Embarq Response on Behavioral Advertising Comes Up Short
Last week we blogged about the continuing congressional pressure facing ISPs regarding their involvement in behavioral advertising. Embarq has replied to the letter that Rep. Dingell, Rep. Barton, and Rep. Markey sent last week inquiring about the company’s trials of a new system that tracks the Web sites subscribers visit and uses that data to serve targeted advertisements to those subscribers. Press reports had indicated that Embarq was partnering with online ad network NebuAd for the test. According to a separate Embarq letter released yesterday, the trial involved 26,000 subscribers in Gardner, Kansas, and only 15 subscribers opted out. One of the most troubling aspects of Embarq’s response concerns its approach to notice and consent. Embarq states that the company "posted a notice in the Privacy Policy that appeared on Embarq’s website." As our recently-released legal analysis pointed out, such notice is most likely inadequate to meet the requirements set out in wiretapping laws, including the Federal Wiretap Act. This law requires an ISP to obtain its subscribers’ consent before intercepting or disclosing their communications – a standard that does not appear to have been met by Embarq. Embarq fails to address this discrepancy, but instead focuses on how its system aligns with the FTC’s proposed self-regulatory principles. The first proposed principle outlined by the FTC is that "[e]very website where data is collected for behavioral advertising should provide a clear, concise, consumer-friendly, and prominent statement" about the behavioral advertising. In its response to the Congressmen, Embarq replaced the word "website" with "company," which drastically narrows the scope of the principle and alters its meaning. The number of companies that collect data for behavioral advertising is dwarfed by the number of Web sites where data is collected for that purpose. Moreover, behavioral advertising companies usually have no direct relationship with consumers, which means that consumers are unlikely to look for or read any notices posted on those companies’ Web sites. Surely, the FTC meant what it said when it issued a principle requiring notice on Web sites where data is collected, not on the sites of the companies doing the collecting. In the case of the Embarq system, that means virtually every Web site its subscribers visit would need to provide notice in order to comply with the principle. Again, the notice Embarq provided falls far short. Embarq also claims that the trial did not "involve keeping ‘profiles’ on customers." However, this claim cuts against our understanding of NebuAd’s services. NebuAd’s recent House testimony even describes how its service constructs "unique and anonymous user profiles" that are "used to select and serve the most relevant advertisements to that user." The anonymity of such profiles may be a separate point of debate, but NebuAd’s business model seems to depend on maintaining profiles in some form in order to deliver targeted advertising. Embarq emphasizes that "[n]o raw or identifiable customer data was ever collected or utilized during the test." However, as we noted both in our legal analysis and our testimony before the House Energy & Commerce committee, the Wiretap Act criminalizes the mere interception of electronic communications, regardless of whether the data is identifiable. Embarq notes at the end of the letter that "[i]t appears that industry standards in this area are evolving rapidly toward a more robust form of notice and choice." Industry standards aside, the system that Embarq employed is already governed by wiretapping laws that require far more robust notice and consent than the company used in its trial. Despite its quick response, it looks like Embarq still has more explaining to do.