• by Wendy Davis  @wendyndavis, December 31, 2012

The Internet service provider Embarq has prevailed in a long-running lawsuit accusing it of violating wiretap laws by partnering with the controversial behavioral-targeting company NebuAd.

"Although NebuAd acquired various information about Embarq users during the course of the technology test, Embarq cannot be liable as an aider and abettor," the 10th Circuit Court of Appeals wrote in a decision issued on Friday.

Embarq was one of six companies that tested NebuAd's behavioral-targeting technology in 2007 and 2008. NebuAd partnered with ISPs to gather data about Web users' activity for ad-serving purposes. To accomplish this, ISPs allowed NebuAd to install a device on their networks that enabled it to learn about users' Web-surfing.

Subscribers filed lawsuits alleging that NebuAd -- and all of the ISPs to test its technology -- violated federal wiretap laws. NebuAd, which folded in 2008, agreed to pay $2.4 million to settle the litigation, but ISPs fought the cases.

The 10th Circuit Court of Appeals ruled on Friday that Embarq didn't itself violate any wiretap laws by allowing NebuAd to gather data about subscribers' Web activity. The court ruled that the federal wiretap law only imposes liability on companies that wrongly intercept traffic. That law generally prohibits companies from intercepting or disclosing subscribers' electronic communications without their consent.

But the appellate judges agreed with Embarq that NebuAd alone was responsible for any potentially unlawful interceptions. That decision was partially based on the appellate court's determination that NebuAd didn't share the raw data, or user profiles it created, with Embarq.

The ruling upheld a decision by U.S. District Court Judge Julie Robinson in the District of Kansas, who granted summary judgment to Embarq in August of 2011.

Robinson also ruled that Embarq was entitled to dismissal of the case because its subscribers consented to NebuAd's platform by failing to opt out of the program. But the 10th Circuit said it didn't need to decide that issue because it found that Embarq never intercepted data.

Like most of the ISPs that tested NebuAd's platform, Embarq notified subscribers about the technology by quietly revising its privacy policy shortly before conducting the test. In Embarq's case, the change consisted of adding a "preference advertising" paragraph, which said the company might use information about sites visited in order to "deliver or facilitate the delivery of targeted advertisements." That paragraph had an opt-out link.

NebuAd's technology drew criticism from privacy advocates, as well as lawmakers, for several reasons. The most significant was that ISPs were able to provide data about everything consumers did online -- including their searches and activity at non-commercial sites, like sites run by hospitals or religious organizations. NebuAd said its data collection was anonymous, and that consumers could opt out of the program.

The other ISPs to test NebuAd's program were CenturyTel, Knology, Bresnan, Cable One and Wide Open West. A privacy lawsuit against CenturyTel was dismissed last year, while a case against the ISP Knology was sent to arbitration. Litigation is still pending against Bresnan and Wide Open West.

"Privacy Keyboard photo from Shutterstock"