ISPs endorse user opt-in on Web tracking, deflect calls for privacy laws

Three top ISPs tell senators they can police themselves on behavioral advertising

WASHINGTON — Three of the four largest Internet service providers in the U.S. promised today that they will adopt policies requiring them to get meaningful permission from customers before tracking their online activities for targeted advertising purposes.

But the ISPs also took the opportunity to tell federal lawmakers at a U.S. Senate committee hearing that new legislation aimed at protecting online privacy isn't needed at this point.

Despite a flurry of concerns that have been raised in recent months about ISPs tracking the online activities of their subscribers, Congress should give the industry time to develop a set of best practices for behavioral advertising and data collection, said Tom Tauke, executive vice president of public affairs, policy and communications at Verizon Communications Inc.

"At this juncture, we aren't prepared to endorse legislation," Tauke told members of the Senate Committee on Commerce, Science & Transportation. Verizon has recruited other ISPs and online businesses to join a group focused on drafting best practices, Tauke said, adding that the group expects to draft some preliminary guidelines by year's end.

Tauke and representatives of AT&T Inc. and Time Warner Cable testified that their companies currently don't engage in behavioral advertising that uses data about the online activities of individual users to deliver contextual ads to them. The ISPs said that if they do decide to start behavioral advertising programs, they will give customers detailed descriptions of the programs and ask for explicit permission before they start tracking activities and collecting usage data.

Since late last year, a handful of ISPs have run trials or signed up to use a subscriber-tracking and targeted advertising service from NebuAd Inc. But privacy advocates have protested, saying that NebuAd's techniques, including the deep-packet inspection of Web traffic, could be illegal. In addition, NebuAd's business model required the customers of ISPs to opt out of the online tracking, instead of asking them to opt in.

In June, broadband services provider Charter Communications Inc. suspended its trial of NebuAd's service because of the privacy concerns. The following month, several lawmakers called on NebuAd to switch to an opt-in approach on its privacy notifications. And earlier this month, NebuAd said it was delaying its ISP behavioral advertising program while Congress looks at the issue.

But even a simple click-yes-to-opt-in model isn't comprehensive enough, Tauke said at today's Senate hearing. In many cases, Web users agree to something without reading the fine print, he said, adding that an opt-in approach needs to be conspicuous, lay out the options in detail and allow customers to opt out later if they change their minds.

Subscribers "want to be in control of their online experience," Tauke said. "Most consumers, I suspect, are like me. We're trying to do something online, a screen pops up, we hit 'OK' or 'continue' and move on, not really aware of what we just opted into."

AT&T also supports industry-developed standards for ISPs, said Dorothy Attwood, the company's senior vice president for public policy and chief privacy officer. But she cautioned that any government-imposed rules should apply to Web sites and online advertising vendors as well as ISPs, saying that users will be confused if they all have different privacy rules.

"Right now, there is behavioral targeting in the online environment, and it is by Web actors who don't have direct customers to answer to," Attwood said. "When the customer turns on a computer and goes to a Web page, I can't do anything to protect that customer from being tracked by other entities who are not at this hearing."

Sen. Byron Dorgan (D-N.D.) noted that there already is customer confusion about online privacy protections. He pointed to a poll released today by the Consumer Reports National Research Center, showing that 61% of the respondents were confident that their online activities are private and aren't being shared without permission, while 57% incorrectly believed that companies must identify themselves, indicate why they're collecting data and whether they intend to share it with other organizations.

Another 48% of those polled believe erroneously that they have to give their consent for companies to use personal information collected as a result of tracking online activities, Dorgan said. He asked the ISPs what information they currently collect about their subscribers for purposes unrelated to targeted advertising.

In response, Attwood said that AT&T does collect "lots of information" for purposes such as improving service. But she didn't elaborate.

While some Republican members of the Senate committee seconded the motion for ISPs to create their own privacy guidelines, Gigi Sohn, president of the consumer advocacy group Public Knowledge, called herself "the skunk at the self-regulatory party."

Sohn disagreed with suggestions by the ISPs that competitive pressures will force them to stick to the promised guidelines. "The problem is, at least in broadband, that there isn't that much competition," she said. "The notion that there's going to be this competitive pressure — I'm dubious."

Copyright © 2008 IDG Communications, Inc.

  
Shop Tech Products at Amazon