What is Phorm?

Phorm is a service that allocates web users a unique identity number. It then tracks the websites visited by that user purely by reference to that identity number. Phorm then uses the information to place targeted adverts that match the interests recorded against the web user's identity number. Using Phorm technology, a marketer might be able to display an advert for a New York hotel to an individual who searches "New York holiday".

Phorm claims that it is only required to maintain a list of random numbers together with the interests associated with those numbers. Phorm has been eager to stress that it does not need to collect any personally-identifiable information from the web users.

Phorm's technology has yet to be launched in the UK but criticism from privacy campaigners has been gathering pace. Leading the charge is the Open Rights Group, the privacy lobbyist, which sent a letter to nine of the internet's biggest names (including Google, Facebook and Bebo) asking them to opt out of Phorm. Amazon, the UK's second most popular shopping website, has already opted out of Phorm technology. This means that Phorm will not have access to the browsing habits of Amazon web users.

Legal position

The European Commission's chief concern with the UK Government relates to the testing of Phorm's technology by BT. BT tested Phorm technology in 2008 but also conducted previous trials in 2006 and 2007, without the explicit consent of the users participating.

In April 2008, the UK's data protection authority, the Information Commissioner's Office (ICO) provided a statement on BT's use of Phorm and its compliance with UK laws, including the Data Protection Act 1998 (DPA), the Privacy and Electronic Communications (EC Directive) Regulations 2003 and the Regulation of Investigatory Powers Act 2000 (RIPA).

The ICO concluded that Phorm's technology did not infringe UK data protection laws for the following reasons:

  • user profiles are based on the unique identity number;
  • Phorm will not be processing personal data and the DPA will not apply;
  • users will be free to "opt in" or "opt out" of Phorm technology at any time; and
  • no lasting records of the browsing habits of the web users will be kept.

The ICO didn't give an opinion as to whether Phorm technology constitutes an illegal interception of communication under RIPA; the Home Office has responsibility for enforcing this piece of legislation.

However, with an increasing number of infuriated privacy campaigners, Phorm has now fallen under the watchful eye of the European Commission.

The European Commission

This month, the European Commission has suggested that the UK's privacy laws should be strengthened in relation to behavioural advertising. Specifically, under Article 226 of the EC Treaty, the European Commission has brought infringement proceedings against the UK Government for failure to implement EU data protection law correctly. The UK has two months to respond.

If the European Commission concludes that the UK Government has not correctly implemented legislation governing behavioural advertising technology, it may need to amend UK's data protection laws. Any such change will impact on online businesses and brand owners alike.

Ultimately, the European Commission proceedings will have the greatest impact on Phorm with many brand owners likely to view the technology as more trouble than it is worth.