NebuAd, (sounds like something out of a dystopian sci-fi novel) a new system from the Claria Corporation, is "the first consumer-centric behavioral targeting network," and, according to the Bits blog from the New York Times, is "farthest along" among advertising systems based on data gathered from Internet service providers. Here's a more-detail explanation of how it works:
...NebuAd installs a hardware device it has designed inside the network of I.S.P.s One device can monitor all of the information going to and from 30,000 to 50,000 users. The device associates the information it sees with the I.P. address of the user. [It] also examines other information about users’ computers in order to identify when an I.P. address is changed. The I.P. address is encoded before it is stored using a technique called hashing. That makes it harder for someone who might get access to NebuAds system to get a list of the I.P. addresses about which it has information. For each of the I.P. addresses it is monitoring, the NebuAd system analyzes the Web traffic including the addresses of the pages visited, the search terms entered, and keywords that appear on those pages. This information is distilled to about 1000 categories representing various purchase interest: shopping for a mortgage, researching lawnmowers, and so on. The system keeps track of how often and how recently users visited pages in these categories, but the system does not keep the list of the actual pages visited. The system also ignores Internet traffic other than Web browsing, such as file downloads and voice over the Internet calls. And it doesn’t have access to encrypted browsing sessions, such as those used to make purchases or investments online.
Some comments left on a previous post from Bits show how concerned people are in general about ISP data being used for advertising.