that it would not start monitoring users until after it pops a screen in front of their browsing to explain the system. He wouldn’t say what the screen would look like. And the choice to opt out of the system, he said, might be on a second screen, not right next to the choice to opt in. Still, he promised that “the opt-out will be more transparent than anything else,” referring to other ad targeting systems.

BT Broadband, one of the three British Internet providers that are working with Phorm, will in fact give users the choice to participate or not on the same screen, at least in its initial tests. Emma Sanderson, BT’s director of value-added services, sent me this in an e-mail message describing how the disclosure will work:

The concept though is pretty straightforward…. the webpage will appear when a customer starts browsing, there will be a description of the service and three buttons - Yes I want the service, No I don’t want the service and I want more information (not these words exactly). If they request more information they will be taken to another page with more detail on it.

She said the company would start testing the service with 10,000 customers in coming weeks. It will be presented as a way to both reduce the number of irrelevant ads users see and also as an aid to online safety because Phorm also helps detect some fraudulent Web sites.

Ari Schwartz, the chief operating officer of the Center for Democracy and Technology, said that this approach may well be appropriate, depending on how easy it is for consumers to understand and how actions are interpreted. If someone closes the pop-up window without making an explicit choice, he said, it should not be considered consent to have their actions monitored.

NebuAd’s approach to disclosure, by any measure, is much further away from “unavoidable notice.” Robert Dykes, NebuAd’s chief executive, told me the company would force I.S.P.’s that participate to notify their customers about the program. But this can be by e-mail, an insert in a billing statement or some other format where boilerplate that consumers don’t read is placed. Of course, it requires that the companies also disclose the system in their privacy statements, another graveyard for unread legalese.
The privacy statement of Embarq is particularly terse. It doesn’t mention NebuAd. It does have a link to opt out of the system which goes to a Web site called Faireagle.com, which is run by NebuAd. Wide Open West has a somewhat more articulate privacy statement. It gives a brief example of how the system may work. It names NebuAd and gives several links where consumers can get more information.

In what other way, if any, did these companies notify their customers? That is one of many questions I had for them that they refused even to consider answering. Peter Smith, the vice president of programming for Wide Open West, declined to comment and declined to say why he was declining to comment.

I then called David Burgstahler, a partner of Avista Capital, the private equity firm that owns Wide Open West. He wouldn’t talk to me either. Amanda Heravi, an Avista spokeswoman, said she would see if she could find someone to talk to me, but I haven’t heard back yet.

At Embarq, Debra Peterson, the company spokeswoman, e-mailed this statement, saying she would entertain no further questions:

Like other companies, we are evaluating behavioral marketing tools, but we have not decided whether to move forward with them. Our Privacy Policy anticipates and alerts customers to possible future use of these tools, and offers customers the opportunity to simply and quickly opt out. EMBARQ takes its customers’ privacy very seriously and we take every precaution to ensure information about our customers remains secure and anonymous.

Embarq by the way is the big local phone company unit spun off from Sprint that is publicly traded.

In my conversation with Mr. Dykes, I asked several times why he wouldn’t name the Internet providers he works with. He said, “It is inappropriate for a vendor to talk about its customers.”

I asked him why users should feel comfortable being involved with a system when the companies using it are afraid to stand up in public and discuss it. I also suggested that customers may want to know in advance whether Internet providers they may choose to do business with will sell information about their browsing to ad targeting firms. He said there is no need to disclose that in advance, particularly because NebuAd allows people to go to its site and request a cookie on their computers that will indicate they don’t want to participate in its tracking program on any Internet provider.

“If someone thinks this is really important, they should simply opt-out,” Mr. Dykes said.

It’s not clear to me that these are the policies that will build the trust level that Mr. Dykes says he needs in order to convince the large Internet providers to sign up for his service.