You can add your wireless provider to the long list of companies and government agencies possibly sneaking a peek at your online movements.
If you're a Verizon customer, the carrier follows your movements online with what's called a "unique identifier header." And then it takes what you've been up to and packages the data for marketers, so they can make targeted mobile ads.
This means around 123 million Verizon subscribers are getting meticulously tracked by the company. Electronic Frontier Foundation staffer Jacob Hoffman-Andrews discovered this program (up and running for two years, by the way) this week.
Verizon lets users "opt out" from participating in PrecisionID, the advertising campaign that uses the UID... But all that does is prevent Verizon from using the data it collects for targeted ads. Because Verizon broadcasts the tracking information to third-party websites, people can still have their movements used to create marketing profiles.
According to security researcher Kenneth White, Verizon isn't the only carrier doing this.
White created a website that lets people test if their carriers are tracking them using the UID technology, and so far, he's found evidence that AT&T, as well as Verizon, is identifying customers with tracking beacons that "persist across location and new IP addresses, for several days," he told me.
Verizon has admitted its behavior, but AT&T denies it has a program like this. "AT&T does not currently have a mobile Relevant Advertising program," a spokesperson told me. But wait! They are "considering" one, which means there's likely something in the works.
"We are considering such a program, and any program we would offer would maintain our fundamental commitment to customer privacy. For instance, we are testing a numeric code that changes every 24 hours on mobile devices to use in programs where we serve ads to the mobile device. This daily rotation on the numeric code would help protect the privacy of our customers. Customers also could opt out of any future AT&T program that might use this numeric code," the spokesperson said.
I've asked White and AT&T for additional information about AT&T's use of tracking and I'll update when I hear back. Forbes reporter Kashmir Hill also looked into AT&T's tests. The company told her that AT&T wouldn't add code in to people who opt out of the program. However, White tested the program by opting out, and discovered that he still found the tracking ID after the fact:
Update: An AT&T spokesperson told me that the screenshot above shows an old opt-out screen from a defunct program. "The updated opt-out feature (no mobile ID insertion) will be turned on before we start using the ID for any advertising program. The opt-out experience also will be updated for ease of use. Opt-outs made now on the existing site will be honored at that time and going forward," they added.
The major carriers aren't the only ones delving into this type of tracking. Customers with regional carriers have contacted White with screenshots showing that companies like Vodacom are up to the same stuff. Vodaphone UK admitted to having a similar program in a tweet:
If this is a ploy to make roaming charges look relatively benign, touché, I guess.
Mobile advertising is a lucrative market, especially if you can effectively offer targeted user profiles. It's logical that these carriers wanted to get involved. But greed has triumphed over consideration for user privacy here. Verizon and A&T are companies with tons of employees, many of whom are very intelligent, and privacy has surely been seriously considered in regards to this program—how to anonymize data enough to obscure specific identities while still retaining enough specifics to make a targeted profile worthwhile in its narrowness.
Unfortunately, whatever discussions happened about privacy failed. Big time. This kind of program should simply be opt-in, not opt-out (I've asked both AT&T and Verizon if they would ever consider making that change).
Verizon spokesperson Debra Lewis told Wired that there was no way to turn off the tracking, which sounds ludicrous. Verizon's technology hasn't become self-aware and gone rogue. It's not like the Verizon executives are sobbing into their money because they've created an unbeatable robot enemy that just wants to create targeted ad profiles based on tracking beacons.
What seems much more likely is that Verizon can turn it off wholesale, it just doesn't want to, because it doesn't care that customers don't want a tracking ID inserted into their online behavior and broadcast to websites. We still don't know exactly how many carriers have similar programs, but any that does is making an active choice to continue on with using the tracking beacons. They have the power to stop, they have the power to make these programs opt-in, and they have the power to sell our information or to protect it.
I am looking into whether Sprint or T-Mobile have similar programs, but the fact that the largest wireless carrier in the U.S. has fessed up and the second largest is, at the very least, testing a tracking program, is emblematic of the schism between consumer expectations of privacy and corporate definitions of it. [Wired]