AT&T has denied using behavioural advertising systems as an ISP, but it does as an advertiser, according to a vendor of such services.

AT&T does not use behavioral advertising or the controversial method of deep packet inspection in its role as an internet service provider, said Dorothy Attwood, AT&T's chief privacy officer and senior vice-president for public policy. She was testifying before the US House of Representatives Subcommittee on Communications, Technology and the Internet.

The hearing focused on ISPs using behavioural advertising and deep packet inspection (DPI), a method of intercepting and examining a user's web traffic. Attwood's testimony did not talk about the company's use of behavioural advertising in its role as an advertiser and its partnership with behavioural advertising vendor AudienceScience.

She seemed to criticise behavioral advertising at the hearing. "Behavioural advertising in its current forms is largely invisible to customers," she told lawmakers. "These new online advertising paradigms must be designed to account for a new set of still-evolving consumer expectations and understandings about how personal information will be used and how personal privacy will be safeguarded."

Attwood told lawmakers AT&T would not use DPI or other behavioural advertising methods without informed customer consent.

AT&T will "avoid thoughtlessly lurching into this realm without proper due diligence", she said. "We will initiate such a program only after testing and validating the various technologies and only after establishing clear and consistent methods and procedures to engage consumers and ensure the protection of, and ultimate consumer control over, consumer information. If AT&T deploys these technologies and processes, it will do so the right way."

But that's not how AT&T partner AudienceScience operates. AudienceScience does not ask for opt-in approval from web surfers, but instead has its website partners disclose their tracking behaviors in their privacy policies. Customers can then opt out of tracking after reading the privacy policy, said Jeff Hirsch, AudienceScience's president and CEO.

"Essentially, there's an implied consent that a consumer is giving, by visiting a site and being able to view that content for free, that they're going to receive advertising," he said. "The idea is to make that advertising more valuable to the advertiser.

AudienceScience does not use deep packet inspection, Hirsch said. Instead, the company uses cookies to track Internet users. AudienceScience doesn't collect personally identifiable information, but it can track internet users across multiple sites using its service, he added.

Hirsch declined to comment on how long AT&T and ad company MEC Interaction have used his company's services, but one report had AT&T using AudienceScience as early as March 2005.

AudienceScience until recently listed AT&T as an advertising partner. AT&T's name was taken off AudienceScience's site after a reporter from MediaPost.com pointed it out following Thursday's hearing.

AudienceScience has also taken down a customer testimonial from MEC, which has placed ads for AT&T.

AT&T says it doesn't use behavioral advertising as an ISP, but it does as an advertiser.

AudienceScience decided to take down the references to AT&T because of the confusion over its use of behavioural advertising, Hirsch said. "We wanted to make sure we conferred with all the appropriate parties to have consistent messaging," he said. "There were, what I feel to be, some confusing comments made about the situation."

AT&T spokesman Michael Balmoris said Attwood was talking about AT&T's role as an ISP, not an advertiser, when she said on Thursday that the company does not use behavioural advertising.

"As an ISP, we do not track our customers' data across unrelated websites to create a profile for behavioural advertising, or hire other firms to do so on our behalf," he said. "Our relationship with this firm is as an advertiser of AT&T products and services. News reports suggesting that we are engaging in behavioural advertising by selling information of our customers is flat wrong."

AT&T does not control the practices of the ad networks or search engines it places ads with, but it has disclosed in the past that it advertises with those outlets, he added. "Like thousands of other businesses that operate websites, AT&T does business with advertising networks and has partnered with providers of online search," Attwood said in an August letter to Congress.

Privacy advocate Jeffrey Chester called on AT&T to clarify its position about behavioural advertising, including whether the company would support legislation to provide "full customer control" of advertising use of their data. "There may be a tug-of-war going on at AT&T, because it appears they don't have a consistent policy on [behavioural targeting] and privacy," said Chester, executive director of the Center for Digital Democracy.

AudienceScience continues to list several other tech companies as advertisers using its technology, including Amazon.com, AOL, Dell, eBay, Hewlett-Packard, IBM and Verizon Communications. The websites using AudienceScience's behavioural advertising technology, according to the company, include AOL, CNet.com, CNNMoney.com, the Los Angeles Times, People, The New York Times, Time and Weather.com.

Privacy advocates have decried most current forms of behavioural advertising as secretive and invasive because website operators generally do not ask customers for their consent.

"Behavioural targeting has become a largely invisible data-collection, profiling and targeting behemoth that threatens the privacy of almost all internet users," Chester said. "Unknown to most of us, BT companies engage in a far-reaching data collection sweep of our online activities. BT identifies the pages we visit, where our mouse is in a page, what we spend in our shopping cart, the content we like, our journey online."