Deep Packet Injection = Trademark Infringement

Posted by in June 25th, 2008

It’s taken me a few days to get to this one, but I read the blog of New York Law School Associate Professor James Grimmelmann where he analyzes the NebuAd controversy. In his analysis, he comes up with a fascinating point that what they are doing may constitute copyright and trademark infringement, in addition to the privacy issues already raised last week.

Quick catch up since I’ve not written about this before: NebuAd makes deals with ISPs to serve ads to users based on the Web pages they visit. They use cookies on the users computer and monitor web-browsing habits using Deep packet inspection. This raises severe privacy concerns because ISPs know every Web site that users visit and all of their search queries. This clickstream data often provides enough information to figure out their identities.

Professor Grimmelman’s raises issues that go way beyond privacy and into the realm of potential lawsuits. Page content is copyrighted and many elements are trademarked. ISPs are shielded from copyright liability by law, but one of the conditions of this immunity is that “the material is transmitted through the system or network without modification of its content.” He even says that advertisers might be liable if they knew (imagine making a buy and not knowing how it’s being served - it’s probably in their sales pitch) what NebuAd was doing for them.

He compares the NebuAd process to serving some other cola to a customer who asks for a “Coke.” He argues that when the NebuAd cookie is injected by your ISP into a page they serve you, that the page is no longer the exact page you asked for. He says ” When your ISP delivers you a page with a NebuAd cookie injected, the statement that this is the page you asked for is false. The ISP is passing off the NebuAd cookie as being from Amazon. It’s not.” This seems like a bit of a stretch to me, but I’m not an intellectual property attorney. He argues that since the cookie is used to sell you goods that it would be close enough to be an issue.

Users can choose to block or allow cookies from specific publishers, but he says that NebuAd’s packet injection “blows away this safeguard. It tricks me into accepting a cookie I wouldn’t have otherwise wanted.” He calls this a “misuse” of the originating site’s trademark.

If NebuAd continues with this business model, there will some interesting cases to watch.