CBS

Verizon Wireless has begun selling information about its customers' geographical locations, app usage, and Web browsing activities, a move that raises privacy questions and could brush up against federal wiretapping law.

The company this month began offering reports to marketers showing what Verizon subscribers are doing on their phones and other mobile devices, including what iOS and Android apps are in use in which locations. Verizon says it may link the data to third-party databases with information about customers' gender, age, and even details such as "sports enthusiast, frequent diner or pet owner."

"We're able to view just everything that they do," Bill Diggins, U.S. chief for the Verizon Wireless marketing initiative, told an industry conference earlier this year. "And that's really where data is going today. Data is the new oil."

Verizon Wireless says that its initiative, called Precision Market Insights, is legal because the information is aggregated and doesn't reveal customers' identities. Also, the company says, its customers can opt out at any time.

But hyper-detailed monitoring of customers' activity looks a lot like the deep packet inspection techniques that landed NebuAd in hot water -- including a congressional investigation -- four years ago. NebuAd's chief executive, Robert Dykes, claimed he had created "anonymous profiles that cannot be hacked or reverse-engineered," but the controversy led to the company's demise.

Hanni Fakhoury, a staff attorney at the Electronic Frontier Foundation in San Francisco, said a wireless carrier that discloses information about which URLs a customer visits could run afoul of the Wiretap Act. In general, the law says, carriers may not "divulge the contents of any communication."

"I don't see any substantive difference between collecting content from one person and turning it over to someone, and collecting it from multiple people, aggregating that information and then turning the aggregated data over to someone else," Fakhoury says. "In the end, there is still a capturing of content from the user at some point -- and that's what the potential (Wiretap Act) problem is."

Paul Ohm, a professor at the University of Colorado Law School currently working at the Federal Trade Commission, concluded in a law review article that federal privacy law "likely forbids many invasive forms of ISP monitoring."

In a video that was posted of the industry event sponsored by PricewaterhouseCoopers in Los Angeles, Verizon's Diggins touted the carrier's extensive monitoring abilities: "We're able to analyze what people are viewing on their handsets. If you're at an MLB game, we can tell if you're viewing ESPN, we can tell if you're viewing MLB, we can tell what social networking sites you're activating, if you're sending out mobile usage content that's user-generated on video."

Verizon Wireless declined to answer questions that CNET posed last week about how its technology works, but it did provide this statement:

Verizon is committed to customer privacy and takes the issue seriously. The Precision program complies with the law and protects the privacy of our customers. The reports available through the program will not disclose the content of specific customer communications because each report will contain aggregate data from a large number of customers to protect privacy. Customers who do not want their data used as part of the program can opt-out at any time.

"Deep" vs. "shallow" packet inspection

It's true, of course, that any company selling Internet connectivity needs to know the destination of packets so it can route them properly, a practice sometimes referred to as shallow packet inspection.

But monitoring which mobile apps customers are using and which URLs are visited typically means engaging in deep packet inspection, which is controversial because it's more intrusive.

Verizon Wireless' marketing literature acknowledges that it sells "mobile-usage data that offers insights on the mobile-device habits of an audience, including URL visits, app downloads and usage." (Not all carriers do: Google guarantees that its proof-of-concept Google Fiber project "will not engage in deep packet inspection" except when necessary to fend off network attacks.)

Ryan Radia, associate director of technology studies at the Competitive Enterprise Institute think tank, agrees with the EFF's Fakhoury that disclosing aggregated URLs visited can be legally risky. "If Verizon Wireless discloses the URLs you've accessed without your consent, it has violated (the Wiretap Act) -- even if Verizon Wireless doesn't disclose any other identifying information," Radia said.

But, Radia argues, Verizon has obtained consent for its Precision Market Insights program by updating its privacy policy and allowing customers to opt out. That's sufficient to satisfy the Wiretap Act by putting the company's subscribers on notice, he says, and notes that a lawsuit that arose out of NebuAd's monitoring was dismissed last year (PDF).

The 2003 In Re Pharmatrak