How the Verizon tracking works, according to privacy technologist Jonathan Mayer

Update on January 30: Verizon Wireless sent a response to my letter, saying it "has begun working" to allow customers to opt out of the tracking code I describe below. Full statement from Verizon at the end of this post.

Dear Verizon,

Hey there. You and I have been acquainted for over a decade now, ever since a hot summer day in 2003 when I walked into a Verizon store in Bethesda, Maryland, bought a little Motorola flip phone and committed to spend two years with you. And then I just kept spending time with you, because it really seemed like that “Can you hear me now?” guy was right. The bars were almost always there, even underground on the D.C. Metro or the New York subway.

Advertisement

I’ve made over 160 monthly payments to you for my smartphone service and dozens more for my iPad data plan. I’ve paid you about $15,000 over the years. You’re my longest-term corporate relationship. I’ve stayed faithful and am always on time with my payments. And you’ve been good to me, like that time I went over my minutes and had an insane bill. Some lovely person on the phone knocked that off and that was super nice.

But Verizon, ever since the FCC loosened the privacy rules for you, you’ve gotten creepy. A few years back you announced you were going to start bundling up information about my location history and web browsing and sell it — “anonymous and aggregated” — to advertisers. Apparently, the $1,000 I was paying you per year wasn’t cutting it. You needed a side piece.

I understood. You were like the police officer who makes a little extra as a bouncer at night. I could forgive you because there was an opt-out for customers who didn't want to have their data packaged up for resale.

Advertisement

However, now you’ve done something I can’t forgive, because this time there is no emergency exit. You created a “supercookie” that puts a unique code on your customers’ network activity so that you can target them with real-time ads as they browse the Web and use smartphone apps. The way you’ve built this thing, it broadcasts the tag not only to you but to Web trackers that want to listen and track everything I do on my smartphone. A tracker could potentially follow my activity from website to website and app to app for a full picture of what I'm interested in and doing. And the trackers are using it. One advertising network used the code to place its own trackers back on Verizon customers’ devices after they had purposefully deleted them.

I talked to your senior privacy officer in the fall when this first got attention, and was disturbed when she didn’t see how this was problematic. She said customers could opt-out of having the code used by Verizon for ad targeting but that the code would remain attached to their activity, like an appendix waiting to burst. When I raised concerns about the fact that the code could then be used by others to track me, she said Verizon would make it difficult to persistently track someone by changing the code “on a regular basis" and "at least once a week." But people who tested the presence of the code found it was not actually changing weekly. You were whispering sweet nothings. You expressed surprise it was suddenly an issue. Verizon had started doing it — silently — in 2012.

Verizon, I pay you for data, not to give my data away. Putting a tracking code on my Internet activity without telling me or giving me a right to say no is not okay. Even if I take proactive steps to prevent tracking and clear my cookies like a fiend, there is only one way for me to avoid the tracking dart you’ve stuck in me — using a Wi-Fi network for Internet access rather than 3G, 4G or LTE. But if I were always on Wi-Fi, why would I need to pay you the absurd amount you charge per month?

Advertisement

You told the New York Times that you’re “considering allowing subscribers to opt out of being tagged with [your] undeletable customer codes.” Consider hard. Kenn White, the developer who created this tool for people to see if they’ve been tagged, canceled his Verizon account and moved to T-Mobile. You’ve got to get rid of this tracker, or more customers are going to get rid of you as their carrier, including me. You spent a lot of money and commercial placements to acquire your 125 million customers. Are the pennies you make selling real-time ads to each of them worth losing the long-term business of the ones who care about their privacy?

—-

Two days after I wrote this letter, Verizon sent the following statement:

Advertisement

"Verizon takes customer privacy seriously and it is a central consideration as we develop new products and services.  As the mobile advertising ecosystem evolves, and our advertising business grows, delivering solutions with best-in-class privacy protections remains our focus.

We listen to our customers and provide them the ability to opt out of our advertising programs.  We have begun working to expand the opt-out to include the identifier referred to as the UIDH, and expect that to be available soon.   As a reminder, Verizon never shares customer information with third parties as part of our advertising programs."