The House Committee on Energy and Commerce on August 1, 2008 requested 33 cable, phone, and Internet companies to respond to a series of questions regarding the trend of companies tailoring Internet advertising based upon consumers’ Internet search, surfing, or other use. Congressional hearings in the spring and summer focused on tracking of consumer web interactions performed by Internet service providers (ISP) for ad targeting purposes. The Committee letter, signed by Representatives Joe Barton (R-TX), John Dingell (D-MI), Ed Markey (D-MA), and Cliff Stearns (R-FL), asked the companies to state the nature and extent to which they have engaged in such practices and the impact it could have on consumer privacy. Below is a summary of the responses to the Committee.

Few Companies Testing “Deep Packet Inspection” Technology

In response to the Committee’s letter, the majority of the companies indicated that they had not tailored or facilitated the tailoring of Internet advertising based on consumers’ Internet use. A small handful of companies indicated that they had tested tailored Internet advertising. Of these companies, all but one explicitly stated that they had tested the technology in partnership with NebuAd for a limited period of time with a discrete set of customers. Charter Communications, a company that had received a prior letter from the Committee directing it not to engage in such practices, indicated that it had considered initiating a limited pilot of NebuAd’s enhanced advertising, but ultimately chose not to move forward with the pilot.

Significant Consumer Privacy Protections Built into Targeted Internet Advertising

A common theme among the responses to the Committee was that companies already provide significant consumer protection and support providing customers with robust notice and choice. For instance, Cable One stated it supported first obtaining affirmative consent via an “opt-in” option from customers to use the technology, and then providing them with the continuous ability to opt out of having their information used for behavioral advertising purposes.

Charter Communications indicated in its comments that NebuAd’s system itself is designed to honor consumer privacy. Charter Communications comments explained that NebuAd’s system contains both contractual and technical measures built in to avoid tracking or serving of advertisements based on Internet visits related to medical information, racial or ethnic origins, religious beliefs, adult content, or content of a sexual nature. Others indicated that that the NebuAd technology does not use, track, or store personally identifiable information, such as a first and last name, physical street address, email address, telephone number, social security number, or information from password-protected sites (e.g., HTTPS traffic).

Expansion of Inquiry Beyond DPI

What began as a focus on ISP based behavioral advertising during the Committee’s July 17, 2008 hearing on privacy implications of using the technology for Internet advertising services was expanded by the Committee’s August 1, 2008 letter. The letter broadened the scope of the inquiry to include an examination of technologies beyond ISP behavioral targeting to practices by Internet companies that involve tailoring Internet advertising based upon consumers’ Internet use. In response to the Committee’s letter, companies described other technologies and practices used to perform behavioral advertising.

AT&T’s comments noted for example, that ISP based behavioral targeting is not the most prevalent technology used by companies to track a consumer’s overall web search and web browsing activities. AT&T asserted that advertising- network operators “have the ability to observe a user’s entire web browsing experience at a granular level, including all URLs visited, all searches, and actual page-views. Techniques include the ad network ‘dropping’ third-party tracking ‘cookies’ on a consumer’s computer to capture consumer visits to any one of thousands of unrelated websites; embedding software on PCs; or automatically downloading applications that – unbeknownst to the consumer – log the consumer’s full session of browsing activity.”1

Google, Microsoft, and Yahoo! each commented on the value of Internet advertising created through non-ISP behavioral tracking practices. Google indicated that its services deliver advertising products to hundreds of thousands of small businesses and other companies around the world. Microsoft explained that its service delivers personalized advertisements through its own properties and the sites of advertising partners. Yahoo! stated that it operates display and sponsored search advertising platforms that provide customized advertising to the company’s users.