I had a chance to check out a recently released CRS report on behavioral advertising [pdf]: "Privacy Law and Online Advertising:  Legal Analysis of Data Gathering By Online Advertisers Such as DoubleClick and NebuAd".  The report commits the cardinal sin of discussing DoubleClick and NebuAd in the same sentence.  They shouldn't even be in the same report!  Nevertheless, the report helpfully canvasses some of the cases in the area (In re DoubleClick, Inc. Privacy Litigation and In re Pharmatrak, Inc. Privacy Litigation) and concludes that use of cookies to target advertising and build networks does not violate any existing laws.  (Those cases are worth re-reading in my opinion.  They're a bit older and it had been a while.)

Two items of interest on this topic.  First, Hunton's Privacy and Information Security blog notes a draft bill is being prepared that would require disclosure of monitoring or tracking for advertising purposes.  At this point the bill is in draft form and I have not come across any details regarding this.  Second, PC World reports that Chris Soghoian developed a browser extension called TACO, that allows its users to opt out of 27 advertising networks (h/t Techdirt; Technology Liberation Front).  Soghoian demonstrates that the cookie-based tracking "problem" can be easily solved from a technical standpoint.  It's really a question of user education and empowerment.  You can opt out of networks now through several different means, including (now) Soghoian's browser extension.  A bill that touches this would be pure folly.  "Deep packet inspection" is obviously a different story.  The fact that the two types of advertising are often discussed together is worrisome.

[image courtesy of solyanka on Flickr [link]/creative commons license]

More:  a great post from Michael Zimmer talks about this (Soghioan's extension) and how drug companies use a popular online quiz to collect information (the In Re Pharmtrak raises this issue in a general way, not sure how factually similar the practices are).  Click on over and read Zimmer's post.