For the last few months, wireless carrier Verizon has been testing out a new ad tracking technology that security analysts are calling a supercookie. Like its cousin, the standard browser cookie, Verizon’s supercookie is a tracking tool, designed to keep a record of what websites you visit while using your mobile device. But Verizon’s unique identifier goes many steps beyond, as third parties can easily intercept it for advertising purposes. And, unfortunately, there’s no way to opt out of being tracked by it.
Naturally, Verizon has downplayed a lot of aspects of its new ad tracker. “If/when a customer opts out … there is no information associated with the (unique super-cookie) ID and therefore, no ability to use it for advertising purposes,” Verizon spokeswoman Debra Lewis writes in an email. “Customers can choose not to participate in the program by going to their privacy choices page on MyVerizon or by calling 866-211-0871.”
But though Verizon may let you opt out of its own ad tracking efforts via the supercookie, opting out does nothing to prevent third parties from using them. In fact, computer scientist Jonathan Mayer caught one Verizon advertising partner, Turn, with its hand in the supercookie jar, using them to resurrect its own company’s tracking cookies when you try to delete them.
“I think a consumer deception claim would succeed against Turn,” Mayer writes, noting that Turn did not disclose its use of the supercookie, nor did it offer an opt-out mechanism to kill its ad tracking properties – only its ad targeting ones. “Even an advertising self-regulatory body acknowledged that non-cookie tracking requires special notice.” Verizon’s supercookie may also violate federal law, which requires carriers to maintain the confidentiality of customer data.
Turn, for its part, says on its company blog that it will disable the use of supercookies “by early February.” But the real problem here isn’t that Turn is using Verizon’s supercookie – it’s that it exists in the first place. The company told the New York Times it is considering allowing a true opt-out, and that the system is still being evaluated. Unfortunately, its desire for profits seems to be trumping the common sense act of ditching the proven insecure tracker for good – at least for now.
If you’re looking to avoid being saddled with Verizon’s supercookie, you have a very limited set of options. One solution is to set up a VPN or use the anonymizing Tor browser. You could also switch carriers – AT&T has abandoned its own attempts to force supercookies on its customers. Realistically though, only one thing can stop the supercookie: The Federal Communications Commission needs to take action to protect us consumers by regulating cell data providers as Title II utilities.
[Smartphone ad via Shutterstock]
