The European commission has launched legal proceedings against the UK government for alleged breach of EU data protection laws caused by controversial internet advertising company Phorm.

Telecoms commissioner Viviane Reding said UK law will have to change to ensure the confidentiality of communications by prohibiting interception and surveillance without a user's consent.

The move follows months of informal communication between Brussels and the Information Commissioner's Office (ICO) about Phorm's controversial behaviour-targeted advertising technology. Phorm's technology enables internet service providers (ISPs) to analyse what their users are doing to build up a profile of their interests, which can then be used by advertisers to serve more relevant adverts on websites they subsequently visit.

A year ago, BT admitted it had tested the technology in 2006 and 2007 without informing customers involved in the trial. That lead to protests from privacy campaigners and several complaints to the commission from individuals and MEPs, which sparked the talks with the ICO.

The technology was subsequently cleared by the ICO, provided consumers were required to opt in to it. The commission, however, believes the UK law needs to be strengthened to ensure that UK users are asked to give their consent before their data is intercepted.

The commission said it had written several letters to the UK authorities since July 2008, asking how they had implemented relevant EU laws in the context of the Phorm case. The EU directive on privacy and electronic communications requires member states to ensure confidentiality of the communications and related traffic data by prohibiting unlawful interception and surveillance unless the users concerned have consented, while the EU data protection directive specifies that user consent must be "freely given, specific and informed". The directive also requires member states to establish appropriate sanctions in case of infringement, with independent authorities charged with supervising implementation.

"Following an analysis of the answers received, the commission has concerns that there are structural problems" in the way the UK has implemented these rules, the commission said in a statement.

Under UK law, it is an offence to unlawfully intercept communications. However, the scope of this offence is limited to "intentional" interception. Moreover, according to this law, interception is also considered to be lawful when the interceptor has "reasonable grounds for believing" that consent to interception has been given.

The commission said it is concerned that the UK does not have an independent national supervisory authority that deals with such interceptions. The Office of Surveillance Commissioners, which oversees conduct of covert surveillance, only looks after public authorities while the ICO, which looks after issues such as data protection, cannot enforce the Regulation of Investigatory Powers Act (RIPA), which covers interception.

"Technologies like internet behavioural advertising can be useful for businesses and consumers but they must be used in a way that complies with EU rules. These rules are there to protect the privacy of citizens and must be rigorously enforced by all member states," said Reding. "We have been following the Phorm case for some time and have concluded that there are problems in the way the UK has implemented parts of EU rules on the confidentiality of communications.

"I call on the UK authorities to change their national laws and ensure that national authorities are duly empowered and have proper sanctions at their disposal to enforce EU legislation on the confidentiality of communications. This should allow the UK to respond more vigorously to new challenges to e-privacy and personal data protection, such as those that have arisen in the Phorm case. It should also help reassure UK consumers about their privacy and data protection while surfing the internet."

The UK has two months to reply and if it does not – or if its response is deemed inadequate – the commission may decide to issue a "reasoned opinion" calling for changes to the law. If that fails to work, the UK could be taken before the European court of justice and forced to change the law.