I remember going to an FTC workshop in November 1999 about "online profiling."  At that workshop, DoubleClick was getting a lot of attention.  People were concerned that DoubleClick was going to combine extensive personal offline information from Abacus (including the catalog-buying habits of tens of millions of households) with its own databases of online profiling information.

It was quite dramatic, as I recall.  Not too many people knew what a "network advertiser" was at that point, and DoubleClick seemed surprised at the focus on its plans.  (People were struggling to understand "cookies.")  I remember thinking that offline direct-mail companies had an awful lot of information to work with and no one ever seemed to tell them what databases they could use.  But I dimly recall that a DoubleClick executive promised at that meeting that they wouldn't merge these offline/online databases.

A while later the Network Advertising Initiative issued self-regulatory principles that required sites using network advertisers (sites allowing third parties to place and read cookies on visitors' hard drives) to disclose that cookies were being used and to make it possible for users to opt out of those third-party ads.

And then, as far as I could tell, the issue went to sleep for a while.  There are always concerns about identity theft, but these concerns aren't linked to online profiling by advertisers.  There are concerns about governmental over-collection of data -- but, again, it's not the private advertisers who are the problem.  Back in 2002 there were concerns about tracking in connection with medical and financial data, but the lawsuits seem to have boiled away. Companies routinely disclosed that third parties were cookie-ing on their sites.  And users got used to targeted ads.

Now, with Google's acquisition of DoubleClick, beaconing and cookie-ing and tracking are newsworthy again.  The Electronic Privacy Information Center has filed a complaint urging the FTC to keep Google from completing the deal. 

Google, for its part, says that it doesn't plan to combine the kind of cross-site information DoubleClick has with its own information.  Google also says that users should have the ability to opt out of cookies.  (EPIC's complaint is that Google matches queries to IP addresses and doesn't allow users to request that this linkage not be made.)  And Google has recently undertaken to anonymize its query data  (by changing some of the bits in the IP addresses and by changing cookie information) after 18-24 months.  (FAQ here.)  Google resisted the DOJ's over-reaching COPA-related query request last year and has joined with other companies in asking for baseline US privacy legislation.

EPIC's complaint doesn't actually say that Google has lied about its practices or that it is violating existing US statutes.  Its complaint is that Google doesn't give adequate notice of its data collection practices (collecting user search terms with IP addresses), but Google's home page is notoriously and intentionally simple.  People interested in finding out what Google is doing can navigate their way to find out.  I remember being presented with a good deal of privacy-related information when I downloaded Google Desktop, and choosing (I believe) not to have it "phone home" to Google. "Fair information practices" and the OECD Privacy Guidelines are not part of US law (yet).

Of course, the legal details don't matter that much here.  Google's services are so popular and it has such a big presence that its acquisition of DoubleClick raises suspicions all on its own.  There's something about cross-site, invisible-to-most-people network advertising that gives people the willies -- even if Google can't access DoubleClick's clients' data. 

This has the feeling of November 1999.  An acquisition of a complementary company in the advertising business -- an event that would go unnoticed in the offline world -- is making people worry about what might happen to the privacy of their machines.  So the lawsuit is being reported on (InformationWeek article here), and we'll probably have several workshops and more legislative efforts.