Earlier this week Embarq responded to a Congressional inquiry into their recent trial of NebuAD user-tracking ad technology, and the sale of user browsing data. While the letter clarified that Embarq's definition of "informing" users about the trial involved burying fine print in their privacy policy, it really didn't answer any of the specific questions put forth to them by the Congressional inquiry. It did, however, take ample time to insult consumer intelligence by suggesting the sale of user browsing data "empowers" customers.

Embarq has e-mailed me a second, more informative response (pdf) from their CEO to Congress. The letter confirms that Embarq's trial of the technology was conducted on 26,000 subscribers at a single point of presence (POP) in Gardner, Kansas. Embarq says Gardner was chosen because it was their smallest pop, and due to its proximity to "qualified" technical staff.

Embarq says that of the 26,000 customers impacted, only fifteen opted out. That's likely because unless those users made a habit of digging through the Embarq privacy policy fine print once a week, they'd never know the trial was taking place. Embarq again repeats that they believe their fine print notification adheres to FTC standards -- though the FTC standards aren't exactly robust.

While it appears that NebuAD's ineffective opt-out system could violate several federal wiretap and privacy laws, Embarq states that their own internal legal review of the technology found it "lawful and otherwise permissible." They also repeat claims that any data collected was anonymous and not retained.

While this letter is much more informative than the previous one, it's still fails to address the fact that NebuAD's cookie-based opt-out system doesn't actually opt users out of data collection (just targeted ad delivery). It also doesn't go out of its way to concede that e-mailing impacted customers might have been a better bet than burying notification in fine print.