Monitoring of Web Browsing By ISPs Raises Privacy Concerns

Charter Communications Inc (Charter), an ISP and the third largest cable operator in the US, plans to test a web-tracking program in four cities which will track its customers' web browsing, including search terms and URLs visited, and use that information to provide targeted advertising. To do this, Charter is partnering with an online ad firm, NebuAD, which has developed a system to categorize user profiles using packet inspection and shared user profiles with third-party advertisers. Customers would be permitted to opt out by installing a browser cookie; however, the cookie must be installed on every computer in the customer's home and re-installed if the cookie is deleted. Concerns expressed are that the monitoring and analysis of customers' web browsing may violate privacy laws, and, specifically, that the use of an opt-out mechanism may contravene the US Communications Act, section 631 of which requires cable operators to use opt-in consent when collecting and using its subscribers' personal information and web-browsing habits. Two US Congressmen, Representatives Markey and Barton, sent a letter to Charter expressing concerns over privacy issues and asking Charter to delay the testing until the Congressmen and Charter discuss the plan. (Markey is the Chair of the House Subcommittee on Telecommunications and the Internet, and Barton is a ranking member of the House Committee on Energy and Commerce). Additionally, Ryan Singel of Wired's Threat Level, has raised concerns that NebuAD's technology does not really permit a customer to opt out of data collection. He suggests that opt-out cookies cannot be detected by NebuAD's monitoring technology. As a result, he says, opt-out cookies permit customers to stop receiving targeted advertising from third party advertisers; however, they do not eliminate the monitoring and analyzing of customers' web browsing. Similarities have been drawn between Charter's system and a targeted advertising system developed by Phorm Inc (Phorm) in the UK. Phorm is partnering with ISPs in the UK to track the web browsing patterns of customers and provide targeted advertising. The Foundation for Information Policy Research (FIPR) sent an open letter to the UK Information Commissioner's Office (Commissioner) expressing its privacy concerns about Phorm's system, specifically, the need for an opt-in mechanism and the possibility that scanning of online communications is considered "interception" under the Regulation of Investigatory Powers Act 2000 (RIPA). The Commissioner analyzed the proposed Phorm system and agreed with FIPR that Phorm must implement opt-in consent. Since the Commissioner does not have responsibility over RIPA, he consulted with the UK Home Office whether Phorm's system was unlawful interception of communications under RIPA. The Home Office's view was that it was questionable whether there was even an interception of communications and that the RIPA was not intended to cover such communications. The Commissioner concluded that it would be possible for Phorm to operate its targeted advertisement system in compliance with privacy laws, but that he would continue to monitor Phorm's services. For further information about Charter, see: http://www.news.com/8301-13578_3-9947499-38.html?tag=ndfd.lede http://www.news.com/8301-13578_3-9945903-38.html http://tinyurl.com/6l6bsg http://blog.wired.com/27bstroke6/2008/05/charter-to-inse.html http://blog.wired.com/27bstroke6/2008/05/congressmen-ask.html http://blog.wired.com/27bstroke6/2008/05/theres-no-optin.html For more information about Phorm, visit: http://news.bbc.co.uk/2/hi/technology/7349715.stm http://www.fipr.org/080317icoletter.html http://tinyurl.com/6jfqka For the letter from US Representatives Markey and Barton to Charter, see: http://tinyurl.com/5698ry Summary by: Lauren Lodenquai