Last week, Verizon Wireless announced that it would allow its users to opt-out of its zombie cookie tracking program, which it calls Relevant Mobile Advertising. Users can now log in to their account and click through a few links to force the company to stop tracking their web traffic. As reported in USA Today, users can also opt out of other tracking programs. This is a major victory for privacy and follows an earlier pledge by AT&T in November to stop the tracking.
Access has been fighting the lack of transparency regarding supercookies since last fall, when we learned that Verizon Wireless had been secretly injecting Unique Identifier Headers, or UIDH, into every single http request made by its mobile users. In response, Access developed a tool that allows mobile users to test whether they are being tracked by their carriers. To date, nearly 172,000 users have taken the test. Not only have we found tracking in the U.S., but we have discovered that the issue may be an international phenomenon in countries such as Canada, Spain, Peru, and the Netherlands.
These cookies have been abused by little-known advertising firms. We believe that the supercookies also make users vulnerable to spoofing by criminals, and could potentially enable governments to surveil users without their knowledge. Even without this type of third-party abuse, though, the very existence of these cookies violates our privacy rights if we can’t truly opt out. That’s why Verizon’s pledge matters.
We’ve kept up the regulatory pressure, too. In the U.S., Access delivered a petition signed by 3,000 users to the U.S. Federal Trade Commission (FTC) to investigate the use of these cookies by mobile carriers to track their customers’ web traffic. Access also delivered a similar petition to the U.S. Federal Communications Commission (FCC) because both agencies arguably have the authority to investigate these harmful practices.
Lessons from the evil sandbox
Mobile internet can be an evil sandbox in which companies experiment with user privacy without much regulation. It is not surprising that similar tracking tools have recently been extended to fixed-line, broadband internet. AT&T’s new GigaPower service requires users to opt-out of tracking of their web traffic, and they must pay a hefty premium to do so. Privacy is becoming a luxury few can afford.
Access will soon be issuing a detailed report that summarizes the results from our AmIBeingTracked test and what they mean for privacy. Meanwhile, you can contribute to the fight by taking our test here to find out if your device is being tracked.