Verizon Wireless Tracks Every Website Its Customers Visit With ‘Supercookies,’ Electronic Frontier Foundation Says

Verizon Wireless is tracking more than 100 million of its smartphone customers using “supercookies” that it plants onto their devices. It has admitted to planting the files since as far back as 2012.

The files, which critics are also calling “perma-cookies,” allow companies to monitor every website users visit via the Web browsers of their smartphones. Critics say that the files can be tracked by third parties, and could expose Verizon customers’ Web browsing history to hackers as well as intelligence agencies.

The encryption Apple has built into its new iPhone software, iOS 8, is also powerless against supercookies, according to Electronic Frontier Foundation activist Jacob Hoffman-Andrews, who first brought attention to the practice with a series of tweets. Apple's encryption "only affects how data is stored on your phone, not how it is communicated on the network," he said.

The two-year-old practice is coming under greater scrutiny after a report last month from Ars Technica delved into Hoffman-Andrews' claims. The privacy watchdog says it has informed the Federal Communications Commission about Verizon’s supercookies, and is considering legal action against the carrier.

“We're evaluating all options at this point,” EFF attorney Nate Cardozo said. “Our top priority is making sure Verizon stops modifying its customers' traffic in a way that enables others to track them as soon as possible.”

The supercookies are difficult to avoid if you are a Verizon customer, as they cannot be erased or avoided with “incognito” or “private” features in mobile Web browsers. AT&T is also experimenting with injecting the files onto users’ devices, the Washington Post reported Monday.

Verizon told the newspaper it notified customers about tracking their Web browsing habits, as did AT&T. But EFF activists say the companies hide those notifications deeply with user agreements that customers seldom read.

Verizon and AT&T are using the supercookies to track customer behavior to then help advertisers better target them with ads. Google Inc. and Facebook Inc. currently employ similar “targeted advertising” practices around the Web. Twitter Inc. is already using Verizon’s supercookies to target users with more “relevant” ads, Propublica reports.