Duck Duck Go posts an informative and detailed write up of how browsers snoop on your internet browsing
||2nd April 2021 |
See article from spreadprivacy.com
||21st September 2019 |
How cookies and tracking exploded, and why the adtech industry now wants full identity tokens. A good technical write up of where we are at and where it all could go
article from iabtechlab.com
ICO reports on adtech snooping on, and profiling internet users without their consent
||25th June 2019 |
article from ico.org.uk
report [pdf] from ico.org.uk
In recent months we've been reviewing how personal data is used in real time bidding (RTB) in programmatic advertising, engaging with key stakeholders directly and via our fact-finding forum event to understand the views and concerns of those
We're publishing our Update report into adtech and real time bidding which
summarises our findings so far.
We have prioritised two areas: the processing of special category data, and issues caused by relying solely on contracts for data sharing across the supply chain. Under data protection law, using
people's sensitive personal data to serve adverts requires their explicit consent, which is not happening right now. Sharing people's data with potentially hundreds of companies, without properly assessing and addressing the risk of these counterparties,
raises questions around the security and retention of this data.
We recognise the importance of advertising to participants in this commercially sensitive ecosystem, and have purposely adopted a measured and iterative approach to
our review of the industry as a whole so that we can observe the market's reaction and adapt our thinking. However, we want to see change in how things are done. We'll be spending the next six months continuing to engage with the sector, which will give
the industry the chance to start making changes based on the conclusions we've come to so far.
Open Rights Group responds
25th June 2019. See
article from openrightsgroup.org
The ICO has responded to
a complaint brought by Jim Killock and Dr Michael Veale in Europe's 12 billion euro real-time bidding adtech industry. Killock and Veale are now calling on the ICO to take action against companies that are processing data unlawfully.
The ICO has agreed in substance with the complainants' points about the insecurity of adtech data sharing. In particular, the ICO states that:
Processing of non-special category data is taking place unlawfully at the point of collection
[The ICO has] little confidence that the risks associated with RTB have been fully assessed and mitigated
Individuals have no guarantees about the security of their personal data within the ecosystem
However the ICO is proceeding very cautiously and slowly, and not insisting on immediate changes, despite the massive scale of the data breach.
Jim Killock said:
conclusions are strong and very welcome but we are worried about the slow pace of action and investigation. The ICO has confirmed massive illegality on behalf of the adtech industry. They should be insisting on remedies and fast.
Dr Michael Veale said:
The ICO has clearly indicated that the sector operates outside the law, and that there is no evidence the industry will correct itself voluntarily. As long as it remains doing
so, it undermines the operation and the credibility of the GDPR in all other sectors. Action, not words, will make a difference--and the ICO needs to act now.
The ICO concludes:
Overall, in the ICO's view the adtech industry appears immature in its understanding of data protection requirements. Whilst the automated delivery of ad impressions is here to stay, we have general, systemic concerns around the
level of compliance of RTB:
- Processing of non-special category data is taking place unlawfully at the point of collection due to the perception that legitimate interests can be used for placing and/or reading a cookie or other technology (rather than
obtaining the consent PECR requires).
- Any processing of special category data is taking place unlawfully as explicit consent is not being collected (and no other condition applies). In general, processing such data
requires more protection as it brings an increased potential for harm to individuals.
- Even if an argument could be made for reliance on legitimate interests, participants within the ecosystem are unable to
demonstrate that they have properly carried out the legitimate interests tests and implemented appropriate safeguards.
- There appears to be a lack of understanding of, and potentially compliance with, the DPIA
requirements of data protection law more broadly (and specifically as regards the ICO's Article 35(4) list). We therefore have little confidence that the risks associated with RTB have been fully assessed and mitigated.
Privacy information provided to individuals lacks clarity whilst also being overly complex. The TCF and Authorized Buyers frameworks are insufficient to ensure transparency and fair processing of the personal data in question and
therefore also insufficient to provide for free and informed consent, with attendant implications for PECR compliance.
- The profiles created about individuals are extremely detailed and are repeatedly shared among
hundreds of organisations for any one bid request, all without the individuals' knowledge.
- Thousands of organisations are processing billions of bid requests in the UK each week with (at best) inconsistent
application of adequate technical and organisational measures to secure the data in transit and at rest, and with little or no consideration as to the requirements of data protection law about international transfers of personal data.
There are similar inconsistencies about the application of data minimisation and retention controls.
- Individuals have no guarantees about the security of their personal data within the
ICO and Ofcom survey public opinion on online advertising targeted from snooping on browsing history
||22nd March 2019 |
press release from ofcom.org.uk
survey [pdf] from ofcom.org.uk
The ICO has commissioned research into consumers' attitudes towards and awareness of personal data used in online advertising.
This research was commissioned by the Information Commissioner's Office. Ofcom provided advice on
the research design and analysis. The objective of this research was to understand the public's awareness and perceptions of how online advertising is served to the public based on their personal data, choices and behaviour.
Advertising technology -- known as adtech -- refers to the different types of analytics and digital tools used to direct online advertising to individual people and audiences. It relies on collecting information about how individuals use the internet, such as search and browsing histories, and personal information, such as gender and year of birth, to decide which specific adverts are presented to a particular person. Websites also use adtech to sell advertising space in real-time.
The research finds that more than half (54%) of participants would rather see relevant online adverts. But while 63% of people initially thought it acceptable for websites to display adverts, in return for the website being free
to access, this fell to 36% once it was explained how personal data might be used to target adverts.
December 2013 |
High Court hears a case for British internet users whose privacy has been breached by Google collecting information on their browsing habits to have the right to sue the company for damages in the UK
article from telegraph.co.uk
ASA announces new advertising rules enforcing options to turn off behaviourally targeted adverts like on Google Adsense
February 2013 |
See press release from
New advertising rules overseen by the Advertising Standards Authority (ASA) that provide the public with notice of, and control over, online behavioural advertising (OBA) come into effect today.
OBA is a form of targeted advertising. It
involves the collection of information from a web browser, about web viewing behaviour so that it can be used to deliver online advertisements that are more likely to be of interest to the user of that computer.
The new rules require ad networks
delivering behaviourally targeted ads to make clear they are doing so. Most are likely to do that through an icon in the corner of online ads. They must also allow consumers to exercise control over receiving targeted ads by providing an opt-out tool.
Anyone concerned about transparency and control of OBA can contact the ASA. Our website contains easy-to-understand information about what OBA is, how it works and how consumers can opt-out of receiving it if they choose. If a consumer continues
to receive OBA despite having exercised their choice not to, we will take action to stop it on their behalf.
The Information Commissioner remains responsible for looking into complaints about the issue of consent, e.g. around the placement of
cookies on a computer's web browser.
More information, tips and advice about OBA and opting-out can be found in the Your Ad Choices section of the YourOnlineChoices
Chief Executive of the ASA, Guy Parker says:
The new rules will provide greater awareness of and control over OBA, demystifying how advertisers deliver more relevant ads to us and allowing those of
us who object to say stop. We'll be there to make sure that the ad networks stick to the rules.
|2nd March |
See article from privacyinternational.org
See article from
Viviane Reding told the BBC that authorities found that transparency rules have not been applied .
The policy change,
implemented on 1st March, means private data collected by one Google service can be shared with its other platforms including YouTube, Gmail and Blogger.
Google said it believed the new policy complied with EU law. It went ahead with the changes
despite warnings from the EU earlier this week.
2nd March 2012. See
article from privacyinternational.org
Google wants to be able to provide an ID card equivalent for the Internet.
...Read the full article
|6th February |
European Advertising Standards Alliance define new rules to inform web surfers that adverts they see are determined
article from independent.co.uk
When new rules governing the way companies collect and use data about our movements online come into force, a little i symbol will appear on screen to reveal adverts generated by cookies . Many internet users find these digital devices,
which are used by websites to create personal profiles based on use of the Internet, intrusive.
The data is used for Online Behavioural Advertising, allowing companies to direct their display adverts at individuals who, through the websites they
have visited, have indicated an interest in certain goods or services.
The warning system, to be introduced by the European Advertising Standards Alliance and the Internet Advertising Bureau of Europe, will allow users to opt out of all Online
like Yahoo!, have already begun using the triangle icon on a voluntary basis in Britain but from June all ad networks will be required to display the symbol or face sanctions.
|5th February |
British MPs note their concern about Google's plundering of private data
See article from
A small group of British MPs have signed up to an Early Day Motion voicing concern that Google are set to plunder user data for advert serving purposes.
The primary sponsor is Robert Halfon and the motion reads:
is concerned at reports in the Wall Street Journal that Google may now be combining nearly all the information it has on its users, which could make it harder for them to remain anonymous;
Google's new policy is planned to take effect on 1 March 2012, but that this has not been widely advertised or highlighted to Google's users and customers, who now number more than 800 million people;
and therefore concludes
that Google should make efforts to consult on these changes and that the firm should be extremely careful in the months ahead not to risk the same kind of mass privacy violations that took place under its StreetView programme, which the Australian
Minister for Communications called the largest privacy breach in history across western democracies.
The motion has been signed by
- Campbell, Gregory: Democratic Unionist Party Londonderry East
- Campbell, Ronnie: Labour Party Blyth Valley
- Caton, Martin: Labour Party Gower
- Clark, Katy: Labour Party North Ayrshire and Arran
- Connarty, Michael:
Labour Party Linlithgow and East Falkirk
- Corbyn, Jeremy; Labour Party Islington North
- Halfon, Robert; Conservative Party Harlow
- Hopkins, Kelvin; Labour Party Luton North
- McCrea, Dr William; Democratic Unionist Party
- Meale, Alan; Labour Party Mansfield
- Morris, David; Conservative Party Morecambe and Lunesdale
- Osborne, Sandra; Labour Party Ayr Carrick and Cumnock
- Rogerson, Dan; Liberal Democrats North Cornwall
- Vickers, Martin; Conservative Party Cleethorpes
- Williams, Stephen; Liberal Democrats Bristol West
|9th April |
CPS drop the case against BT over unlawful snooping during Phorm trials
article from bbc.co.uk
BT will not be prosecuted for snooping on the web browsing habits of its customers.
The Crown Prosecution Service (CPS) has dropped a request to bring charges against BT and Phorm - the firm that supplied the monitoring system. The Webwise
software used cookies to track people online and then tailored adverts to the sites they visited.
Trials were carried out in 2006 and involved more than 16,000 BT customers. When the covert trials became public they led to calls for prosecution
because BT and partner Phorm did not get the consent of customers beforehand. Snooping is an offence under the Regulation of Investigatory Powers Act which outlaws unlawful interception.
At present, the available evidence is insufficient to
provide a realistic prospect of conviction, said the CPS in a statement: We would only take such a decision if we were satisfied that the broad extent of the criminality had been determined and that we could make a fully informed assessment of the
public interest. It added that there was no evidence to suggest that anyone who unwittingly took part in the trial suffered any harm or loss.
|8th April |
Google proposes to target ads according to signals snooped from email
Based on article from
Google's GMail service has announced that it will be trawling people's email to try and extract signals that it can use to more selectively target ads.
soon: Better Ads in Gmail
- Fewer irrelevant ads
- Gmail's importance ranking applied to ads
- Offers and coupons for your local area
Bad ads tend to annoy people. We're trying to cut down on these ads, and make the ones you do see much more useful.
With features like Priority Inbox, we've been working hard to help sort out
the unimportant messages that get in your way. Soon we're going to try a similar approach to ads: using some of the same signals that help predict which messages are likely to be important to you, Gmail will better predict which ads may be useful to you.
For example, if you've recently received a lot of messages about photography or cameras, a deal from a local camera store might be interesting. On the other hand if you've reported these messages as spam, you probably don't want to see that deal.
As always, ads in Gmail are fully automated-no humans read your messages- and no messages or personally identifiable information about you is shared with advertisers.
|7th March |
Lord West has concerns about ISPs listening in without permission
See article from
Of course we don't inspect packets.
We facilitate personalised internet experience
Ministers must do more to stop internet service providers (ISPs) snooping on private e-mails without consent, an ex-cyber security minister has said.
They are meant to ask permission first - but former Labour minister Lord West says it is too
easy to flout the rules.
The Labour peer, who raised the issue in the House of Lords, said he had ordered officials to start work on a crackdown when he was in government, but they had run out of time before the last election to make the
necessary changes: This is something I think is important for the nation. Giving private companies the right to go and look into people's e-mails is something I find rather unhealthy. These companies want the right to go into people's e-mails and look
for key words without anyone's permission.
Civil liberties campaigners say the use of Deep Packet Inspection software, which scans e-mails for key words and tracks web browsing habits, including sites and forums visited, is widespread in the
UK - and consumers who object to it have little or no redress.
Jim Killock, executive director of the Open Rights Group, said: It's clear the police will ignore all but the most blatant abuses, and very few if any problems will ever get to
|1st February |
Government review expected to ban internet snooping for advertising purposes
Internet companies are set to be barred from collecting information on people's use of the internet in a tightening of data privacy rules.
Ministers have started a review that will lead to restrictions on the practice of using people's internet
habits to draw up individual profiles in order to target advertising at them, sources say.
The European Commission warned last year that it would take the UK to court unless it tightened up the law. It said such profiling did not appear to be
covered by the Data Protection Act.
The review is also expected to strengthen people's rights to withdraw consent from having their personal data used. People could also be given the right to have data permanently deleted.
Brussels is also
pressing for a body to be set up in the UK to monitor internet firms to ensure they comply with the law.
|13th November |
Home Office responds to EU pressure to ensure Phorm/BT communications interception is more effectively banned in
Based on article from
See also Home
Office botches again: Phorm Interception consultation released in silence from openrightsgroup.org
Home Office: citizens not directly concerned by interception law from
The Home Office is scrambling to close loopholes in wiretapping law, revealed by the Phorm affair, ahead of a potentially costly court case against the European Commission.
It is proposing new powers that would punish even unintentional illegal
interception by communications providers.
Officials in Brussels are suing the government following public complaints about BT's secret trials of Phorm's web interception and profiling technology, and about the failure of British authorities to
take any action against either firm.
The government has now issued a consultation document proposing changes to the Regulation of Investigatory Powers Act (RIPA) that will mean customer consent for interception of their communications must be freely given, specific and informed
, in line with European law. RIPA currently allows interception where there is only reasonable grounds for believing consent is given.
The Home Office
consultation document has been published with an unusually short period for
public response closing 7 December.
|26th October |
Monitoring website and advert browsing may out gay Facebook users
I can't believe it is quite so straightforward to infer life preferences from browsing habits. Sites of interest are often the exact opposite of sites of preference. Anyone reading my
browsing history would probably infer that I was lining myself up as the next MediaWatch-UK chairman!
article from dailymail.co.uk
Facebook might be inadvertently outing its gay users to advertisers, according to a new study.
Researchers have discovered that different targeted advertising is being sent to users' accounts if they have described themselves as gay or straight.
The discovery could mean that people who wish to keep their sexuality private may be sharing it with advertisers without their knowledge.
A team from Microsoft and Germany's Max Planck Institute created six fake profiles: two straight men,
two straight women, a gay man and a lesbian. They wanted to see if Facebook targeted ads based on sexuality, and so the profiles were left otherwise completely the same.
The team then monitored what ads each virtual user was sent over a period of
a week. They found that the ads displayed on the gay man's profile differed substantially from those on the straight one. Many of these adverts were not obviously adverts for services that only gay men would require, and half of them did not mention the
word gay in the text.
The researchers write in the paper: The danger with such ads, unlike the gay bar ad where the target demographic is blatantly obvious, is that the user reading the ad text would have no idea that by clicking it he
would reveal to the advertiser both his sexual-preference and a unique identifier (cookie, IP address, or email address if he signs up on the advertiser's site).
The loophole means that any advertisers who collect data such as Facebook IDs
could match a person's sexual preference with their unique ID and their name.
Last week it emerged that vast amounts of data – including the names of individual members and their online friends – were passed to internet advertising firms,
with tens of millions of people thought to have been affected. The leaks were possible even when members had deliberately set their privacy options to the maximum secrecy levels.
Security experts warned that the details could be used – when
combined with other publicly available information – to build up a detailed picture of an individual's interests, friendship circle and lifestyle.
Around 25 different advertising and data firms were receiving the information, an investigation by
the Wall Street Journal found. It was passed to them by firms whose apps – games and other features – operate on Facebook and not by the social networking site itself.
|3rd October |
EU is suing Britain over data protection failures highlighted by the BT Phorm trials
Based on article from
The European Commission is suing the UK government over authorities' failure to take any action in response to BT's secret trials of Phorm's behavioural advertising technology.
The Commission alleges the UK is failing to meet its obligations under
the Data Protection Directive and the ePrivacy Directive.
The action follows 18 months of letters back and forth between Whitehall and Brussels. The Commssion demanded changes to UK law that have not been made, so it has now referred the case to
the European Court of Justice in Luxembourg.
Specifically, European officials firstly charge that contrary to the ePrivacy Directive there is no UK authority to regulate interception of communications by private companies.
European Commission says the Regulation of Investigatory Powers Act (RIPA), which sanctions commercial interception when a company has reasonable grounds for believing consent has been given, does not offer strong enough protection to the public.
The City of London police dropped their investigation of the Phorm trial, claiming BT had reasonable grounds to believe it had customers' consent.
European law says consent for interception must be freely given, specific and informed indication
of a person's wishes . BT did not obtain, or attempt to obtain, such consent to include customers' internet traffic in its testing.
Finally, the Commission says the provisions of RIPA that outlaw only intentional interception are also
inadequate. EU law requires Members States to prohibit and to ensure sanctions against any unlawful interception regardless of whether committed intentionally or not, it said.
If the government loses the case, it faces fines of millions of
pounds per day until it brings UK law in line with European law.
|10th September |
TalkTalk monitor their customers' website visits without informing them
on article from bbc.co.uk
ISP TalkTalk has been reprimanded by the Information Commissioner's Office (ICO) for failing to disclose enough about a trial requiring the collection of the urls of websites visited by customers.
The ICO said the ISP should have told both it and
customers about the trial.
In August the ICO received a Freedom of Information request, asking whether it had investigated the system.
It revealed that it had and in correspondence with TalkTalk, Information Commissioner Christopher Graham
said: I am concerned that the trial was undertaken without first informing those affected that it was taking place . He also revealed that TalkTalk had not told the ICO about the trials: In the light of the public reaction to BT's trial of the
proposed Webwise service I am disappointed to note that this particular trial was not mentioned to my officials during the latest of our liasion meetings .
BT's Webwise system, devised by ad firm Phorm to track user behaviour in order to serve
them more relevant advertisements, proved highly controversial.
TalkTalk defended its trial and the technology. We were simply looking at the urls accessed from our network, we weren't looking at customer behaviour so we didn't feel we were
obliged to inform customers, said Mark Schmid, TalkTalk's director of communication. It didn't cross our minds that it would be compared to Phorm, said Schmid.
Schmid explained that the system scans websites and would provide customers
with a blacklist of sites that contained malware or viruses. In its tests, some 75,000 websites were found to contain malware. TalkTalk plans to introduce the system at the end of this year.
|28th February |
CPS considering mounting a prosecution of BT for their secret phorm trials
article from theregister.co.uk
The Crown Prosecution Service has revealed that it is working with a top barrister on a potential criminal case against BT over its secret trials of Phorm's targeted advertising system.
BT had covertly intercepted and profiled the web browsing
habits of tens of thousands of its customers, the CPS told campaigners this week that it is still investigating the affair.
The Crown Prosecution Service is working hard to review the evidence in this legally and factually complex matter, a
Campaigners gave prosecutors a file of evidence, including a copy of BT's detailed internal report on a trial of Phorm's technology in 2006, obtained by The Register. The experiment monitored 18,000 broadband lines without
customers' knowledge or consent.
This week the CPS said: We are currently awaiting advice from a senior barrister which we will review before coming to a conclusion. We are giving the matter meticulous attention and will reach a proper and
considered decision as soon as it is possible for us to do so.
The main law BT is alleged to have broken is the Regulation of Investigatory Powers Act (RIPA). It restricts the interception of communications.
|8th December |
Google extends advert personalisation
Based on article from
Google is now personalizing results even when users have not logged into its web-dominating search site.
Personalization is a euphemism for a Google-controlled practice that involves tweaking your search results according to your past web
history. Mountain View was already doing this with users who had signed in to a Google account so they could use non-search services like Gmail and Google Calendar. But now it's targeting results for all users - whether they're logged in or not.
Google has always hoarded the search history of everyone visiting the site - whether they were logged in or not. But this is the first time Google has massaged results for users who haven't signed in. This is just one of the many reasons Google likes cookies.
The company's new cookie-based personalization is based on 9 months of stored data. And it's completely separate from account-based personalization.
Google does let you turn off personalization off. But it's on by default - and we all know
that most people will leave it on.
|1st November |
EU accuses Britain of failing to protect citizens from internet snooping
article from independent.co.uk
Ministers face an embarrassing showdown in court after the European Commission accused Britain of failing to protect its citizens from secret surveillance on the internet.
The legal action is being brought over the use of controversial behavioural
advertising services which were tested on BT's internet customers without their consent to gather commercial information about their web-shopping habits.
Under the programme, the UK-listed company Phorm has developed technology that allows
internet service providers (ISPs) to track what their users are doing online. ISPs can then sell that information to media companies and advertisers, who can use it to place more relevant advertisements on websites the user subsequently visits. The EU
has accused Britain of turning a blind eye to the growth in this kind of internet marketing.
Ministers were warned by the EU in April that if the Government failed to combat internet data snooping it would face charges before the European Court of
Justice. The European Commission made it clear this week that it is unhappy with the Government's response and began further legal action to force ministers to address the problem. Commissioners are disappointed that there is still no independent
national authority to supervise interception of communications.
Europe's information commissioner Viviane Reding said that the aim of the Commission was to bring about a change in UK law. People's privacy and the integrity of their personal
data in the digital world is not only an important matter: it is a fundamental right, protected by European law, she said. I therefore call on the UK authorities to change their national laws to ensure that British citizens fully benefit from the
safeguards set out in EU law concerning confidentiality of electronic communications.
The Commission said the UK had failed to comply with both the European e-Privacy Directive and the Data Protection Directive.
|3rd October |
University research finds that Phorm is out of favour in the US
Based on article from
See also the report: Americans Reject Tailored Advertising [pdf]
Americans do not want to be given tailored advertising based on monitoring of their online behaviour, according to what its authors call the first independent, academically rigorous survey of consumers' views.
Research conducted by the University
of Pennsylvania and the Berkeley Centre for Law and Technology has found that 66% of adult US citizens do not want advertising to be tailored to what advertisers think are their interests.
Publishers keen to increase advertising revenue and
advertisers have claimed that tracking that does not identify users by name is acceptable to most people, because of the benefits that accrue from being shown more relevant ads. To marketers, it is self-evident that consumers want customized
commercial messages, the academics' report says. The survey's data appear to refute that argument.
Contrary to what many marketers claim, most adult Americans (66%) do not want marketers to tailor advertisements to their interests, said
the study. We conducted this survey to determine which view Americans hold. In high%ages, they stand on the side of privacy advocates. That is the case even among young adults whom advertisers often portray as caring little about information privacy,
it said. Our survey did find that younger American adults are less likely to say no to tailored advertising than are older ones.
This survey's findings support the proposition that consumers should have a substantive right to reject
behavioural targeting and its underlying practices, said the report.
|8th July |
BT and Virgin Media signal an end to interest in phorm
Shares in Phorm, the controversial online advertising group that tracks consumer behaviour, plunged more than 40% after BT said it has no immediate plans to use the company's technology.
We continue to believe the interest-based advertising
category offers major benefits for consumers and publishers alike, said BT: However, given our public commitment to developing next-generation broadband and television services in the UK, we have decided to weigh up the balance of resources
devoted to other opportunities.
Phorm's software has been dogged by controversy following news that BT ran two trials using it without seeking its customers' permission in 2006 and 2007. Tim Berners-Lee, the British founder of the internet,
has also spoken out against Phorm.
Phorm said that it is now focused on its overseas business and has made strong progress in South Korea: We are engaged in more than 15 markets worldwide, including advanced negotiations with several major
internet service providers (ISPs) .
The likes of Virgin Media and Carphone Warehouse are believed to be considering working with the group. However, Virgin Media released a statement suggesting that no deal was imminent. The company believes
that interest-based advertising has some important benefits for consumers as well as website owners and ISPs but said it was a fast-changing market and had extended its review of potential opportunities.
|15th May |
Phorm create website claiming that they have been smeared by privacy campaigners
Thanks to Spiderschwein
Phorm introduce their Stop Phoul Play website:
Over the last year Phorm has been the subject of a smear campaign orchestrated by a small but dedicated band of online "privacy pirates" who appear very determined
to harm our company. Their energetic blogging and letter-writing campaigns, targeted at journalists, MPs, EU officials and regulators, distort the truth and misrepresent Phorm's technology. We have decided to expose the smears and set out the true story,
so that you can judge the facts for yourself.
|17th April |
EU challenges UK over Phorm whilst Amazon rejects the system
article from telegraph.co.uk
See also Internet privacy: Britain in the dock from
Online retailer Amazon has confirmed that it is opting out of the controversial internet advertising service, Phorm.
The company has said that it will not allow Phorm to scan its web pages in order to serve customers with targeted adverts based
on their browsing habits.
The Phorm technology, known as Webwise, has been at the centre of controversy in recent months. Last year, BT allowed a trial of Webwise to go ahead without the explicit consent of users. It has now started a new trial
of the technology on an opt-in basis only.
Although Phorm has been cleared by the Information Commissioner’s Office of any concerns regarding data or privacy, the European Commission has announced that it is starting legal action against the UK
government for the way its data protection laws operate in relation to Phorm.
The EU telecoms commissioner, Viviane Reding, said : I call on the UK authorities to change their national laws and ensure that national authorities are duly
empowered and have proper sanctions at their disposal to enforce EU legislation.
The Commission has branded the technology as an interception of user data, and believes there is a legal need for more explicit seeking of consent from
users before such services can be rolled out.
And privacy lobby the Open Rights Group has also called on a number of websites, including Microsoft, Google and AOL to opt out of Phorm’s scheme. The group said it expected more companies to follow
Amazon’s lead and opt out of the Phorm service.
|17th March |
Liberal Democrat home affairs spokeswoman asks for Phorm to be delayed
article from computerweekly.com
BT must be stopped from deploying technology that uses people's personal internet communications to make money from advertisers, the government was told this week.
Baroness Miller of Chilthorne Domer, Liberal Democrat home affairs spokeswoman,
asked in the Lords for the government to delay the rollout of interception-based online advertising until its legality had been established under the Regulation of Investigatory Powers Act 2000.
She told Computer Weekly that Ofcom, the
Information Commissioner, the Home Office and the Department for Business Enterprise and Regulatory Reform (BERR) were all passing the buck. Phorm could normalise a level of snooping not even attempted by the Home Office's stalled Interception
|1st March |
Which? withdraw press release citing opposition to phorm after legal action
Based on article from
News articles based on a survey indicating public opposition to Phorm's web snooping and advertising system have been withdrawn after the firm made legal threats to their publishers.
The independent consumer watchdog Which? sent a press
release to newspapers earlier this week entitled Internet users say: Don't sell my surfing habits. It detailed survey findings that UK internet users are opposed to plans by BT, TalkTalk and Virgin Media to monitor and profile their browsing in
collaboration with Phorm.
The findings contradicted market research repeatedly cited, but not published, by Phorm that the majority of people want the more relevant web experience it claims its Webwise -branded technology will
The Which? survey was covered by the Press Association, Channel 4 News, The Telegraph, and The Daily Mail. The press release, however, was swiftly followed by a retraction of the press release.
The Press Association, Channel 4
News and Telegraph stories have all been removed whilst the Daily Mail has edited its story to online to remove all references to the negative survey findings.
A Phorm spokesman said that the survey had been based on inaccurate information and
that the press release itself contained inaccuracies. It repeatedly stated the Webwise system collects and sells on data which is misleading. We also wouldn't allow the creation of advertising channels on sensitive subjects such as for medical
|19th December |
BT look set to start using Phorm in 2009
Based on article from
Phorm expects to launch its targeted ad service in the first half of next year after a successful trial with BT.
Phorm is behind technology that analyses web users' behaviour in a bid to serve up more relevant advertising. The company has been
criticised because of fears that its technology will allow internet companies to spy on users.
However, it has taken great pains to explain that privacy is one of its major concerns and that because of the way its targeting works, no identifying
information is retained on web users.
Phorm said that the BT trial, which began on 30 September, achieved its primary objective of testing all the elements necessary for a larger deployment, including the serving of small volumes of targeted
advertising. BT has said it expects to move towards deployment of the Phorm platform.
Phorm chief executive Kent Ertugrul said: We have met with most of the main players in the advertising sector and they welcome the potential commercial value of
the service. We have not set a date for a full launch, as this depends on several factors such as the ISPs, but we are looking at a launch in the near term. This is a first half of 2009 initiative.
|22nd November |
BT delete discussions of Phorm from their support forum
Based on article from
BT has banned all future discussion of Phorm and its WebWise targeted advertising product on its customer forums, and deleted all past threads about the controversy dating back to February.
Subscribers to BT's broadband packages had used
the BT Beta forums to criticise its relationship with Phorm and raise concerns about the technical implications of ISPs wiretapping their customers.
However, BT decided it had had enough and deleted the threads. A first thread on WebWise extended
to almost 200 pages, before being closed in late September when BT's third trial of the system began. It was still available to read however and a new thread was started by BT Beta moderators, which continued until yesterday. All record of either has now
|19th November |
US ad targetting eavesdropper NebuAd sued
article from blog.wired.com
Net eavesdropping firm NebuAd and its partner ISPs violated hacking and wiretapping laws when they tested advertising technology that spied on ISP customers web searches and surfing, according to a lawsuit filed in federal court.
seeks damages on behalf of thousands of subscribers to the six ISPs that are known to have worked with NebuAd. If successful, the suit could be the final blow to the company, which abandoned its eavesdropping plans this summer after powerful lawmakers
began asking if the companies and ISPs violated federal privacy law by monitoring customers to deliver targeted ads.
NebuAd paid ISPs to let it install internet monitoring machines inside their network. Those boxes eavesdropped on users' online
habits -- and altered the traffic going to users in order to track them. That data was then used to profile users in order to deliver targeted ads on other websites.
The suit alleges the ISPs and NebuAd both violated anti-wiretapping statutes by
capturing users' online communications without giving adequate notice or getting consent.
Neither WideOpenWest nor Embarq, the two largest ISPs being sued, responded to requests for comment. Knology told Congress in August it had used NebuAd in
Georgia, Florida, Tennessee and Alabama, but stopped in July after Congress started asking questions. The other named ISP defendants are Bresnan Communications, Cable One, CenturyTel, all of which admitted testing NebuAd's technology.
seeks damages as well as an injunction against any similar behavior in the future.
|1st November |
Orange say no to Phorm
article from theregister.co.uk
Orange, the UK's sixth largest broadband provider, is not going to use Phorm's data-snooping technology.
Paul-Francois Fournier told the FT: Privacy is in our DNA, so we need to be honest and clear about what we are doing. We have decided not
to be in Phorm because of that... The way it was proposed, the privacy issue was too strong. He said Phorm's model lacked clarity for customers.
However, the ISP has not given up on making more revenue from users' data. Fournier said the
company would talk to customers about what data they would be happy to hand over, and what they would want in return.
|2nd October |
BT start new trials of phorm for those that opt in
article from news.bbc.co.uk
BT is about to start further trials of a controversial internet advertising technology. Developed by Phorm, the Webwise system watches what people do online and shows adverts tuned to their interests.
From 30 September, a sample of BT's customers
will be invited to "opt in" to a trial of the technology. Those that are invited to take part will see a special webpage appear when they start browsing the web. In a statement BT said customers would be able to opt in, opt out or ask for more
information via the pop-up page.
A spokesman for BT said the trial would run for "at least" four weeks and that it hoped 10,000 customers would take part. He said the technical trial would help BT assess whether the Phorm Webwise
technology works well in the field.
Earlier trials of the technology suggested that BT would have to commit a lot of resources, potentially 300 servers, to use the system for all customers.
If it goes according to plan it's our
expectation that we will roll it out across the entire broadband customer base, said the spokesman. No decision had yet been taken on whether Webwise would be "opt in" when the finished system is rolled out, he added.
browsing traffic of those that "opt out" will pass through the Webwise system will not be profiled or copied by it, he added. BT was also working on a separate system that let people opt out at a network level so their traffic avoided Webwise
more completely, he said.
|18th September |
The government requires that customers select whether to use Phorm or not
Based on article from
The government has outlined how a controversial online ad system can be rolled out in the UK.
In response to EU questions about its legality, it said that it was happy Phorm conformed to EU data laws.
But any future deployments of the
system must be done with consent and make it easy for people to opt out.
In its statement sent to the EU the government said: Users will be presented with an unavoidable statement about the product and asked to exercise choice about whether to
be involved. Users will be able to easily access information on how to change their mind at any point and are free to opt in or out of the scheme.
|14th August |
Parliamentary questions about Home Office role in the Phorm trials
article from news.bbc.co.uk
In the House of Lords Lib Dem peer Baroness Miller has asked a series of questions about the nature of talks between the government and Phorm.
Critics have asked why the Home Office has not intervened over secret Phorm trials BT conducted in 2006
In her questions Baroness Miller has asked about the issues surrounding Phorm and the technology it employs.
In one question she asked if the government has issued advice to net service firms about getting consent for
web-watching ad systems or what needs to be done to let people know their web habits could be monitored.
In response the government said it was up to net firms to decide if a service they provide was within the law. The Home Office told the BBC
that it was unaware of BT's early trials, in which thousands of BT customers had their web habits monitored without consent.
But it did confirm that Phorm had approached the Home Office in June 2007: We welcome companies sharing commercially
sensitive ideas and proposals with us in confidence if that means public safety considerations and legal obligation can be taken into account, where appropriate, in the conception of new products and services .
Technology consultant Peter
John, who has been following Phorm closely, asked why the Home Office did not intervene once it became clear that customers were unhappy that their web surfing habits had been monitored without consent. He believes the Home Office should have sought
legal advice about a document it prepared for BT on the legality of the service in relation to RIPA (Regulation of Investigatory Powers Act).
It found that the service may comply with RIPA but only if consent was asked.
According to John,
the City of London Police is currently conducting its own investigation into Phorm, following complaints against BT.
|12th August |
Yahoo! to enable opt out of its personal advert targeting scheme
Based on Yahoo! press release from valleywag.com
Yahoo! has announced that it will offer users greater choice in how they manage their privacy online by enabling them to opt-out of customized advertising on Yahoo.com. This new option expands Yahoo!'s existing opt-out program for customized advertising
served by Yahoo! on third party networks.
Yahoo! announced the new opt-out capability as part of its response to a Congressional inquiry about customization sent to 33 companies from the House Energy and Commerce Committee.
opt-out capability is expected to be available for consumers by the end of August. Users will be able to access the opt-out in the Yahoo! privacy center, which is linked on the home page and nearly every page on the Yahoo! network.
|9th August |
EU Commissioner enquires about the legality of Phorm
article from news.bbc.co.uk
The UK government has until the end of August to respond to a letter from the European Union about a controversial system which monitors web traffic.
EU commissioner Viviane Reding has asked the UK government to clarify whether the Phorm system
is in breach of European data laws.
The Information Commission ruled in May that no action would be taken against BT's secret trial due to the difficult nature of explaining to consumers what it was doing. It said anyone using Phorm must ask for
the consent of users before going ahead with any further trials.
The letter from Mrs Reding, the details of which are not publicly known, was sent in mid-July and the UK government has until the end of August to respond.
for Information Policy Research (Fipr) has been one of the more outspoken critics of Phorm. Fipr's general counsel Nicholas Bohm believes ISPs implementing the system could find website owners objecting: There is going to be increased focus on the
rights of website owners and their right to prevent material being used to the advantage of their competitors.
An e-petition on the Downing Street website
calling for Phorm to be dropped has so far attracted over 16,000 signatures.
|18th July |
EU requires that Phorm be Opt-In
full article from The Register
The European Commission has sent a message to the British government, and it reads something like this: If you don't deal with Phorm, we will.
Earlier this month, according to Dow Jones, the European Union commissioner for information
society and media sent a "pre-warning letter" to UK authorities, voicing her concern over Phorm, the behavioral ad targeter poised to track user activity on Britain's three largest ISPs: BT, Carphone Warehouse, and Virgin Media.
already conducted two trials with Phorm - and web surfers were not notified.
It is very clear in E.U. directives that unless someone specifically gives authorization (to track consumer activity on the Web) then you don't have the right to do
that, EU commissioner Viviane Reding said. If UK government does not deal with the issue, Dow Jones says, the EC could take action in the European Court of Justice.
Bad Phorm from BT Execs
full article from dephormation
A Stop Phorm activist attended the BT AGM and asked a serious of amusing and awkward questions.
His blog entry makes for good reading:
On to resolution 9, appointment of Ms Hewitt.
Resolution 9 –
elect Patricia Hewitt MP as a director
When was Ms Hewitt first informed by BT that it had conducted covert 'stealth' trials (BT's own words) of Phorm/121Media advertising systems? Does BT believe Ms Hewitt, or any other MP, would welcome
interception of their unencrypted communications for advertising?
Michael Rake tried to shield her with more waffle. Ms Hewitt is obviously well used to handling difficult questions... She rescued him from deep embarrasment. She didn't specify a
date, but mentioned a board meeting. Amazingly, she left herself hostage to fortune by saying she would opt in to Phorm because she trusted their assurances.
|16th April |
New York State proposes legislation to protect consumers from snooping
Based on article from AVN
See also Third Party Internet Advertising Consumers' Bill of Rights
Web companies are increasing their lobbying efforts against New York Assemblyman Richard Brodsky's proposed bill aimed at regulating snooping on web browsing with view to targeting advertising.
A consortium of members representing 12 companies,
including AOL, Yahoo!, Google, Facebook, Comcast and eBay, complained about the bill in a letter to Brodsky.
The letter sent on behalf of the misleadingly named State Privacy and Security Coalition, said the proposed bill would have profound
implications for the future of Internet advertising and the availability of free content on the Internet. The coalition wrote that the bill would subject advertising networks to an extremely detailed, unprecedented array of notice, consent and
The group said the bill is unnecessary because several large advertising networks voluntarily allow users to opt out of behavioral targeting.
Brodsky, who said the measure is needed to protect privacy, said the
State Privacy and Security Coalition is going to lose this fight. They're taking the position that a corporation can exploit, control and manipulate the activities of private citizens.
The proposed bill, the Third Party Internet
activity tell users about the practice and give them an opportunity to opt out.
The bill is largely patterned after the seven-year-old voluntary standards created by the Network Advertising Initiative who have proposed new behavioral-targeting
guidelines. Among other changes, the new standards call for companies to obtain users' consent before using their Web-surfing history to target them based on "sensitive" matters, such as certain medical conditions, psychiatric conditions or
sexual behavior. The new proposal also prohibits companies from using behavioral-targeting strategies to market to children younger than 13.
|14th April |
Information Commissioner requires Phorm to be Opt-In
See full article from the
Ad-targeting system Phorm must be "opt in" when it is rolled out, says the Information Commissioner Office (ICO)
European data protection laws demand that users must choose to enrol in the controversial system, said the ICO in an
The ICO only commented on whether Phorm complied with UK and European data protection laws. It said a decision about whether Phorm broke laws on interception was a matter for the Home Office.
From its discussions with
Phorm, the ICO said it appeared the company did not break laws regarding "personal data" ie information which can be used to identify a living individual.
The ICO said European laws demand that users must consent to their traffic data
being used for "value added services". The ICO wrote: This strongly supports the view that Phorm products will have to operate on an opt in basis to use traffic data as part of the process of returning relevant targeted marketing to internet
Before now Phorm has been expecting to operate on an "opt out" basis where every customer of ISPs that have signed up is enrolled unless they explicitly refuse to use it.
Responding to the ICO statement, Kent
Ertugrul, chief executive of Phorm, said We now have a statement from the Home Office and the Information Commissioner saying not only is there no privacy issue but there is no interception issue either. He said that the warnings Phorm will give
to those enrolled in it would "exceed substantially" the "valid and informed consent" demanded by European regulations.
Responding to the ICO statement, Nicholas Bohm, general counsel for the Foundation for Information Policy
Research, said: The ICO has set a floor below Phorm-like activities by saying it has at least to be opt in and that's better than before. Bohm said Phorm had consistently "ducked" questions about whether its system was "opt
in". Being opt in faces them with a much more difficult business model, he added.
|13th April |
Phorm attempted to delete facts about BT trials
See full article from
Phorm has admitted that it deleted key factual parts of the Wikipedia article about the huge controversy fired by its advertising profiling deals with BT, Virgin Media and Carphone Warehouse.
A number of Phorm-friendly edits were made to the
page. The revisions were quickly reverted by a Wikipedian who argued that they made Phorm out to be "awesome and perfect".
In a telephone conversation, a spokesman for Phorm refused to comment on why it had tried to censor a quotation
from The Guardian's commercial executives describing the ethical stance they took against its tracking system. He also refused to talk about the deletion of a passage explaining how BT admitted it misled customers over the 2007 secret trial.
Phorm also deleted a link to the The Register's report on the 2006 trial, and accompanying reference to BT's own document. It said that the aim of the trial was to validate that users were unaware of the presence of the tracking system.
The spokesman said Phorm's PR team had not been aware of Wikipedia's policy on conflicts of interest. Among many other rules they violated, it states: Producing promotional articles for Wikipedia on behalf of clients is strictly prohibited.
|10th April |
US ISPs quietly test tracking of web use to target advertising
See full article from the
Washington Post by Peter Whoriskey
The online behavior of a growing number of computer users in the United States is monitored by their Internet service providers, who have access to every click and keystroke that comes down the line.
The companies harvest the stream of data for
clues to a person's interests, making money from advertisers who use the information to target their online pitches.
The extent of the practice is difficult to gauge because some service providers involved have declined to discuss their
practices. Many Web surfers, moreover, probably have little idea they are being monitored.
But at least 100,000 U.S. customers are tracked this way, and service providers have been testing it with as many as 10%of U.S. customers, according to
tech companies involved in the data collection.
...Read full article
|8th April |
BT own up to snooping on their customers without permission
full article from the Daily Mail
BT tested secret "spyware" on tens of thousands of its broadband customers without their knowledge, it admitted recently.
It carried out covert trials of a system which monitors every internet page a user visits.
investigation into the affair has been started by the Information Commissioner, the personal data watchdog.
Privacy campaigners reacted with horror, accusing BT of illegal interception on a huge scale. The company was forced to admit that it had
monitored the web browsing habits of 36,000 customers.
The scandal came to light only after some customers stumbled across tell-tale signs of spying. At first, they were wrongly told a software virus was to blame.
Executives insisted they
had not broken the law and said no 'personally identifiable information' had been shared or divulged.
BT said it randomly chose 36,000 broadband users for a "small-scale technical trial" in 2006 and 2007.
The monitoring system,
developed by U.S. software company Phorm scans every website a customer visits, silently checking for keywords and building up a unique picture of their interests.
Nicholas Bohm, of the Foundation for Information Policy Research, said BT's
actions amounted to illegal data interception. He told the BBC: It seems a clear-cut case of illegal interception of communication.
A further trial is planned in the next few weeks, BT said, but customers will be asked in advance.
|5th April |
Phorm without permission is said to be illegal
full article from the BBC
Technical analysis of the Phorm online advertising system has reinforced an expert's view that it is "illegal".
The analysis was done by Dr Richard Clayton, a computer security researcher at the University of Cambridge.
Clayton learned while quizzing Phorm about its system only convinced him that it breaks laws designed to limit unwarranted interception of data.
The Information Commissioner's Office (ICO) has also said it would monitor Phorm as it got closer to
In addition the ICO confirmed that BT is planning a large-scale trial of the technology involving around 10,000 broadband users later this month.
Previous trials of the technology by the telecoms firm were branded
"illegal" by Nicholas Bohm of the Foundation for Information Policy Research (Fipr), which campaigns on digital rights issues.
As the company did not inform customers that they were part of the trial, he said the tests were "an
illegal intercept of users' data".
In the subsequent trial the ICO said: We have spoken to BT about this trial and they have made clear that unless customers positively opt in to the trial their web browsing will not be monitored in order
to deliver adverts.
|25th March |
Dangerous Pictures made more dangerous by snooping phorm
Thanks to Alan
full article from Comment is Free by Zoe
Phorm is a way to enable advertisers to meet web users' needs: no one gets hurt, right? Wrong. There's another reason this invasion of privacy is of such a concern and it is the potential effect of some worrying legislation that is currently being
debated very quietly in the UK.
The proposed criminal justice and immigration bill contains a disturbing element within it: if passed and made into law, it will then be "an offence for a person to be in possession of an extreme pornographic
image". It will be illegal to have in your possession certain pictures deemed "offensive" or "obscene" by the government. No, this is not 1984, surprisingly. According to this proposed bill, if you have in your possession
hardcore BDSM sexual imagery you can be criminalised and potentially imprisoned for it.
So, let's say you're a man who gets off on being tied up and spanked. One day your girlfriend strips you naked, binds you and your genitalia tightly with some
rope, hits you with a paddle, and perhaps you both have an orgasm or two. She also photographs you in situ. Let's then say that the next day you decide to upload those photos to a blog, so you can both look at them. Your girlfriend likes the pictures so
much she decides she's going to download a couple to her computer so that she has permanent offline access to them and can enjoy them at her own leisure.
Guess what? If this law gets passed, you both would have just broken it, and risked a large
fine, if not imprisonment, even though you were willing, mutually consensual participants, and your photos were for your own personal use. Both owning and downloading the pictures would be a criminal offence, and bar searching every home in the country,
it'll surely be users' web history that allows others, whether it be ISPs, advertisers, or the government, to have access to what people are privately looking at and downloading from the web. While Phorm might look innocuous now, its use in the future
may be more about gathering personal web viewing data, for legal purposes, rather than for targeted advertising and we should be challenging it now, for this reason.
Liberty has joined forces with the organisation Backlash in opposing the bill,
not least because it breaches at least two aspects of the European convention on human rights. Given this, and the fact our private information is soon to be readily available to third parties courtesy of our ISPs, we should all be concerned about
protecting the future privacy of our online use. Right now people have the chance to opt out - and by that I mean they have the choice to leave an ISP if it signs up to Phorm and join another one that will not be collecting data about its customers. But
if we rest on our laurels and do not fight for online confidentiality, we may soon find that our right to privacy is eroded without our consent: once that is gone, it is unlikely we will ever win it back.
The boss of Phorm defended the embattled online advertising technology developer yesterday, offering to open the company up to outside scrutiny by a panel of independent web experts
after the firm was blasted by privacy campaigners.
The challenge followed a 5% drop in Phorm shares as the Guardian declared it would not be signing up to the firm's advertising platform because of worries over the information the company had on
The Guardian's advertising manager, Simon Kilby, said: Our decision was in no small part down to the conversations we had internally about how this product sits with the values of our company.
|21st March |
BT confesses to lies over secret Phorm experiments
See full article from
See also www.badphorm.co.uk
BT has admitted that it secretly used customer data to test Phorm's advertising targeting technology last summer, and that it covered it up when customers and The Register raised questions over the suspicious redirects.
The national telecoms
provider now faces legal action from customers who are angry their web traffic was compromised.
Stephen Mainwaring, a BT Business customer said he suffered sleepless nights after detecting the dodgy DNS requests, and said today: It is very
likely that I and others will take legal action against BT for what they did last summer.
In a statement, BT said: We conducted a very small scale technical test of a prototype advertising platform on one exchange in June 2007. The test
was specifically conducted to evaluate the functional and technical performance of the platform. Absolutely no personally identifiable information was processed, stored or disclosed during this trial.
Speaking to El Reg on Friday, Stephen
said: If they wanted to run a trial, they should have asked. I would have told them I did not want to be part of it.
Stephen has already filed a complaint with the Information Commissioner's Office and is consulting on how to proceed
through the courts with other BT subscribers who believe their connection was subject to illegal Phorm tests.
When The Register first asked BT about its relationship with Phorm in July 2007, when it was widely known as 121Media, a firm deeply
involved in spyware. BT denied any testing and said customers whose DNS requests were being redirected must have a malware problem.
It wasn't until 14 February this year, when the deals between BT, Virgin Media and Carphone Warehouse to pimp
customer web browsing were announced, that a cover-up was revealed.
BT's belated confession that it secretly used its customers' traffic to test the safety of ad targeting technology can only add to the distrust around Phorm.
As part of
its admission that it lied over the 2007 trials, BT also said it will follow Carphone Warehouse's lead and develop an opt-out that does not involve cookies and means no data will be mirrored to a profiling server, even if it is ignored.
|19th March |
Home Office seem worryingly supportive of phorm
full article from Linx Public Affairs
Laws against unauthorised wiretaps should not be used to prevent ISPs providing targetted advertising services, provided ISPs users consent and the service has the highest respect for the users’ privacy, according to a Home Office memo released to
the ukcrypto mailing list.
The memo analyses the legality of Phorm and similar services in detail, and concludes with a policy statement that:
The purpose of Chapter 1 of Part 1 of RIPA is not to inhibit
legitimate business practice particularly in the telecommunications sector. Where advertising services meet those high standards, it would not be in the public interest to criminalise such services or for their provision to be interpreted as criminal
conduct. The section 1 offence is not something that should inhibit the development and provision of legitimate business activity to provide targeted online advertising to the users of ISP services.
The memo’s legal analysis
also provides comfort for Phorm in three key areas. It suggests that there are arguments that Phorm’s service might not constitute an interception under RIPA:
Where the provision of a targeted online advertising
service involves the content of a communication passing through a filter for analysis and held for a nominal period before being irretrievably deleted - there is an argument that the content of a communication has not been made available to a person.
It suggests that even if Phorm’s services does constitute an interception, it might still be lawful provided the ISP user consents to it, as the required consent from a web site operator might be inferred from the fact that
they’re publishing content on the public Internet
A question may also arise as to whether a targeted online advertising provider has reasonable grounds for believing the host or publisher of a web page consents to
the interception for the purposes of section 3(1)(b). It may be argued that section 3(1)(b) is satisfied in such a case because the host or publisher who makes a web page available for download from a server impliedly consents to those pages being
It also suggests that ISPs might be able to redefine their service from being “Internet access” to “Internet access with value-added targeted advertising", and by so doing take advantage of wiretap exemptions
originally intended to protect routers and web proxies.
Regardless of the legal debate, it is highly significant that the government has decided that as a matter of public policy RIPA should not stand in the way of Phorm and similar services,
provided user consent is obtained through the ISP’s Terms and Conditions of Service. This implies that even if the legal arguments remain contested, ISP prosecution is unlikely and the government might contemplate legislative reform to clarify the legal
situation in favour of Phorm and their ISP partners.
FIPR Consider Phorm to be Illegal
See full article from
See also Open Letter to the Information Commissioner
The Foundation for Information Policy Research (FIPR), a leading government advisory group on internet issues, has written to the Information Commissioner arguing that Phorm's ad targeting system is illegal.
In an open letter posted to the think
tank's website today, the group echoes concerns voiced by London School of Economics professor Peter Sommer that Phorm's planned partnerships with BT, Virgin Media and Carphone Warehouse are illegal under the Regulation of Investigatory Powers Act 2000
The letter, signed by FIPR's top lawyer Nicholas Bohm, states:
The explicit consent of a properly-informed user is necessary but not sufficient to make interception lawful.
The consent of
those who host the web pages visited by a user is also required, since they communicate their pages to the user, as is the consent of those who send email to the user, since those who host web-based email services have no authority to consent to
interception on their users' behalf.
Phorm claims that all sensitve data will not be profiled, but FIPR argues its "restricted sites" blacklist system will be ineffective because of the vast array of webmail and
social networking sites web users now visit.
Bohm uses the letter to urge the Information Commissioner, Richard Thomas, to ignore the conclusions of the Home Office, which advised BT and the other ISPs that Phorm's technology is legal.
Earlier today web inventor Sir Tim Berners-Lee said he would personally not want his traffic to be profiled by Phorm, and called on BT, Virgin Media and Carphone Warehouse to make the "service" opt-in only.
He also raised concerns that what a person looked at online could be used for other purposes. He said: I want to know if I look up a whole lot of books about some form of cancer that that's not going to get to my insurance company and I'm going
to find my insurance premium is going to go up by 5 per cent because they've figured I'm looking at those books.
|12th March |
Petition to stop ISPs breaching customers privacy for advertising
We the undersigned petition the Prime Minister to Stop ISP's from breaching customers privacy via advertising technologies.
We petition the Prime Minister to investigate the Phorm technology and if found to breach UK or
European privacy laws then ban all ISP's from adopting it's use. Additionally the privacy laws should be reviewed to cover any future technologies such as Phorm
The UK's three largest ISP's, Virgin Media, BT and TalkTalk are all in talks with a
view to introducing the Phorm technology. This would result in the browsing habits of the majority of the UK population being sold to a third party for advertising purposes. The opt out system for this technology is vague and unproven, even when opting
out your every move on the Internet might be recorded. Surely this must be a breach of privacy laws, if not then the privacy laws need to be changed to cover such invasive technology.
4th March 2009. Closed with 21,403 signatures
Thank you for the e-petition on internet advertising technologies and customer privacy.
your petition states, some Internet Service Providers (ISPs) have been looking at the use of Phorm’s Webwise and Open Internet Exchange (OIX) products. However, the only use of the technology so far has been the trials conducted by BT.
Advertisers and ISPs need to ensure that they comply with all relevant data protection and privacy laws. It is also important that consumers’ privacy is protected and that they are given sufficient information and opportunity to make a clear and informed decision whether to participate in services such as Phorm.
The Government is committed to ensuring that people’s privacy is fully protected. Legislation is in place for this purpose and is enforced by the Information Commissioner’s Office (ICO). ICO looked at this technology, to ensure that any use of
Phorm or similar technology is compatible with the relevant privacy legislation. ICO has published its view on Phorm [pdf] on its website
ICO is an independent body, and it would not be appropriate for the Government to second guess its decisions. However, ICO has been clear that it will be monitoring closely all progress on this issue, and in particular any future use of Phorm’s
technology. They will ensure that any such future use is done in a lawful, appropriate and transparent manner, and that consumers’ rights are fully protected.
|10th March |
ISPs to monitor web browsing to serve targeted adverts
See article from guardian.co.uk
|23rd February |
British ISPs monitor browsing to target adverts
Ignoring the nasty side of the policy it will be interesting to see what they can work out from browsing history. I think they will target me with adverts for religion and nutter
See full article from Techdirt
For years now, ISPs have been searching for alternative revenue streams to avoid just being "dumb pipes."
A few years ago, they picked up on the fact that they have a tremendous amount of data about what you do
online. A bunch of ISPs then started selling your clickstream data to companies that could do something useful with it (though, those ISPs probably neglected to tell you they were doing this).
Late last year, we heard about a
company that was trying to work with ISPs to make use of that data themselves to insert their own ads based on your surfing history -- and now we've got the first report of some big ISPs moving into this realm.
Over in the UK
three big ISPs, BT, Carphone Warehouse and Virgin Media have announced plans to use your clickstream data to insert relevant ads as you surf through a new startup called Phorm.
While Phorm claims that it keeps your data private by tracking
individual users with an assigned number only, that's hardly assuring. After all, remember that both AOL and Netflix have released similar anonymized data where identifying info was replaced with an assigned number... and it didn't take long for both
sets of data to be de-anonymized.
While it's no surprise that ISPs would want to get into the advertising business it's going to freak some people out (and potentially cause some serious privacy problems).
All the more reason to figure out how encrypt your traffic and hide your activities from your ISP.