In a clear indication that online privacy concerns are on the rise, a class action complaint has been filed against several companies that use consumer data obtained through "deep packet inspection," a technology that tracks and consolidates all web-related information for an individual at the ISP level, in order to provide targeted online advertising. The complaint, filed in federal district court in California, alleges that NebuAd, Inc., and its ISP affiliates violated the federal Electronic Communications Privacy Act and Computer Fraud and Abuse Act, and the California Computer Criminal Law and Invasion of Privacy Act, by using deep packet inspection to intentionally intercept the online transmissions of subscribers without notice or consent.

The plaintiffs claim that NebuAd obtained sensitive information and personally identifiable information by tapping directly into consumers' ISP connection, and then analyzed such information and shared it with its subsidiaries who use it to display ads while consumers use the Internet.

Separately, in December, 2007, the Federal Trade Commission issued proposed guidelines for online behavioral advertising. (We summarized the proposed guidelines in our December 2007 client alert .) In July, 2008, Lydia Parnes, Director of the FTC's Bureau of Consumer Protection, testified before Congress on this issue. She said that "the Commission is cautiously optimistic that the privacy concerns raised by behavioral advertising can be addressed by industry self-regulation," which "affords the flexibility that is needed as business models continue to evolve." She also noted, however, that the FTC will continue to monitor the marketplace closely so it can take appropriate action as needed.

While targeted advertising based on consumers' online activities potentially allows marketers to reach those consumers most interested in hearing their messages, the practice has raised privacy concerns for consumer groups and regulators, particularly when such advertising is enabled by the use of deep packet inspection or other intrusive techniques. It is likely that regulation and self-regulation will develop to address consumers' concerns in the coming year.