Verizon users might want to start looking for another provider. In an effort to better serve advertisers, Verizon Wireless has been silently modifying its users' web traffic on its network to inject a cookie-like tracker. This tracker, included in an HTTP header called X-UIDH, is sent to every unencrypted website a Verizon customer visits from a mobile device. It allows third-party advertisers and websites to assemble a deep, permanent profile of visitors' web browsing habits without their consent. 
 
 Verizon apparently created this mechanism to expand their advertising programs, but it has privacy implications far beyond those programs. Indeed, while we're concerned about Verizon's own use of the header, we're even more worried about what it allows others to find out about Verizon users. The X-UIDH header effectively reinvents the cookie, but does so in a way that is shockingly insecure and dangerous to your privacy. Worse still, Verizon doesn't let users turn off this "feature." In fact, it functions even if you use a private browsing mode or clear your cookies. You can test whether the header is injected in your traffic by visiting lessonslearned.org/sniff or amibeingtracked.com over a cell data connection. 
 
 How X-UIDH Works, and Why It's a Problem 
 
 Like a cookie, this header uniquely identifies users to the websites they visit. Verizon adds the header at the network level, between the user's device and the servers with which the user interacts. Unlike a cookie, the header is tied to a data plan, so anyone who browses the web through a hotspot, or shares a computer that uses cellular data, gets the same X-UIDH header as everyone else using that hotspot or computer. That means advertisers may build a profile that reveals private browsing activity to coworkers, friends, or family through targeted advertising. 
 
 Also unlike a cookie, Verizon's header is nearly invisible to the user and can't be seen or changed in the device's browser settings. If a user clears their cookies, the X-UIDH header remains unchanged. Worse, ad networks can immediately assign new cookies and link them to the cleared cookies using the unchanged X-UIDH value. We don't know which data brokers and ad networks are using the header to create behavioral profiles, but Cory Dunne found at least one GitHub repository contained code to extract the header value, as of October 27. The repository has since been quietly deleted but can be viewed at the Internet Archive. Twitter's mobile advertising division also appears to use the header for ad auctions. 
 
 Besides cookie clearing, the X-UIDH header bypasses several other built-in browser privacy mechanisms. Cookies belong to a single website and aren't shared with other websites. But one unique X-UIDH header value is shared with all unencrypted websites a user visits, making it easier for ad networks to track that user across many sites in a way not possible with cookies alone. Browsers provide Incognito Mode or Private Browsing Mode in order to defeat some kinds of tracking, but the X-UIDH header, since it is injected at the network layer, ignores those modes. Verizon also chooses to ignore Do Not Track, a setting users enable in their browser to indicate they do not want to be tracked. Similarly, disabling third-party cookies in browser settings does nothing to stop the X-UIDH header. 
 
 To compound the problem, the header also affects more than just web browsers. Mobile apps that send HTTP requests will also have the header inserted. This means that users' behavior in apps can be correlated with their behavior on the web, which would be difficult or impossible without the header. Verizon describes this as a key benefit of using their system. But Verizon bypasses the 'Limit Ad Tracking' settings in iOS and Android that are specifically intended to limit abuse of unique identifiers by mobile apps. 
 
 Because the header is injected at the network level, Verizon can add it to anyone using their towers, even those who aren't Verizon customers. Notably, Verizon appears to inject the X-UIDH header even for customers of Straight Talk, a mobile network reseller (known as a MVNO) that uses Verizon's network. Customers of Straight Talk don't necessarily have a relationship with Verizon. 
 
 But according to AdAge, "Corporate and government subscribers are excluded from the new marketing solution." We haven't verified (and Verizon refuses to say) whether the header is still sent for those subscribers or not. If they are indeed excepted from the program, that indicates to us that implementing an opt-out is feasible. We're disappointed that Verizon takes some of its users' privacy more seriously than others. 
 
 Verizon's Claimed Protections 
 
 Verizon does provide a sort of limited opt-out for individual customers, but it appears that the opt-out does not actually disable the header. Instead, it merely tells Verizon not to share detailed demographic information with advertisers who present a UIDH value. Meaningful protection from tracking by third parties would require Verizon to omit the header entirely. 
 
 According to Verizon, the header value is a salted hash, and the hash changes on an undisclosed frequency. However, it's easy for third-party ad networks to create a continuous profile by associating old and new X-UIDH values through their own identifier cookie . Verizon has refused to say what identifier they hash to create the identifier, but their recent patent suggests hashing a phone number. If they are indeed hashing phone numbers, it would be a major cryptographic mistake. Phone numbers can easily be deduced from hashes, so sending those hashes to untrusted web sites is practically equivalent to giving them your phone number. 
 
 Besides the ad networks, the unique X-UIDH header is a boon to eavesdroppers. We have seen that the NSA uses similar identifying metadata as 'selectors' to collect all of a single person's Internet activity. They also have been shown to use selectors to choose targets for delivering malware via QUANTUMINSERT and similar programs. Having all Verizon mobile users' web traffic marked with a persistent, unique identifier makes it trivial for anyone passively eavesdropping on the Internet to associate that traffic with the individual user in a way not possible with IP addresses alone. 
 
 According to Verizon, it began the Precision Market Insights program in 2012, but has consistently refused to provide technical details about how the program worked. The injection of the X-UIDH header went largely unremarked by the technical community until recently because it is so hard to observe. The header is inserted in requests after they leave the phone, so customers cannot detect it using only a phone. In order to detect it, a user needs to run a web server configured to log or echo all HTTP headers, which is very rare. 
 
 How You Can Protect Yourself 
 
 Verizon can only modify plaintext traffic. It can't modify encrypted requests without breaking the whole connection. There are four options for encrypting web requests: HTTPS, an encrypted proxy, a VPN, or Tor. Only a VPN or Tor provide full protection in this case. 
 
 The best protection against this specific problem is to use a VPN that encrypts all requests made from your phone, regardless of whether they were made by an app or a browser. Most VPNs are paid services, and when using a VPN you have to trust the VPN operators the same way you would normally trust your ISP. Advanced users can also use Tor via Orbot Android app in transparent proxy mode (requires root). Tor is free, but you have to trust exit node operators not to interfere with your connection. Tor is more appropriate if you are trying to be anonymous. 
 
 The second-best protection is to use an encrypted proxy, which protects browser traffic but not mobile apps. Mobile Chrome provides the 'Reduce data usage' setting, which is reported to prevent the X-UIDH header injection. Unfortunately, this connection is not reliably encrypted, because an ISP can disable encryption on it at any time. 
 
 HTTPS, which is the best protection for many types of harm, is actually the least powerful protection for this one. The header cannot be injected into an HTTPS request, but since websites choose whether to offer HTTPS, a site that wants to track users can simply avoid HTTPS and get the tracking headers. The web needs to become fully encrypted, and these X-UIDH headers provide a strong disincentive for sites and advertisers who wish to track their users to adopt HTTPS. In fact, the AT&T patent on similar headers recommends downgrading (redirecting) secure HTTPS requests to HTTP ones in order to receive the tracking header. 
 
 What Verizon Should Do 
 
 Verizon should immediately stop injecting the X-UIDH tracking header into its users' traffic. It is entirely possible to re-design their marketing programs so that the header is only injected for users who explicitly consent to having their Internet connections modified to add tracking information, and to do so in a way that doesn't allow third-party sites to track users across the Internet. 
 
 We're also concerned that Verizon's failure to permit its users to opt out of X-UIDH may be a violation of the federal law that requires phone companies to maintain the confidentiality of their customers' data. Only two months ago, the wireline sector of Verizon's business was hit with a $7.4 million fine by the Federal Communications Commission after it was caught using its "customers' personal information for thousands of marketing campaigns without even giving them the choice to opt out." With this header, it looks like Verizon lets its customers opt out of the marketing side of the program, but not from the disclosure of their browsing habits. 
 
 More generally, Verizon should stop tampering with their customers' Internet traffic without their customers' consent. ISPs like Verizon act as trusted connectors to the world, and shouldn't be modifying our communications on their way to the Internet. People should not be required to subscribe to a VPN and put their trust in a third party in order to get a modicum of privacy on the Internet. 
 
 AT&T has been reported to be testing a similar header. 

 Dragnets Tracking Censorship and Surveillance 
 
 An online advertising clearinghouse relied on by Google, Yahoo and Facebook is using controversial cookies that come back from the dead to track the web surfing of Verizon customers. 
 
 The company, called Turn, is taking advantage of a hidden undeletable number that Verizon uses to monitor customers' habits on their smartphones and tablets. Turn uses the Verizon number to respawn tracking cookies that users have deleted. 
 
 Does Your Phone Company Track You? Check for Tracking Code Click from your smartphone or tablet (with Wi-Fi turned off) to see if your telecom provider is adding a tracking number. We don't save any information. Al Shaw and Jonathan Stray, ProPublica Your personal tracking code is token This is being sent by your carrier to every site you visit using this device. You are not being tracked by your carrier, or not viewing this on a mobile network. 
 
 "We are trying to use the most persistent identifier that we can in order to do what we do," Max Ochoa, Turn's chief privacy officer, told ProPublica. 
 
 Turn's zombie cookie comes amid a controversy about a new form of tracking the telecom industry has deployed to shadow mobile phone users. Last year, Verizon and AT&T; users noticed their carriers were inserting a tracking number into all the Web traffic that transmits from a users' phone – even if the user has tried to opt out. 
 
 Users complained that the tracking number could be used by any website they visited from their phone to build a dossier about their behavior – what sites they went to, what apps they used. 
 
 In November, AT&T; stopped using the number. But Verizon did not, instead assuring users on its website that "it is unlikely that sites and ad entities will attempt to build customer profiles" using its identifiers. 
 
 When asked about Turn's use of the Verizon number to respawn tracking cookies, a Verizon spokeswoman said, "We're reviewing the information you shared and will evaluate and take appropriate measures to address." 
 
 Turn privacy officer Ochoa said that his company had conversations with Verizon about Turn's use of the Verizon tracking number and said "they were quite satisfied." 
 
 Turn's actions were spotted by Stanford researcher Jonathan Mayer, and confirmed by ProPublica's testing. 
 
 Turn and Verizon also have a separate marketing partnership that allows Verizon to share anonymized information about its mobile customers. In April, Verizon sponsored a Turn event in New York City called " Bringing Sexy Back to Measurement." 
 
 Turn, which calls itself a "Digital Hub," may not be a household name but it is a huge back-end processor of ads on websites. 
 
 It works like this: When a user visits a website that contains Turn tracking code, the company holds an auction within milliseconds for advertisers to target that user. The highest bidder's ad instantly appears on the user's screen as the web page loads. Turn says it receives 2 million requests for online advertising placements per second. 
 
 For its auctions to work, Turn needs to identify web users by cookies, which are small text files that are stored on their computers. The cookies allow Turn to identify a user's web browsing habits, such as an interest in sports or shopping, which it uses to lure advertisers to the auction. 
 
 Some users try to block such tracking by turning off or deleting cookies. But Turn says that when users clear their cookies, it does not consider that a signal that users want to opt out from being tracked. 
 
 "There are definitely people who feel that if they clear their cookies, they won't be tracked, and that is not strictly accurate," said Joshua Koran, senior vice president of product management at Turn. 
 
 Turn executives said the only way users can opt out is to install a Turn opt-out cookie on their machine. That cookie is not designed to prevent Turn from collecting data about a user - only to prevent Turn from showing targeted ads to that user. 
 
 ProPublica's tests showed that even Verizon users who installed the Turn opt-out cookie continued to receive the Turn tracking cookie as well. Turn said despite the appearance of the tracking cookie, it continues to honor the opt-out cookie. 
 
 Initially, Turn officials also told ProPublica that its zombie cookie had a benefit for users: They said they were using the Verizon number to keep track of people who installed the Turn opt-out cookie, so that if they mistakenly deleted it, Turn could continue to honor their decisions to opt out. 
 
 (Julia Angwin, Mike Tigas and Terry Parris Jr., ProPublica) 
 
 But when ProPublica tested that claim on the industry's opt-out system, we found that it did not show Verizon users as opted out. Turn subsequently contacted us to say it had fixed what it said was a glitch, but our tests did not show it had been fixed. 
 
 Either way, this fix does not address the respawning of cookies that have been deleted– since Turn says it does not consider that an expression of user intent. 
 
 "It is our absolute desire to honor people's choices," said Ochoa, Turn's chief privacy officer. 
 
 For more coverage, read ProPublica's previous reporting on Verizon's indestructible tracking and AT&T;'s decision to stop using the technique. 

 Verizon Wireless injects a unique header into customer web traffic. When the practice came to light last year, it was widely panned. Numerous security researchers pointed out that this “supercookie” could trivially be used to track mobile subscribers, even if they had opted out, cleared their cookies, or entered private browsing mode.1 But Verizon persisted, emphasizing that its own business model did not use the header for tracking. 
 
 Out of curiosity, I went looking for a company that was taking advantage of the Verizon header to track consumers. I found one—Turn, a headline Verizon advertising partner. They’re “bringing sexy back to measurement.” 
 
 Warning Signs 
 
 There are, roughly, two ways that a website could track a user with the Verizon header. The sneaky way is to surreptitiously correlate values on the backend. Detecting that is quite tricky. (Though there’s been impressive research progress in the past couple years.) 
 
 The brazen lazy transparent way is to bolt the header onto existing cookie tracking. If a user’s ID cookie is missing, simply reconstruct it from their Verizon header. In the rich jargon of online privacy, these are dubbed “zombie cookies.” They rise from the grave.2 
 
 In late December, I went Verizon zombie hunting. I began by developing a basic web crawler with PhantomJS. It visited popular websites, clearing cookies after each page. On the first run, it spoofed a Verizon advertising header.3 On the second run, it used a vanilla configuration. A post-processing script then scanned for lengthy cookie values that recurred only in the Verizon crawl. 
 
 The uid cookie on turn.com immediately appeared suspicious. The same unique value was restored on over a hundred pages. 
 
 Undead Cookies 
 
 Confirmation was easy. A request to certain Turn resources, sans Verizon header, simply drops a uid cookie. 
 
 $ curl -D - "http://ad.turn.com/server/ads.js" ... Set-Cookie: uid=2415230717135370700; Domain=.turn.com; ... 
 
 Each cookieless request results in a new ID. 
 
 $ curl -D - "http://ad.turn.com/server/ads.js" ... Set-Cookie: uid=4425321986559530189; Domain=.turn.com; ... 
 
 So far, no surprises. When requests include a Verizon header, though, the subsequent response behavior is different. 
 
 $ curl -H "X-UIDH: OTgxNT..." -D - "http://ad.turn.com/server/ads.js" ... Set-Cookie: uid=4012847891611109688 ; Domain=.turn.com;... $ curl -H "X-UIDH: OTgxNT..." -D - "http://ad.turn.com/server/ads.js" ... Set-Cookie: uid=2539356028667362074; Domain=.turn.com;... Set-Cookie: uid=4012847891611109688 ; Domain=.turn.com;... 
 
 As before, there’s a new ID. But a second Set-Cookie header appears; it trumps the first header and restores the old ID.4 
 
 Turn does not seem to validate the Verizon header. Sending a totally bogus value, for instance, still results in a zombie cookie. 
 
 $ curl -H " X-UIDH: totallybogus " -D - "http://ad.turn.com/server/ads.js" ... Set-Cookie: uid=8323135681340417635 ; Domain=.turn.com;... $ curl -H " X-UIDH: totallybogus " -D - "http://ad.turn.com/server/ads.js" ... Set-Cookie: uid=3259412905334729433; Domain=.turn.com;... Set-Cookie: uid=8323135681340417635 ; Domain=.turn.com;... 
 
 The respawning logic also appears to be naïve. It seems to simply replay the latest ID value associated with the header.5 
 
 $ curl -H " X-UIDH: fake " -H "Cookie: uid=123456789 " -D - "http://ad.turn.com/server/ads.js" ... Set-Cookie: uid=123456789 ; Domain=.turn.com;... $ curl -H " X-UIDH: fake " -D - "http://ad.turn.com/server/ads.js" ... Set-Cookie: uid=3647115064319153191; Domain=.turn.com;... Set-Cookie: uid=123456789 ; Domain=.turn.com;... 
 
 I tried moving between IP addresses and User-Agents, in case those factored into Turn’s behavior. The zombie cookie remained. 
 
 Because of implementation quirks, the zombie cookie might not always stick.6 But the basic design and effect are straightforward. 
 
 Cookie Contagion 
 
 The privacy impact does not, unfortunately, end with Turn. Over the past five years, the online advertising market has shifted from monolithic advertising networks to fragmented advertising exchanges. A technical consequence is that advertising firms routinely swap ID values. In industry lingo, it’s call “cookie syncing.” 
 
 In my crawl, Turn’s zombie cookie was sent to or from over thirty other businesses.7 They included Google, Facebook, Yahoo, Twitter, Walmart, and WebMD. How those firms use Turn’s ID, I can’t say—it’s entirely possible that some unknowingly tracked users with a zombie value. They certainly possessed sufficient information.8 It’s especially likely for businesses that dropped their own tracking cookie with Turn’s ID.9 
 
 The privacy impact also goes beyond individual mobile browsers. If a Verizon customer tethered with their phone, their notebook could get stuck with the zombie value. (The ultimate in cross-device advertising!) And the zombie value could spread between cookie stores on a device, including between the web browser and individual apps. (The ultimate in inter-app advertising!) 
 
 In sum, there are widespread collateral consequences from Turn’s zombie cookie. 
 
 No Escape 
 
 If a Verizon Wireless subscriber objects to Turn’s tracking, what’s their recourse? Well, both Verizon and Turn offer opt outs. You might think those would be effective. You would think wrong. 
 
 Verizon provides two separate privacy choices related to the header: “Relevant Mobile Advertising” and “Verizon Selects.” Steve Englehardt has compiled a convenient comparison of these programs.10 
 
 The accounts that I tested had both Relevant Mobile Advertising and Verizon Selects disabled, as well as every other controllable form of Verizon information sharing. Turn’s zombie cookies kept coming back. 
 
 These preferences don’t actually stop Verizon from injecting a unique advertising header. They merely stop Verizon from passing along additional customer information. If a business is using the header as a tracking identifier—like Turn is—the Verizon preferences are entirely ineffective. 
 
 Turn’s privacy option also fails to prevent its zombie cookies. I checked by opting out on Turn’s website,11 a process that drops an optOut=1 cookie and expires ID cookies.12 
 
 I then cleared browser state and visited websites where Turn’s zombie cookie had previously respawned. The uid tracking cookie came back. 
 
 What’s more, the optOut cookie—which is supposed to prevent behavioral ad targeting—did not get resurrected. According to Turn’s own status check, the user’s preference against behavioral advertising was gone. 
 
 Status checks for advertising self-regulatory programs confirmed that Turn would use its tracking data for behavioral advertising.13 
 
 So, what’s a Verizon subscriber to do? Ad blocking would be effective, but it isn’t supported by the stock Android or iOS browsers. Using a VPN or other secure proxy would work, though that’s quite cumbersome. For an ordinary user, there simply is no defense. 
 
 Are These Zombies Legal? 
 
 
 
 Commercial supercookies, fingerprinting, and zombie cookies are tolerated (if not permitted) under current United States law.17 Any associated consumer deception, however, is a violation of the Federal Trade Commission Act and parallel state statutes. 
 
 I think a consumer deception claim would succeed against Turn. One theory is deception by omission: Turn failed to disclose its zombie cookie practice. Turn’s privacy policy speaks volumes about cookies, but says nothing about the Verizon header. 
 
 This isn’t a novel legal theory. The FTC previously used it against Epic Marketplace, for failing to disclose a non-cookie tracking technology. (That case was based on a prior project.) Even an advertising industry self-regulatory body acknowledged that non-cookie tracking requires special notice. 
 
 Another viable theory against Turn is that its opt-out mechanism is deceptive. The advertising industry’s self-regulatory guidelines say this: 
 
 The technologies that members use for [behavioral advertising] purposes must provide users with an appropriate degree of transparency and control. 
 
 It’s weak language, to be sure. Ordinarily, the “appropriate” control is opt-out, difficult to find, implemented as a flimsy cookie, and limits only ad targeting (not tracking!). 
 
 In the context of non-cookie tracking technologies, though, the text does have a little bite. A company can use a tracking mechanism that is stickier than a cookie. But for the “control” to be “appropriate,” it must be at least as sticky as the tracking. That’s not just a sensible interpretation—that’s the advertising industry’s own interpretation. 
 
 Companies must also ensure that their [behavioral advertising] opt-out mechanism provides consumers with real choice, which may require linking their back-end technologies to existing opt-out mechanisms so that they will function seamlessly no matter what technology is being employed. 
 
 As noted above, Turn does not link its Verizon header tracking to a consumer’s opt-out choice. 
 
 Are These Headers Legal? 
 
 The ideal enforcement target is, of course, Verizon. They started this whole header mess, and they can finish it. Others have previously argued that the unique header violates telecom customer privacy obligations. That might be.14 
 
 Given Turn’s zombie cookie practice, I think there’s also a good FCC, FTC, or state deception case against Verizon.15 The company has consistently misrepresented the privacy properties of its header, and especially the impact of its opt-out preferences. 
 
 In its explanation of the advertising header, Verizon says: 
 
 It is unlikely that sites and ad entities will attempt to build customer profiles for online advertising or any other purpose using the [header] . . . . 
 
 Security researchers disagreed. We were right. 
 
 For ad tech entities that have a presence on many websites, the [header] does not provide any information beyond . . . other already existing IDs. 
 
 False. The header enables more persistent tracking than other technologies, especially on mobile platforms.16 
 
 When a customer opts out of [Verizon advertising programs] the [header] cannot be used for advertising purposes because there is no information associated with it available to our ad partners. 
 
 Also false. Turn is using the header for ad tracking, and Verizon’s opt-out preferences do not alter Turn’s practices. This is precisely the scenario that security researchers warned about. 
 
 When a customer opts out, our partners receive no information, anonymized or otherwise, about those customers. 
 
 Again, false. Turn is a partner. And it’s receiving some information about the customer—a persistent unique identifier. 
 
 Since the [header] was implemented in 2012, we are not aware of any uses of the [header] other than the intended uses we have described here. 
 
 Might want to change that. 
 
 Verizon’s statements to the press are also inaccurate. Wired: 
 
 According to Verizon spokeswoman Debra Lewis . . . if you opt out of the company’s [header advertising program], then Verizon and its advertising partners won’t be using [the header] to create targeted ads. 
 
 Nope. CIO (and customer support): 
 
 Verizon spokeswoman Debra Lewis says . . . “If/when a customer opts out . . . there is NO information associated with the ID and therefore, no ability to use it for advertising purposes.” 
 
 Negative. Washington Post: 
 
 A company spokeswoman, Adria Tomaszewski, said . . . those who are not part of the Verizon advertising program . . . are not able to use the supercookie to track Verizon customers. “The way it’s built, it wouldn’t be able to be used for that,” Tomaszewski said. 
 
 You get the idea. 
 
 Concluding Thoughts 
 
 Internet service providers are in a trusted position. They can arbitrarily observe and tamper with all of a customer’s traffic. What’s more, in the wireless space, carriers can exert control over a customer’s devices. 
 
 When ISPs have breached that trust to snoop on subscribers, they’ve landed in trouble. Debacles involving NebuAd, Phorm, and Carrier IQ come to mind. The reasons are evident: consumers have limited information, limited choice, and limited control. 
 
 Advertising headers are no different. AT&T has already yanked its program; it’s past time for Verizon to do the same. 
 
 Sometimes I write (shorter) stuff at @jonathanmayer. 
 
 I owe a debt of gratitude to Steven Englehardt, Arvind Narayanan, Jacob Hoffman-Andrews, and other friends and colleagues who contributed to this work. All views and errors are solely my own. 
 
 The graphics in this post remix resources that are Creative Commons licensed. 
 
 1. The only viable defense against the Verizon header is securing all traffic through Verizon’s network, e.g. with a VPN. 
 
 2. Researchers have previously spotted zombie cookies using Flash LSOs, HTML5 storage, HTTP ETags, and other tracking technologies. John Mitchell and I wrote a survey paper a few years ago synthesizing possibilities. 
 
 3. Specifically, I used my own header value from October. 
 
 4. Some Turn resources were a little more subtle, responding with just the old ID value. For instance: 
 
 $ curl -H "X-UIDH: OTgxNT..." -D - "http://d.turn.com/r/du/" ... Set-Cookie: uid=4012847891611109688 ; Domain=.turn.com;... 
 
 5. In my crawls, I saw more than one ID value get respawned. That suggests that Turn’s mechanism for associating an ID with an X-UIDH header is more convoluted than merely storing and replaying a single value. 
 
 Also, I tried testing with an older and newer Verizon header for the same device. They received different ID values, suggesting Turn is treating the header as an opaque identifier. 
 
 I should note that Turn’s implementation allows a website to steal a user’s uid value. That could, potentially, allow an adversary to learn coarse information about the user’s browsing activity (e.g. based on ads displayed). 
 
 6. Not all Turn resources receive the Verizon header (e.g. those loaded over HTTPS or over a non-Verizon network). Also, not all Turn resources respawn cookies. An example: 
 
 $ curl -H "X-UIDH: OTgxNT..." -D - "http://ad.turn.com/r/cs" ... Set-Cookie: uid=4375890934513601832; Domain=.turn.com;... 
 
 If the browser does not have a uid cookie, and some of these resources are also embedded, a race condition arises between HTTP transactions. The browser can thrash between new and old cookie values, depending on request and response timing. In my testing, a zombie cookie was the most common end state. 
 
 7. A post-processing script checked URLs, referrers, and cookies for the zombie value. The results are available in a spreadsheet. Based on Turn’s partner APIs, as well as observations from Steven Englehardt, it appears other companies may have received the zombie value. 
 
 8. The Verizon header itself, of course, is sufficient information for persistent tracking. The header rotates periodically, however, making Turn’s zombie cookies more robust. 
 
 9. Assuming these firms keep HTTP request logs with cookie values, they’d have a zombie IDed database of user web browsing activity. 
 
 10. My understanding is the same as Steve’s. Relevant Mobile Advertising is an opt-out program that facilitates demographic and consumer profile targeting. It may also incorporate some behavioral targeting; Verizon’s language is ambiguous. Verizon Selects is a compensated opt-in program; it covers location-based and behavioral targeting. 
 
 11. A similar process is available on industry self-regulatory websites. 
 
 12. The uid value can subsequently respawn or be reassigned, before the user has cleared their cookies. 
 
 13. It’s possible that Turn has an opt-out preference stored on its backend, tied to an X-UIDH header or uid cookie value. The technical evidence suggests otherwise—that would render the optOut cookie entirely redundant and mean all three status checking mechanisms are broken. The definitive answer is in Turn’s backend which, of course, I can’t audit. 
 
 14. To my knowledge, no regulatory agency has yet challenged one of these practices as inherently “unfair” or “deceptive” in violation of consumer protection law. 
 
 15. One theory is that the header constitutes an unauthorized disclosure of “customer proprietary network information” (CPNI) under Section 222(c) of the Communications Act. Another basis for liability is that the header is “proprietary information” under Section 222(a), a new theory articulated by the FCC in a recent data breach case. 
 
 16. In this area, the Federal Communications Commission, the Federal Trade Commission, and the state attorneys general have concurrent authority. The FCC’s deception authority would stem from the Open Internet Order or Section 201 of the Communications Act. 
 
 17. According to several journalists, Verizon is keen to compare the header to Apple’s Advertising Identifier on iOS. That ID, while problematic, does have more favorable privacy properties. It isn’t accessible from the browser, users can forcibly change it, there’s an associated privacy signaling mechanism (“Limit Ad Tracking”), and all app developers are bound by enforceable conditions on using it.
– Verizon phones can apparently track you, even if you try to stop them. This month a Stanford University lawyer confirmed on his blog what cybersecurity experts have warned for a while: You can delete cookies on Verizon phones, but the company's so-called "supercookies" remain, allowing advertisers to target you anyway, the New York Times reports. "Verizon is not in a position to control how others use its [tags]," says the lawyer, Jonathan Mayer. "There’s no doubt that this particular approach does introduce new privacy problems." Others have noticed, too: After ProPublica reported on the practice this month, the ad software company Turn agreed to stop tracking Verizon users for ad sales. "We feel this practice is legal," says a Turn executive, but privacy concerns have persuaded them to stop "as soon as we get the new codes rolled out." Turn, a Verizon customer, uses the phones' tags to track online habits and sell ad space to companies targeting people based on their interests. And Verizon's not alone: AT&T tried a similar system last year but shelved it under news-media scrutiny. And companies like Yahoo and Facebook allow advertisers to target users in similar ways. While activists seek to reclassify telecom companies as "common carriers"—which would limit their legal right to share data—Verizon says it's reconsidering the "supercookie" practice. "They did not talk to me," says Verizon's technology director of the new revelations. "If they did, I would not have been satisfied."