Phorm Says NebuAd Lacked ‘Notice and Choice’ in U.S. Targeting Trials

Privacy issues have come a long way since Hill staffers years ago told Dobbs, then with DoubleClick, that they weren’t concerned about spyware legislation harming free content, he said. “They looked at me sort of quizzically and didn’t understand” the role of ads, Dobbs said -- some staff thought ISP subscription fees were being paid to Web sites on a “prorated” basis. “Some of these folks are involved in the net neutrality debate right now,” he said.

Phorm’s targeting through ISPs is actually less invasive to users than targeting by online ad networks, Dobbs said, because Phorm doesn’t log IP addresses and it deletes all data associated with users after six months. Like NebuAd, Phorm puts users into broad categories, which Phorm calls “channels,” such as digital photography enthusiasts, to target ads. But NebuAd’s trials “definitely weren’t conducted in a manner of notice and choice” that’s required to pass muster with U.S. regulators, Dobbs said, adding that Phorm has been watching the debate in Congress. Phorm is about to start another trial with BT on an opt-in basis, he said: “Clearly we're moving to a much higher level of notice and consent for these systems.” NebuAd, which lost its ISP customers following Hill scrutiny and halted its ISP targeting services, couldn’t be reached to respond to Phorm’s claims.

The FTC’s principles on online advertising and privacy should be published “pretty soon,” said Jessica Rich, assistant director in the Privacy and Identity Protection Division: “We're still considering the issues.” She warned fans of detailed guidance that the draft principles, which aren’t binding on industry, are “pretty high level and they're going to remain that way.” Rich may have tipped the FTC’s hand when she said the agency isn’t interested in punishing “minimal” privacy violations. What disappointed the FTC during the comment period on its principles was that many Internet companies “weren’t particularly forthcoming” about how their targeting actually works. The agency must know “how the data flows” to write solid guidelines, she said.

The Center for Democracy and Technology isn’t thrilled with the FTC’s hands-off approach, said Ari Schwartz, chief operating officer. The Network Advertising Initiative, an 8- year-old voluntary system for targeting companies to let users opt out, “almost at the time it was written was obsolete,” he said. Facebook and Apple showed some savviness when they quickly blocked outside applications for the social network and iPhone that siphoned off user data, Schwartz said. But it’s unclear how much more sensitive data will be handled by Google Health, Microsoft Health Vault and other applications that are free to use, he said.

A ‘Sea Change of Philosophy’ at Ad Networks

Internet companies have cleaned up their act on privacy issues, they said. Following user outcry, Google quickly scrapped its collection of IP addresses and placement of cookies for the “Suggest” Web-address feature in its new Chrome browser, said Jane Horvath, senior privacy counsel. Jules Polonetsky, AOL chief privacy officer, said the recent moves by Internet companies to delete users’ data after a certain period was a “sea change of philosophy” from the early days of online advertising. Google recently halved its retention period following European scrutiny (WID Sept 10 p1). Product designers at AOL now jump at the chance to add privacy features, Polonetsky said. All agreed publishers and targeting companies haven’t explained well to consumers what they get out of targeting. Amazon.com has been an exception, showing users how their purchases influence Amazon’s recommendations, Polonetsky said.

Participants traded jabs over whether ISPs or Web sites were worse for privacy, and which deserves stronger regulation. In ISP targeting, “everyone understands your warts” because clickstream data potentially can reveal much about Internet users, Dobbs said. The pitfalls from traditional online ad networks are “part of the iceberg below the water,” though. Polonetsky contrasted the value of targeted information from Google and Amazon versus the “addendum that I'm signing” to let an ISP parse a subscriber’s clickstream data: “It’s going to take a real hard set of thinking to explain to users” how it helps them. Horvath said ISPs have little excuse to target advertising because they “charge quite a bit for access.” IP addresses are also highly identifiable for ISPs because they have the user’s account information, she added.

Schwartz blasted Phorm and NebuAd for their “over-the- top, outrageous, extreme” actions in ISP targeting. NebuAd did its trials with ISPs in parts of the U.S. where customers weren’t likely to complain, he said. Most known trials happened far from metropolitan areas, though ISPs have said they chose the locations (WID Aug 13 p3). BT customer service reps weren’t even informed that Phorm was running tests when customers complained about network problems, Schwartz said. An e-commerce company that used similar techniques, including the forgery of packets in Internet traffic, would be blocked by Internet security software, he said. Dobbs said Phorm has always given notice of its practices to consumers. BT is giving users choice through an interstitial page before the targeting is activated, he said. -- Greg Piper

Pike & Fischer Web 2.0 Conference Notebook…

YouTube’s filtering system is about 80 percent effective in blocking copyrighted material from being uploaded to the site, said David Green, NBC Universal vice president of public policy. A year ago, the site was awash in illicit NBC programming. Today, when a YouTube visitor searches the site for “SNL” only 9 percent of the results contain copyrighted Saturday Night Live material, he said. The filtering is changing user behavior in two ways, he said. First, people looking for NBC programming are decreasingly finding it on YouTube, hopefully leading them to look to NBC.com or Hulu instead. Second, users who upload the programming are learning that copyrighted material won’t get through, he said. Western video hosting sites in general are working more closely with copyright owners in the last year, as a result of the adoption of a set of principles for user- generated content sites, he said. Even among companies like Google that have not signed onto the principles, there has been much progress, he said. The outcome of Viacom’s lawsuit against YouTube will help settle some uncertainties about how the safe harbors in copyright law will be interpreted moving forward, said attorney Martin Hansen. Questions about direct financial benefit, knowledge and awareness of infringing activity and whether efforts to filter mitigate liability should get a good vetting in the case, he said. In France, courts have a recent history of siding with copyright owners in online infringement cases, attorney Asim Singh said. Even though those same courts have found such sites are classified as “hosting providers” rather than “content publishers,” which would seem to afford them broader protections, “European courts clearly tend to distort what the statute says and find in favor of the copyright owner,” he said. Looking at two recent cases involving eBay, courts may be able to develop a third classification for sites like YouTube and DailyMotion, he said. In those cases, the courts found that eBay provides a service -- brokering sales -- and is subject to a separate set of rules from “hosting providers.” -- JW-

---

The one thing the Internet and content industries know about the Web is that they know nothing, said Kevin Kuzas, Comcast Interactive Media general counsel. The two-year-old Comcast division, which runs Comcast.net and Fancast, has purchased movie-ticket site Fandango, video-publishing provider thePlatform, contact synchronizer Plaxo, and most recently pop-culture site DailyCandy.com. Kuzas called privacy problems with behavioral targeting by ISPs “largely theoretical” because deployments have been few and far between, though the architecture is essentially the same as for traditional ad networks. The DMCA doesn’t give carte blanche to Web sites whose users post copyrighted content, but content owners are also wrong to dispute that some copyrighted content online counts as fair use, he said. Similarly, sites should be wary and fact-specific when deciding if a proposed activity is fair use, he said. “There are not bright-line rules.” Companies should cherish their business relationships even when they are “dead right” on legal arguments, he said. Silicon Valley companies must ditch their attitude that the government is “irrelevant” to their business, Kuzas said. Regulation is “much more likely” with the recent arrival of the DMCA’s tenth anniversary, though Congress probably needs more than a year to finish copyright reform, he said. Kuzas also predicted that the dearth of sales taxes on e-commerce likely will be reversed by cash-strapped states.