(CN) - Two Internet providers secretly installed "unprecedented, extraordinarily pervasive" spyware on their broadband networks, allowing them to spy on and profile their customers for targeted online advertising, according to a federal class action in Kansas City, Kan.
The class claims that from late 2007 to July 2008, Delaware-based Embarq Management and United Telephone Co. of Eastern Kansas funneled Internet users' communications to NebuAd, a third-party advertising company.
The spyware, which was tied to users' Internet Services Provider addresses, left undeletable tracking cookies and could not be detected through individual privacy or security settings, according to the complaint.
NebuAd monitored and profiled individual users - eavesdropping on their email and search histories - to send targeted advertising on Web pages that the users visited, the class claims.
NebuAd is not named as a defendant. Both Embarq and United Telephone do business as CenturyLink, according to the complaint.
Named plaintiffs Kathleen and Kerry Kirch say people's online data can reveal enormous personal information, including finances, movie rental choices, attorney-client privilege and information about minor children.
Embarq and United Telephone were paid on a per-customer, per-month basis, according to the complaint. The class says the Internet providers gave little warning before activating the spyware and simply amended their online privacy policies with misleading information two weeks before they did so.
Embarq told Congress that the NebuAd test affected 26,000 subscribers in Kansas and 6 million across the country, according to the complaint. But the class claims that many more people were affected, since one subscription typically includes multiple users in a household.
"Assuming a single user from each of 26,000 customer accounts visited one Web site per day during a five-month period, the number of diverted incoming and outgoing communications would be approximately 4 million," according to the complaint.
The class says Embarq made misleading statements about the spyware in response to congressional inquiries, claiming the "foray into profiling and ad distribution with NebuAd was 'brief.'"
Embarq also bent the truth by claiming that it did not use personally identifiable information, though tracking users through online behavior profiles is as personally identifiable as a phone number, according to the complaint.
Embarq and United Telephone are accused of invasion of privacy, wiretapping and computer fraud.
The class seeks an injunction, disgorgement of ill-gotten gains, punitive damages and deletion of all the date it wrongfully collected. Lead counsel is Glenn Stockton of Gardner, Kan
Read the Top 8
Sign up for the Top 8, a roundup of the day's top stories delivered directly to your inbox Monday through Friday.