The Electronic Frontier Foundation has published a list of tools that can block online advertising companies from collecting web browsing data in ways that privacy advocates contend are deceptive.
Computer scientist Jonathan Mayer of Stanford University and ProPublica revealed on Wednesday that an online advertising company, Turn, can re-create the history of a person’s Web browsing traffic using Verizon’s tracking system.
Verizon tracks its mobile subscribers’ web surfing by tagging their traffic at the carrier level with a number called a UIDH (Unique Identifier Header). Verizon uses the system for two of its targeted advertising programs.
The type of tracking, known as “header enrichment,” is controversial. AT&T stopped using the method last year after running tests, ProPublica reported in November 2014.
Turn uses the UIDH in a way that privacy advocates say is concerning. Turn and other online advertising companies uses cookies, or small data files stored in a Web browser, to keep track of websites and Web pages that people have visited in order to serve targeted advertisements.
Ginny via Flickr/Creative Commons But if a person deletes their cookies, online advertisers have less data. Turn, however, can re-create one of its deleted cookies by looking at Verizon’s UIDH, a practice that critics say is invasive. It’s called a “zombie” cookie.
Turn has defended its practices, writing in a blog post on Wednesday that “clearing a cookie cache is not a widely recognized method of reliably expressing an opt-out preference.”
“The advertising industry has worked together to develop far more effective methods for consumers to express the choice not to receive tailored ads,” Turn said, noting that opt-out tools are available from the Network Advertising Initiative and the Digital Advertising Alliance.
There are several tools, however, that can block Web trackers such as Turn, wrote Peter Eckersley, technology projects editor for the EFF. Applications such as AdAway, AdBlock, AdBlock Plus and Disconnect Pro will all halt Turn from receiving data.
Users don’t have a lot of options for preventing their mobile traffic from being tagged with a UIDH. Using a VPN or Tor would stop it, but it’s probably unlikely the vast majority of people would use those kinds of services on a mobile device.
But people could stop using Verizon. Ironically, that is Verizon’s suggestion according to its privacy policy: “If you do not want information to be collected for marketing purposes from services such as the Verizon Wireless Mobile Internet services, you should not use those particular services.”