Ars technica

The data appears to be “anonymous” only in the sense that it consists of IP addresses and not usernames. When deployed by an ISP, however, linking IP addresses to one’s own user accounts is trivial.

Do ISPs even have the authority to install such systems on their network? “Anonymous” or not, DPI tools might be considered wiretap devices, and a group called Privacy International promptly complained to the European Commission about the issue (during the debates over a similar DPI-based ad-serving system called Phorm, the UK government made clear it would not do much to stop such trials).

Today, the European Commission indicated that it took the Privacy International complaint seriously and would watch Virgin’s actions closely.

The BBC also went to Virgin, asked a couple of obvious questions about how CView would work, and elicited some amazing responses from an ISP spokesman.

“He admitted that potentially 40 percent of Virgin Media’s customers could have their data scrutinised and confirmed that it has no plans to inform them beforehand. He also conceded that it would not be technically difficult to link up deep packet inspection technology with the IP addresses which would identify individuals but stressed that was not the plan currently.”