NebuAd has denied using such tactics, saying it uses "industry-standard techniques for standard ad serving purposes."

NebuAd on Tuesday announced it was rolling out a new notification and opt-out program as part of the targeted ad service. The program would give consumers periodic reminders that they are enrolled in the ad system, the company said. NebuAd's announcement about new privacy measures came a day before a U.S. Senate Commerce, Science and Transportation Committee hearing on Internet advertising privacy, where NebuAd Chairman and CEO Robert Dykes is scheduled to testify.

The changes detailed by NebuAd Tuesday aren't enough, because the company still requires ISP subscribers to opt out of information collection, Schwartz said. "Even if they went with opt in [consent], there'd still be state concerns," he added.

NebuAd disputed the CDT interpretation of wiretap laws, but it supports current privacy standards, said company spokeswoman Janet McGraw. NebuAd agrees with the industry standard of implementing more rigorous disclosure and consent practices when sensitive data is collected, she said.

In addition, the company does not collect personally identifiable information and does not store data linked to individuals, she said. NebuAd uses "state-of-the-art security" for any information it collects, she added.

"NebuAd's service is designed so that no one-- not even the government -- can determine the identity of our users," McGraw said.

By tracking Web surfing habits, it would be easy for NebuAd to identify users, CDT and Public Knowledge officials countered. They called on Congress and the Federal Trade Commission to make rules addressing behavioral advertising programs operated by ISPs.