alarm:clock

News & Updates - Tuesday, September 25, 2007

NebuAd Pushes The Limits of Acceptable Behavioral Ad Targeting

UPDATE: NebuAd's CEO Bob Dykes called this afternoon to question our characterization of his company. (We have printed below information on NebuAd's privacy policies.) Dykes describes how much effort the company has taken to ensure privacy and says that descriptions of NebuAd not having opt-out policies are based on ignorance. In our original post we asserted that NebuAD and its ISP partners need to both provide clear notice to subscribers that they are being monitored and a clear opt-out plan, or else people will freak out. Dykes insists that both boxes have been checked. When we responded that our ISP has not given us an opt-out option, Dykes responded that this is because our ISP probably is not using NebuAD, at least in our area. He also questions our speculation that we wouldn't be surprised to see a class action suite here.

We do not question that NebuAD has made it best efforts to ensure privacy, as this is in its best interests. And personally, we have no issue with what NebuAD might do with our data. But we continue to assert that try as they might, NebuAD faces a stiff headwind from privacy forces. NebuAd can explain their policies until they are blue in the face but they we are willing to bet that the anti-privacy label will be an albatross around their neck for some time. If this was Google or Microsoft we would expect to see a full page of Techmeme links dissecting the controversy. Just look at the recent quotes that come out about NebuAD:

VentureBeat: "NebuAd, a controversial advertising firm.. Its 'targeted' advertising technology is likely to add fuel to the debate about privacy."

A Network World columnist called NebuAd "An invisible abomination - ISPs spying on customers’ Internet activities, inserting ads in Web pages." After talking with Bob the columnist later wrote that Nebuad is not as bad as he had characterized.

Red Herring: "Privacy advocates are not likely to be happy, given that many already have criticized Google’s proposed acquisition of DoubleClick, which could allow Google to compile both a user’s search history and web browsing history."

To summarize, we have nothing against NebuAd. It's just that we have seen the forces of privacy marshaled against startups like Gator (Claria), 180Solutions, etc. and its not pretty. Once you have taken on the label of anti-privacy, its very hard to shake. We don't doubt that NebuAd can build a large business but it had better brace itself for a fight.

RESUME ORIGINAL POST
NebuAd has raised around $20M in Series B funding from Menlo Ventures and Sierra Ventures. NebuAd represents a departure from current online ad standards. The company actually partners with ISPs to get information about subscribers (more details about where they are physically located, etc.) With this data, NebuAd believes it can out behavior the behavioral ad networks.

As a net user does it bother you that your ISP will sell your data to NebuAd? Well check the fine print on your contract because somewhere you agreed to let them. In an interview today, company CEO Bob Dkyes responds to this question: "We only look at consumer sites – not ones that are sensitive. So if you go to a sex site, we don’t track that. If you look up something for HIV positive, we don’t look at that. But if you are planning travel to the South of France or are researching a Lexus SUV, we do track that."

Are we the only ones that find this statement laughable? NebuAd is going to cover its eyes if we go to a porno site and then open them up again when we land on a respectable site?

Don't get us wrong, we think that NebuAd has the makings of a smart business, but they need to come to terms with the fact that they are doing stuff that is going to freak people out. In our view, they need to give ISP subscribers notice that their data is being sold to Nebuad and give subscribers the option to opt out, just as they have the option to not accept cookies. If not, we would not be surprised to see a class action law suit in the works.

UPDATE: From NebuAD
a) NebuAd converts, in the appliance located at the ISP, the key user
identifiers (such as IP address) to a one-way random number, and so the
central servers only receive this hash number, not the original
identifiers.

b) NebuAd has a list of categories (e.g. "Cars - SUV - Lexus") and it
notes if "the hash number" goes to a site, or performs a search, that is
related to the category. If yes, NebuAd notes that interest mapped to
the "hash number" -- not the URL's visited, just the interest.

c) Since NebuAd doesn't have categories for sex (it, along with all
reputable Ad networks don't run sex ads) there isn't even a mechanism to
hold such URL visits mapped to the "hash number".

To aggregate data, NebuAd does another random-number conversion on the
data, and store the URL visits in aggregate form, but because of the
second hash, it is never possible to deconstruct back to the original
hash, or, of course, the original user. This data is stripped of
personal and personally identifiable information and held in aggregate
only.

View - site