Intellectual Property Law

New Phorms, new privacy concerns

There's a storm brewing online over the activities of Phorm, a company that specialises in delivering adverts online. Lots of companies already do that of course; what has caused all the fuss is that Phorm works by tracking the internet surfing habits of the customers of certain Internet Service Providers (ISPs) and delivering adverts based on those activities.

Phorm has signed deals with BT, TalkTalk and Virgin Media allowing it to place equipment at those ISPs, recording the surfing activities of users. When a user goes on to a web page with a Phorm-connected advert, the user will be presented with an advert tailored for their surfing habits.

Charles Arthur at the Technology Guardian has written a great article on the Phorm scheme. In the article, he quotes Phorm on the various privacy bodies that it claims have given the seal of approval to its scheme, and the user perspective. A key point made by Phorm is that it doesn't store user's IP addresses or browsing histories; surfing activities are put into various categories and this is then placed into a cookie on your computer. Countering this is the arguments made by outraged users and privacy campaigners. The Technology Guardian piece quotes a comment it received from someone going under the name Clanger9:

"The fact that they use this data to provide 'targeted advertising' and claim to discard it afterwards is irrelevant. All your browser content, webmail, forum postings, everything is being analysed by servers owned and controlled by a third party."

The article also refers to the AOL search results scandal last year, where searches were disclosed online by AOL, allowing the inquisitive to identify the makers of those searches despite those searches being theoretically anonymous (see our post on the resulting legal action).

Furthermore, at least some of Phorm's activities will inevitably include the processing of personal data, meaning that data protection laws apply. As Peter Wainman over at Naked Law highlighted in January, the Article 29 Working Group of data protection commissioners has stated that IP addresses can constitute personal data. Even if Phorm can reassure users over their privacy concerns, it will therefore have to tread carefully as far as data protection is concerned.

Full post as published by IMPACT on March 05, 2008 (boomark / email).