A behavioral advertising program that collects information about Internet service provider subscribers' Web surfing habits may be illegal, two privacy groups said Tuesday.

State and federal laws may prohibit a targeted ad program adopted by several U.S. ISPs, officials with the Center for Democracy and Technology and Public Knowledge said. The targeted ad program, offered by California vendor NebuAd, has been tested or implemented by more than a dozen ISPs, according to Robert Topolski, technical consultant for Public Knowledge.

The targeted ad program, which was tested but dumped by Charter Communications, one of the largest cable broadband suppliers in the U.S., may violate federal and state wiretap laws, the CDT said in a memo released Tuesday.

The Electronic Communications Privacy Act (ECPA) could allow ISPs to monitor customers' Internet traffic, with consent from customers, but the law suggests the consent should be active, not buried in a terms of service agreement or a billing statement, said CDT Vice President Ari Schwartz. Several state laws require affirmative consent from all affected parties, in the case of the NebuAd program, both ISP subscribers and the owners of the Web sites they visit, Schwartz added.

The NebuAd program requires ISP subscribers to opt out of having their data collected. Objections to the program gained momentum after Charter announced in May it was testing the NebuAd service. Charter announced in late June it had suspended the program, citing subscriber privacy concerns.

"Consumers do not expect their ISP to be copying their Internet communications and selling them to third parties," Schwartz said. "We have concluded that the advertising network model at issue here requires clear notice and prior consent, and that may be impossible if state laws apply requiring all parties to consent."

Without consent from ISP subscribers and the Web sites they visit, the targeted ad program is possibly illegal, CDT said. It would be impossible to get consent from all Web sites, CDT officials said.

The NebuAd service offered to ISPs is different than traditional online behavioral advertising, because it inserts a third party into the relationship between Web users and the sites they visit, said Leslie Harris, CDT's president and CEO.

Public Knowledge and Free Press, another advocacy group, published a report in June that accused NebuAd of using several common Internet attacks to get information on users' Web surfing habits. The report said NebuAd hijacks browsers, employs man-in-the-middle attacks and uses packet forgery to get information from users and deliver ads.