Verizon Wireless tracking 100 million users with undetectable 'supercookie'

Verizon Wireless is tracking users' mobile Internet activity using a new 'supercookie,' that is undetectable and virtually unblockable. Verizon is using that information to allow advertisers to target individual users with marketing campaigns. The new supercookie has privacy advocates contemplating legal action.

Verizon Wireless has been the ire of privacy advocates for a while. It was revealed last year that the mobile carrier was handing over phone records to the National Security Agency, and last month the group settled charges that it wasn't notifying users that they could opt-out of tracking. This week privacy advocates have a new reason to protest Verizon.

Verizon Wireless is reportedly tracking more than 100 million mobile customers by installing a 'supercookie' onto mobile devices, according to the advocacy group Electronic Frontier Foundation (EFF). Verizon is using the information to give advertisers the ability to advertise based on an individuals Internet activity.

The supercookies are almost untraceable, according to the EFF. Users cannot block supercookies through privacy settings or incognito modes, which have become a popular way to block outside tracking. Verizon is able to understand an individual's taste or interests by cataloging what websites a user visits, and then uses that information to allow advertisers to target people with specific ads.

'For nearly twenty years now, the cookie has become the standard way to track people online, for better or worse,' Jacob Hoffman-Andrews, the senior staff technologist at EFF, told Marketplace. 'The metaphor I use when I teach is I say a cookie is like a name tag.'

Privacy advocates are alarmed by the new supercookies because they believe other sites will begin to use similar trackers, which will dramatically increase the amount of data collected on ordinary users.

'You're making it very difficult for people who want privacy to find it on the Internet,' Paul Ohm, a former Federal Trade Commission official who teaches at the University of Colorado Law School, told The Washington Post.

Verizon began tracking 106 million customers in November 2012, the company told The Post. Verizon is only tracking its retail customers, and is not tracking its business or government users. Verizon says it sent notifications to customers to offer them a way out of the program, but it would not go into further detail about how many people chose to opt-out.

While users are able to opt-out of the program, it appears the supercookie is never fully disabled.

'Verizon does provide a sort of limited opt-out for individual customers, but it appears that the opt-out does not actually disable the header' Mr. Hoffman-Andrews wrote in his report. 'Instead, it merely tells Verizon not to share detailed demographic information with advertisers....'

This isn't the first time Verizon has come under fire for the data it collects on its customers. In September, Verizon paid $7.4 million to settle charges that it used consumer information for marketing. Verizon failed to notify two million new customers of their privacy rights and how to opt-out of having their personal information used for marketing campaigns.

AT&T is conducting tests with a similar type of supercookie. The company hasn't said how long it's been tracking users Internet activities, but said it has not yet used the information for marketing purposes.

'We are considering such a program, and any program we would offer would maintain our fundamental commitment to customer privacy,' Emily J. Edmonds, an AT&T spokeswoman, told The Post in an e-mail.

EFF has raised complaints with the Federal Communications Commission. The group is contemplating legal action against Verizon because the supercookie is in possible violation of the Communications Act, which prohibits companies from selling revealing information on its customers. Mr. Ohm, told The Post, the companies could also be in violation of the federal wiretap act, which prohibits altering personal communications without court order, if the company didn't send proper notifications to customers.

'What Verizon and AT&T are doing -- and why they might have the leg up here, if there's no backlash from privacy concerns -- is that their network goes across devices,' Jenny Wise, mobile marketing analyst at Forrester, told Marketplace. 'So not only do you know what I'm doing when I use my mobile phone, I'm also using that same network when I'm on my tablet, or when I'm on my TV.'