Three of the four largest ISPs (Internet service providers) in the US said Thursday that they will adopt policies that require them to get meaningful permission from customers before tracking online activities.
Representatives of AT&T, Time Warner Cable and Verizon told a US Senate committee that they currently do not engage in behavioral advertising that uses subscribers' Web activities to deliver contextual ads. If the ISPs decide to start behavioral advertising programs, they will give customers a detailed description of the ad program and ask for permission before tracking online activities, the companies said.
However, the ISPs also suggested that legislation is not now needed to protect customer privacy online. Despite a flurry of concern in recent months about some ISPs tracking subscriber activities, lawmakers should give ISPs and Web businesses time to develop a set of best practices for behavioral advertising and information collection, said Tom Tauke, Verizon's executive vice president for public affairs, policy and communications.
"At this juncture, we aren't prepared to endorse legislation," Tauke told the Senate Commerce, Science and Transportation Committee.
Verizon has recruited other ISPs and Web businesses to join a group focused on drafting best practices, Tauke said. That group should have some preliminary guidelines drafted by the end of the year, he said.
Representatives of all three large ISPs told lawmakers that their policies governing targeted advertising will be to require informed customer consent before tracking their activities and collecting their data. Since late last year, a handful of ISPs ran trials or signed up to use a subscriber tracking and targeted ad service from 2-year-old vendor NebuAd, and some privacy advocates protested, saying NebuAd's techniques, including deep packet inspection of Web traffic, could be illegal.
The NebuAd model required ISP customers to opt out of the online tracking. Earlier this month, NebuAd said it was delaying its ISP behavioral advertising program while Congress looks at the issue.
But even a simple click-yes-to-opt-in model isn't comprehensive enough, Tauke said at the Senate hearing. In many cases, Web users opt into something without reading the fine print, he said.
An opt-in approach needs to be conspicuous, lay out the options in detail and allow customers to opt out later if they chance their minds. he said. Subscribers "want to be in control of their online experience," Tauke added. "Most consumers, I suspect, are like me. We're trying to do something online, a screen pops up, we hit 'OK' or 'continue' and move on, not really aware of what we just opted into."
AT&T also supports a industry-developed standards, said Dorothy Attwood, the company's senior vice president for public policy and chief privacy officer. However, any government-developed rules should apply to Web sites and advertising firms, as well as ISPs, she said.