NebuAd, Inc., an online advertising company that recently went out of business, has agreed to settle class action claims stemming from alleged violations of federal and state privacy laws. As we previously reported in June, plaintiffs filed suit against NebuAd and several defendant ISPs because of their collective practice of tracking consumers' online activities in order to deliver targeted advertisements. The complaint stated that the ISPs gathered the information and provided it to NebuAd, which in turn served targeted ads. The case against two of the four ISPs was dismissed for lack of personal jurisdiction. As we reported in June, NebuAd lost its motion to dismiss the state laws claims. We had continued to track the case as the court did not reach a decision on plaintiffs' allegations that NebuAd's activities violated the Electronic Communications Privacy Act (ECPA). In addition, the claims against the ISPs continued when the plaintiffs' re-filed against the ISPs in their local jurisdictions. Before the court was able to reach a decision on the merits of the federal ECPA claim, NebuAd agreed to settle the case. As part of the settlement NebuAd is to pay $2.4 million, with $800,000 going to the plaintiffs' attorneys, and $1.7 million going to a charity of plaintiffs' choice. NebuAd officials have also agreed to testify against the ISPs, who plaintiffs' allege participated in improper activities by not giving consumers adequate notice, not respecting consumers' choice to opt out of receiving behaviorally-tracked ads, and to not be tracked for advertising purposes.
TIP: Companies should exercise care when serving behaviorally-targeted ads and working with vendors who offer these services. This includes vendors who will serve ads on third-party websites as well as vendors who offer to take existing information companies might have about their consumers in order to serve behaviorally-targeted ads. When behaviorally targeted ads are served, companies can limit their liability in a potential lawsuit by giving consumers notice and the ability to opt-out. If a consumer opts out, care should be taken to both avoid collecting information in order to serve behaviorally-targeted ads, as well as avoiding serving any behaviorally-targeted ads. Self regulatory programs like that described at aboutads.info can assist in providing both notice and choice.