Cookie-based opt-out
"NebuAd did provide a cookie-based opt-out and claimed to anonymize all user data with a one-way hash, but US law may require an opt-in."
The problem is that a cookie-based opt-out is not a valid opt-out. Not all browsers support cookies, and cookies are not required for web access. Many security-conscious people block cookies, especially third-party cookies, as an additional step in protecting one's privacy. Forcing someone to use cookies in order to opt-out is an affront to that person's privacy.
(Almost) anything that collects personal information should require explicit opt-in (no, burying an agreement within a license or contract does not equal explicit opt-in).


