1. The Privacy Symposium Privacy in Transition August 20, 2008 Turning the Tables: How Preference Marketing by Broadband ISPs Will Disrupt the Google Advertising Model Yaron Dori Covington & Burling LLP 1201 Pennsylvania Avenue, N.W. Washington, D.C. 20004 Tel: (202) 662-5444 Fax: (202) 778-5444 E-mail: ydori@cov.com

2. The Privacy Symposium Privacy in Transition August 20, 2008 2 Roadmap for Discussion Applicable Legal Framework  Electronic Communications Privacy Act (“ECPA”) Introduction and Overview  Definition of preference advertising  Summary of preference advertising practices -The Wiretap Act -The Stored Communications Act -Pen Registers/Trap and Trace Devices  State Wiretap Laws  FTC Act  Other Claims Current Status Predictions

3. The Privacy Symposium Privacy in Transition August 20, 2008 3 Introduction and Overview Definition of Preference Advertising  “The tracking of a consumer’s activities online – including the searches the consumer has conducted, the Web pages visited, and the content viewed – in order to deliver advertising targeted to the individual consumer’s interests.” See FTC Staff Statement on Online Behavioral Advertising at 2, available at http://www.ftc.gov/os/2007/12/ P859900stmt.pdf. Summary of Preference Advertising Practices  The Google/DoubleClick Model -See In re DoubleClick, Inc., 154 F.Supp. 2d 497 (S.D.N.Y. 2001).  The Broadband ISP Model

4. The Privacy Symposium Privacy in Transition August 20, 2008 4 Applicable Legal Framework ECPA  The Wiretap Act, 18 U.S.C. § 2510, et seq. -Prohibits the intentional interception, disclosure or use of any wire, oral or electronic communication “Wire” = Aural transfer (contains a human voice) “Oral” = in-person communication “Electronic Communication” = “signs, signals, writings, images, sounds, data or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photoelectric or photooptical system that affects interstate or foreign commerce” “Interception” = contemporaneous with transmission. See, e.g., U.S. v. Steiger, 318 F.3d 1039, 1047 (11th Cir. 2003). -Key Exceptions for Preference Advertising Analysis: (1) Consent, (2) Service Provider, (3) Business Use

5. The Privacy Symposium Privacy in Transition August 20, 2008 5 Applicable Legal Framework (cont’d) ECPA (cont’d)  The Wiretap Act (cont’d) -Exception 1: Consent “It shall not be unlawful under this chapter [for a person] to intercept a wire, oral, or electronic communication where such person is a party to the communication or where one of the parties to the communication has given prior to consent such interception.” 18 U.S.C. § 2511(d). Single party only (subscriber or publisher) Placement (Terms of Use, Privacy Policy, Stand Alone) Continuum of Consent Express vs. Implied

6. The Privacy Symposium Privacy in Transition August 20, 2008 6 Applicable Legal Framework (cont’d) ECPA (cont’d)  The Wiretap Act (cont’d) -Exception 1: Consent (cont’d) Select Implied Consent Cases oGriggs-Ryan v. Smith, 904 F.2d 112 (1st Cir. 1990) (finding implied consent after repeated notification that all incoming phone calls at campground were being recorded). oGeorge v. Carusone, 849 F.Supp. 159 (D.Conn 1994) (finding implied consent in workplace where there was an established policy of monitoring telephone communications and employees had knowledge of monitoring policy). oUnited States v. Workman, 80 F.3d 688, 693 (2d Cir. 1996) (“When an inmate has repeatedly received notice that calls placed on prison telephones are subject to surveillance, the evidence indicates that he is in fact aware of the monitoring program, and he nevertheless uses the telephones, by that use he impliedly consents to be monitored for purposes of Title III”) oU.S. v. Faulkner, 439 F.3d 1221 (Kan. 2006) (finding implied consent by pretrial detainee where detainee received numerous warnings that his call might be recorded and detainee was aware of such warnings).

7. The Privacy Symposium Privacy in Transition August 20, 2008 7 Applicable Legal Framework (cont’d) ECPA (cont’d)  The Wiretap Act (cont’d) -Exception 2: Service Provider Exception Interception and disclosure permitted “in the normal course... while engaged in any activity which is a necessary incident to the rendition of... service or to the protection of the right of property of the provider of that service.” 18 U.S.C. § 2511(a)(i). oBerry v. Funk, 146 F.3d 1003, 1010 (D.C. Cir. 1998) (holding that a switchboard operator who overhears a few moments of a phone call to ensure that the call went through to be a “necessary incident”). oUnited States v. Councilman, 418 F.3d 67, 82 (1st Cir. 2005) (en banc) (holding that a service provider’s capture of emails to gain a commercial advantage “clearly” was not within the service provider exception).

8. The Privacy Symposium Privacy in Transition August 20, 2008 8 Applicable Legal Framework (cont’d) ECPA (cont’d)  The Wiretap Act (cont’d) -Exception 3: Business Use Excludes from the definition of “interception” transmissions that are obtained by “any... equipment or facility, or any component thereof... used by a provider of wire or electronic communications service in the ordinary course of business.” 18 U.S.C. § 2510(4) and (5). What is “the ordinary course of business?” oCourts are divided oBerry v. Funk, 146 F.3d 1003, 1009 (D.C. Cir. 1998) (suggesting that the “ordinary course” may apply to any device used for monitoring that is “undertaken normally”). oWatkins v. L.M. Berry & Co., 704 F.2d 577, 581 (11th Cir. 1983) (“The phrase ‘in the ordinary course of business’ cannot be expanded to mean anything that interests a company”).

9. The Privacy Symposium Privacy in Transition August 20, 2008 9 Applicable Legal Framework (cont’d) ECPA (cont’d)  Other Provisions -Stored Communication Act, 18 U.S.C. § 2701, et seq. Prohibits intentional access without authorization into a facility through which an electronic communication service is provided Applies to stored communications, not contemporaneous transmissions Subject to exceptions similar to those under ECPA -Pen Registers/Trap and Trace Devices, 18 U.S.C. § 3121, et seq. Applies to “dialing, routing, addressing or signaling information,” not content. See 18 U.S.C. § 3127(3). See In re Pharmatrak, 329 F.3d 9, 32 (1st Cir. 2003) (holding that URLs are content).

10. The Privacy Symposium Privacy in Transition August 20, 2008 10 Applicable Legal Framework (cont’d) State Wiretap Laws  Generally track language and exceptions of The Wiretap Act  Twelve states require “dual” or “all party” consent: CA, CT, FL, IL, MD, MA, MI, MT, NV, NH, PA and WA. -Application to preference advertising model oNo reported Google/DoubleClick Model cases oShould a “public” website have an expectation of privacy? oShould a “public” website have an expectation of privacy in connection with the activities of others (who have consented) vis-à-vis the website?

11. The Privacy Symposium Privacy in Transition August 20, 2008 11 Applicable Legal Framework (cont’d) FTC Enforcement –Section 5 (Unfair or Deceptive Acts or Practices) –Self-Regulatory Principles Examples of Other Claims –Common Law –State Privacy Laws –Lanham Act (Trademark Infringement)

12. The Privacy Symposium Privacy in Transition August 20, 2008 12 Current Status Timeline of Select Recent Events: –Late 2007/Early 2008 – Phorm activities in U.K. begin to receive widespread attention –December 6, 2007 – Wall Street Journal article on CenturyTel –May 16, 2008 – House Commerce Committee Letter to Charter –July 9, 2008 – Senate Commerce Committee Hearing –July 14, 2008 – House Commerce Committee Letter to Embarq –July 17, 2008 – House Commerce Committee Hearing –August 1, 2008 – House Commerce Committee Letter to 33 Search Engines and Broadband ISPs –August 8, 2008 – Responses to August 1 House Commerce Committee Letter due (see http://energycommerce.house.gov/ Press_110/080108.ResponsesDataCollectionLetter.shtml)

13. The Privacy Symposium Privacy in Transition August 20, 2008 13 Predictions Level Playing Field Legislation Discounted Service Model Immunization Theories –See, e.g., United States v. Hammond, 286 F.3d 189, 192 (4th Cir. 2002) (Subsequent FBI acquisition of lawfully intercepted telephone calls by Bureau of Prisons not an “interception” because FBI acquisition not contemporaneous with transmission).

14. The Privacy Symposium Privacy in Transition August 20, 2008 14 Questions?