More than 30,000 BT Broadband users were used to secretly test the Phorm online advertising system in two separate tests in 2006 and 2007.
The ISP has admitted that it used technology from 121Media (which became targeted advertising company Phorm) to analyse web traffic and then placed selected adverts on a number of websites. The users involved were not informed about the tests.
Phorm technology identifies websites and keywords visited by surfers, which can then be used to target surfers with more streamlined advertising that is most relevant to them.
BT's actions breached the Regulation of Investigatory Powers Act (RIPA) 2000 that states it is an offence to intercept internet traffic without consent or a warrant. The ISP may now face legal action by any users that can show their data was used.
BT said in a statement: "The purpose of the test was to evaluate the functional and technical performance of the platform. It is important for BT to ensure that before any new technologies are deployed, they are robust and fit for purpose. No personally identifiable information was processed, stored or disclosed during this test."
However, Nicholas Bohm from the Foundation for Information Policy Research told BBC News: "If the customers in 2006 and 2007 weren't invited to do anything and it was completely surreptitious, and assuming that BT and Phorm trialled a version of what they are planning to launch later this year, then it was a massive scale illegal interception."
BT is planning a third test of the system to take place next month, although the company has stated it will be approaching 10,000 customers and asking them to take part.