Verizon 'Supercookies,' Which Track Web Browsing, Blasted For 'Bogus' Security, Privacy

An increasing number of computer scientists are expressing concern over the Verizon Wireless “supercookie” that makes it impossible for mobile customers to avoid being tracked. That worry is only growing after a researcher discovered that at least one advertising company hijacked Verizon’s methodology and was able to monitor smartphone users who thought they had deleted records of their online activity.

Verizon Wireless has admitted using “perma-cookies,” also known as supercookies, to track every website that the company’s more than 100 million customers visit. The files, which have been used since at least 2012, are impossible for users to delete, stoking fear from privacy experts that advertisers, hackers and intelligence agencies will soon monitor what mobile users do online.

“Verizon is not in a position to control how others use its header,” Jonathan Mayer, a Stanford computer scientist and lawyer, told the New York Times. “There’s no doubt that this particular approach does introduce new privacy problems.”

At least one advertising company, Turn, a Verizon partner, was doing exactly that until Mayer published a blog post announcing that the entire process, from a security standpoint, was “bogus.”

“We feel this practice is legal,” Max Ochoa, Turn’s chief privacy officer, told the Times Sunday. “But given people’s concerns, as soon as we get the new codes rolled out, we will suspend this practice.”

By using the supercookies, Turn is able to classify users by their Web browsing habits, luring advertisers in by offering to know whether a Verizon customers like sports, technology or another interest that can be marketed to. Turn then holds a virtual online auction that takes only milliseconds, Pro Publica reported, awarding the ad space on a user’s phone to the highest bidder.

A Verizon spokeswoman previously told Wired there is no way to avoid being tracked.

Turn’s decision to suspend the program comes after AT&T announced last year it would stop using supercookies, which also track what apps an individual uses and for how long. Verizon says the classification strategy provides advertising partners with a major advantage by giving them direct access to customer habits.

“Stuff like this is worse than what Google or Facebook or anyone else does,” Harold Feld, a senior vice president at the information policy group Public Knowledge, told the Times. “I can avoid Google and Facebook, in theory at least. But if the network operator is going to spy on me, there is nothing I can do about it.”