An online ad company called Turn is using tracking cookies that come back to life by using a hidden undeletable number that Verizon uses to monitor customers’ habits on their serviced devices. The company called Turn utilizes this number to respawn tracking cookies even after they are deleted by Verizon users.
Max Ochoa, Turn’s chief privacy officer admitted “We are trying to use the most persistent identifier that we can in order to do what we do.”
This controversy has been noted before as a new form of tracking by the telecom industry and has been deployed to shadow mobile phone and tablet users. Both Verizon and AT&T users noticed their carriers were inserting these tracking numbers into all their Web traffic that transmits from their users’ phones. Irregardless if they attempt to opt out or not.
After Verizon’s and AT&T’s users complained that the tracking number could be used by any website they visited from their phone to track their behavior serendipitously (what sites they went to, what apps they used.)
Only AT&T discontinued the practice in November. However Verizon continued to do so, assuring users that “it is unlikely that sites and ad entities will attempt to build customer profiles” when using their numbers as identifiers.
Turn’s actions were originally identified by Stanford researcher Jonathan Mayer.
Turn and Verizon are now known to have a separate marketing partnership which allows Verizon to share anonymized information about its mobile customers. Turn, is also known to have a huge back-end processor of ads on websites.
The mechanics of this cookie mechanism works like this:
When a user visits a website that contains Turn tracking code, the company holds an auction within milliseconds for advertisers to target that user.
The highest bidder’s ad instantly appears on the user’s screen as the web page loads. Turn says it receives 2 million requests for online advertising placements per second.
For its auctions to work, Turn needs to identify web users by cookies, which are small text files that are stored on their computers. The cookies allow Turn to identify a user’s web browsing habits, such as an interest in sports or shopping, which it uses to lure advertisers to the auction.
Turn executives claim the only way users can opt out is to install a Turn opt-out cookie on their machine. The cookie will not prevent Turn from collecting data about a user, only to prevent Turn from showing targeted ads to that user. In other words they still collect the user’s data.
To make matters worse even Verizon users who installed the Turn opt-out cookie continued to receive the Turn tracking cookie as well.
Users can independently test to see if Turn’s claims are what they say they are. I would not trust any thing Turn’s cheif privacy officer says if these test don’t compare to your results.
No fix Turn has done addresses the respawning of cookies that have been deleted as Turn says it does not consider that an expression of user intent.
