A controversial service which tracks users' behaviour as they browse the internet in order to increase the effectiveness of online advertising is illegal, an influential think tank has said.

Phorm, which is backed by three of the UK's biggest internet service providers, is designed to make online advertising more relevant by taking account of all the websites a person visits, rather than just the content of a single web page.

The Foundation for Information Policy Research (FIPR), a group of Cambridge academics, said today that the service - which is due to be trialled by BT this month - infringed users' privacy. The group called on the Information Commissioner, who is due to publish a report on the subject in a couple of weeks, to condemn the service.

Phorm, which has the support of BT, Virgin and Talk Talk, says that its technology will allow ISPs to serve more relevant advertising to customers by keeping track of the types of pages a person visits during a complete 'browsing session'.

For instance, if a person visited five golfing websites before visiting a financial services page, the technology might suggest serving another golf advert on the financial page, where typically an advert for a financial product might have appeared.

The big ISPs have signed on to the service, hoping that it will increase their share of the burgeoning online advertising market, which at present is dominated by companies such as Google that broker deals directly between advertisers and websites.

FIPR, an influential group of academics, today attacked the service, saying that gathering information about website visits without the user's consent amounted to a breach of the Regulation of Investigatory Powers Act, which prevents unlawful interceptions of communications.

"Users should have to opt in to such a system, not merely be given an opportunity to opt out," the FIPR said. "Failure to establish a clear and transparent 'opt-in' system is likely to render the entire process illegal and open to challenge in UK and European courts."

The FIPR's report went further, suggesting that even if users agreed that their browsing could be monitored, the service would still be illegal unless it also obtained the consent of web publishers, as the content on their pages was effectively part of the 'intercepted communication'.

A spokesman for Phorm, which is based in the UK, said that it had not taken a decision about whether users would have to give their consent before the service was activated, which would be a matter for the ISPs which signed on.

Meanwhile, more than 5,000 people have signed a petition which claims that Phorm invades privacy and calls on the Prime Minister to review the country's privacy laws.

Phorm's technology - which will be sold directly to ISPs - works by assigning the computer of each internet user a number, so that the path of the user across the internet can be tracked.

Advertisers can then buy advertising based on the way the person - who is identified only by the number - uses the internet over a longer period of time. For instance, a Paris hotel could say it only wants its adverts to be shown to a person who has visited LastMinute.com or Expedia, two travel sites, at least once, and who has searched for the terms 'hotel paris' in a search engine.

Individual websites may hold registration details about their own users, but they are unlikely to know which other websites and services they use. Such information is typically known only by the ISP.

Once the advertiser's criteria are satisfied, the advert is served and the details of that person's path across the internet are deleted, Phorm said.

The privacy implications of the service, which is called Webwise, have been investigated by two independent parties - 80/20 Thinking, a consultancy which advises companies on privacy issues, and Ernst &Young, the financial services firm, Phorm said. Both found that none of the information collected about consumers made them personally identifiable.

A leaked report by the Home Office also found that "targeted online advertising services" that were undertaken "with the highest regard to the respect for the privacy of ISPs' users and the protection of their personal data" were legitimate, as long as an ISP first requested the user's consent.

"The purpose of RIPA is not to inhibit legitimate business practice, particularly in the telecommunications sector," the Home Office report concluded.

The Information Commissioner's Office (ICO) has asked Phorm for details about how its technology works, and is due to make its report on the privacy aspects of the service soon.

Explore Tech & Web

• Personal Tech

• The Web

• Gadgets & Gaming