Verizon's Zombie Cookie Gets New Life
by Julia Angwin and Jeff Larson in ProPublica
Verizon is giving a new mission to its controversial hidden identifier that tracks users of mobile devices.
Verizon said in a little-noticed announcement that it will soon begin sharing the profiles with AOL's ad network, which in turn monitors users across a large swath of the Internet.
That means AOL's ad network will be able to match millions of Internet users to their real-world details gathered by Verizon, including — "your gender, age range and interests." AOL's network is on 40 percent of websites, including on ProPublica.
AOL will also be able to use data from Verizon's identifier to track the apps that mobile users open, what sites they visit, and for how long. Verizon purchased AOL earlier this year.
Privacy advocates say that Verizon and AOL's use of the identifier is problematic for two reasons: Not only is the invasive tracking enabled by default, but it also sends the information unencrypted, so that it can easily be intercepted.
"It's an insecure bundle of information following people around on the Web," said Deji Olukotun of Access, a digital rights organization.
Verizon, which has 135 million wireless customers, says it is will share the identifier with "a very limited number of other partners and they will only be able to use it for Verizon and AOL purposes," said Karen Zacharia, chief privacy officer at Verizon.
In order for the tracking to work, Verizon needs to repeatedly insert the identifier into users' Internet traffic. The identifier can't be inserted when the traffic is encrypted, such as when a user logs into their bank account.
Previously, Verizon had been sending the undeletable identifier to every website visited by smartphone users on its network — even if the user had opted out.
But after ProPublica revealed earlier this year that an advertising company was using the identifier to recreate advertising cookies that users had deleted, Verizon began allowing users to truly opt-out, meaning that it won't send the identifier to subscribers who say they don't want it.
Verizon users are still automatically opted into the program.
"I think in some ways it's more privacy protective because it's all within one company," said Verizon's Zacharia. "We are going to be sharing segment information with AOL so that customers can receive more personalized advertising."
A recent report by Access found that other large carriers such as AT&T and Vodafone, are also using a similar technique to track their users.
In order for Verizon users to opt-out, they have to log into their account or call 866—211—0874.
ProPublica is a Pulitzer Prize-winning investigative newsroom. Sign up for their newsletter.