We've noted how AT&T and Verizon investors and executives have been terrified for some time that they would have to (gasp) compete on price as T-Mobile continues to disrupt the market with its consumer-friendly, faux-punk rock behavior. Ever since the AT&T deal was blocked by regulators, T-Mobile has been mercilessly (but entertainingly) mocking both companies, offering a bevy of promotions while eliminating a lot of "pain points" for consumers (like overage fees). It's working: T-Mobile's now signing up more subscribers each quarter than Sprint, AT&T or Verizon -- just by treating consumers well.
So far, outside of a few very time-limited promotions, Verizon's been unwilling to compete on price, insisting the company's high prices are justified by a "premium network experience." Verizon also recently tried to shoot down the appeal of T-Mobile's unlimited data offerings by insisting that nobody really wants unlimited data plans, they're just being driven by "gut feelings." With T-Mobile just having one of its most successful quarters ever, Verizon's increasingly under pressure to compete on price, yet the telco continues to proclaim it doesn't have to:
The company reported on Tuesday that it had lost 138,000 postpaid customers in the last three months. Francis Shammo, Verizon’s chief financial officer, apparently won't be missing customers who, he says, value price over quality. "If the customer who is just price-sensitive and does not care about the quality of the network—or is sufficient with just paying a lower price—that’s probably the customer we’re not going to be able to keep," he said in the company’s quarterly earnings call."
It shows you just what kind of competition Verizon's historically used to if the company honestly believes you have a choice of when you get to compete on price. And while the company is busy telling investors that it's not feeling any heat from T-Mobile, the growing, magenta-hued (TM) threat has Verizon simultaneously testing a number of new price promotions it hopes will help tip the subscriber scales back in its favor. Smelling blood, T-Mobile this week launched a new promotion that specifically takes aim at these "price sensitive" customers Verizon apparently doesn't want any more:
Of course Verizon's not entirely wrong. The company does come in first place pretty consistently in most customer service and network performance studies. Verizon's also well aware it enjoys an 80+% retail market share with AT&T, and an 85% market share of the special access (cell tower backhaul) market. The two companies also enjoy an estimated $171 billion in combined spectrum holdings, which certainly helps keep other competitors from market. Still, this belief that the company doesn't have to compete on price in the face of increased price competition seems like a pipe dream narrative they'll only be able to push for so long, especially if Sprint can manage to get out of its own way, fix its lagging network, and become a viable fourth wireless competitor.
Having written about the FCC for most of my adult life, I've grown cynically accustomed to an agency that pays empty lip service to things like consumer welfare and the painful lack of broadband competition. It doesn't matter which party is in power; the FCC has, by and large, spent the lion's share of an entire generation ignoring last mile competitive problems and the resulting symptoms of that greater disease. When the agency could be bothered to actually address these issues, the policies were so tainted by the fear of upsetting campaign contributors (read: regulatory capture) they were often worse than doing nothing at all (see our $300 million broadband map that hallucinates speeds and ignores prices or 2010's loophole-filled net neutrality rules co-crafted by Verizon and Google).
Whether it was former FCC boss turned cable lobbyist Michael Powell's claims that massively deregulating the sector would magically result in telecom Utopia (tip: that didn't happen) or Julius Genachowski being utterly terrified of taking any meaningful stand whatsoever, the broadband industry has spent decades governed by an agency that, at its best, is too timid to do its job, and, at its worst, is an obvious revolving-door lap dog to an industry it's supposed to regulate.
So in 2013 when it was announced that a former lobbyist for both the wireless and cable industries would be the next FCC boss, the collective, audible sighs of disgust unsurprisingly rattled the Internet. I, like many others, believed we were bearing witness to a twisted culmination of decades of regulatory capture, a giant, living, breathing middle finger to a public hungry for a more consumer and innovator-friendly FCC. John Oliver even put Wheeler's name in lights when he infamously compared hiring the former cable lobbyist to employing a dingo as a babysitter:
Most people (with a few notable industry exceptions) believed Wheeler was the final nail in a grotesque, campaign-cash stuffed telecom coffin long under construction. We were painfully, ridiculously wrong.
In fact, if you read profiles on Wheeler, he's turned out to be a complete 180 from the thinking of a traditional revolving-door regulator, basing his decisions on all available information -- even if that data conflicts with previously-held beliefs (a unique alien indeed in 2015). And while it's true that massive grass roots advocacy helped shift Wheeler's thinking on issues like Title II, his embrace of issues like municipal broadband required little to no shoving, since the lion's share of the public had no idea the issue existed. One of the biggest reasons Wheeler's willing to stand up to the broadband industry? He's 69, and no longer biting his tongue and biding his time for the next cushy lobbyist or think tank gig. Perhaps we should make a rule that all future FCC bosses must be on the brink of retirement to avoid what we'll henceforth call Michael Powell syndrome.
Still, watching Wheeler fills me with cognitive dissonance, as if my frequently-disappointed brain isn't quite sure what to do with an FCC Commissioner capable of objective thought free of AT&T, Comcast and Verizon lobbyist detritus. As a sure sign of the looming apocalypse, last week I watched an FCC Commissioner issue a statement about protecting competition -- and actually mean it:
"Comcast and Time Warner Cable’s decision to end Comcast’s proposed acquisition of Time Warner Cable is in the best interests of consumers. The proposed transaction would have created a company with the most broadband and video subscribers in the nation alongside the ownership of significant programming interests. Today, an online video market is emerging that offers new business models and greater consumer choice. The proposed merger would have posed an unacceptable risk to competition and innovation especially given the growing importance of high-speed broadband to online video and innovative new services."
Though his tenure's unfinished, it may not be a stretch to say that a man most of us believed would be the epitome of revolving door dysfunction has proven to be one of the most consumer- and startup-friendly FCC Commissioners in the agency's history. Granted that may not be saying much; caring more about consumers than Martin, Powell and Genachowski is like getting an award for beating a handful of lobotomized ducklings at a hundred yard dash. And none of this is to classify Wheeler as a saint -- the agency's net neutrality rules have some very concerning loopholes and the FCC still refuses to talk much about pricing, whether that's the problems inherent in usage caps, unreliable meters, or sneaky below the line fees.
Still, it's a lesson learned in letting your mind run on cynicism autopilot, and it's a reminder that even our very broken, campaign-cashed soaked government can still occasionally manage to give birth to consumer-friendly policies. So in short, the tl;dr version is this: I apologize to you, Tom Wheeler, for believing you were a mindless cable shill. I was wrong.
from the these-are-not-the-droids-you're-looking-for dept
As we've made repeatedly clear, consumers really like the ease and simplicity of unlimited data plans. Whether that's on fixed-line or wireless networks, users don't really like having to guess if they'll make it in under the wire this month, and don't particularly enjoy being socked with $15 per gigabyte overages should they stream a few extra songs or watch a YouTube clip. However, when you enjoy the kind of regulatory and market power AT&T and Verizon do, you don't have to give a flying cellular damn what your consumers actually want.
As such, both companies decided to eliminate their unlimited data plans entirely a few years ago, replacing them with shared data plans laden with caps and steep overages. And while both companies did grandfather existing unlimited users, they made life as uncomfortable as possible for those users, whether it was by secretly throttling them after a few gigabytes of usage or restricting their access to specific apps unless they "upgraded" to a shared, metered plan. Meanwhile, competitors T-Mobile and Sprint have tried to differentiate themselves by continuing to offer unlimited data options.
Continuing the proud tradition of telling users what they want instead of giving them what they want, Verizon this week offered up an amusing blog post in which an analyst paints unlimited data plans as a public menace of the highest order. To hear analyst Jack Gold tell it, we should all agree that you can't have unlimited data plans, because they'll obliterate the network and leave us all weeping over our smart devices:
"The quality of connection is important to wireless users, and when connections become slow or disconnections occur due to overcrowding, users become disappointed. Let’s face it, if everyone had unlimited data and used it fully, the performance of the networks would suffer because of bandwidth restrictions and the “shared resource” nature of wireless. The bottom line is: users agree that degrading the networks is something that they don’t want to happen."
If I only had a nickel every time the congestion bogeyman was trotted out to defend anti-competitive pricing and policies. While spectrum is certainly a finite resource, Gold intentionally ignores the fact that offering unlimited data plans doesn't mean idiotically ignoring all network management and letting your network implode. While both Sprint and T-Mobile offer unlimited data, they still implement network management and throttling practices that ensure traffic loads remain relatively balanced and the consumer experience remains consistent.
In other words, most unlimited data plans aren't really unlimited anyway, or users have to pay a steep premium for the privilege of not having to worry about data thresholds. That's because AT&T and Verizon dominate 85% of the special access and cell tower backhaul market, resulting in Sprint and T-Mobile (and most everybody else) having to pay an arm and a leg too. It's all quite by design.
Gold knows this, but it's apparently much more fun to try and argue that unlimited data plans decimate the fabric of the space-time continuum and rip the very axle of the universe from its foundation. Disagree? Verizon's analyst proceeds to imply you're simply being overly emotional:
"So, while unlimited data may sound attractive, there is no practical effect of data limits on the majority of users. Understanding this should bring rationality to a discussion that is often held on a “gut feeling” level. Keeping adequate speed and performance while allowing all users to share the limited commodity we call wireless data is the fair way to deal with wireless connectivity. And ultimately, that is what is beneficial for wireless consumers."
Just so it's clear, it's "rational" to support Verizon's vision of internet pricing, in which you pay some of the highest prices among developed nations, but it's a "gut feeling" should you start to desire a better value plan. It's never quite clear to me who these telecom blog authors actually think they're speaking to. Surely the goal is to influence an overarching policy discussion, but all they generally wind up doing is having their brand mocked mercilessly by news outlets for being painfully out of touch with what consumers actually want.
Back in 2008, Verizon proclaimed that we didn't need additional consumer privacy protections (or opt in requirements, or net neutrality rules) because consumers would keep the company honest. "The extensive oversight provided by literally hundreds of thousands of sophisticated online users would help ensure effective enforcement of good practices and protect consumers," Verizon said at the time. Six years later and Verizon found itself at the heart of a massive privacy scandal after it began covertly injecting unique user-tracking headers into wireless data packets.
The headers not only allow Verizon to ignore browser privacy settings to track online behavior, it allows third parties to do so as well (something Verizon initially denied). Worse, perhaps, while users could opt out of the personalized ads delivered by the system, they couldn't actually opt out of having their online behavior tracked. Initially, Verizon responded to the controversy by repeatedly downplaying it, but as it became clear regulators and lawyers were contemplating action, Verizon stated in February that it would finally let users opt out.
As of last week, Verizon's mobile advertising FAQ now states that users can choose whether they want to let Verizon manipulate their traffic and spy on them:
"Verizon Wireless has updated its systems so that we will stop inserting the UIDH after a customer opts out of the Relevant Mobile Advertising program or activates a line that is ineligible for the advertising program. Government and enterprise lines are examples of ineligible lines. The UIDH will still appear for a short period of time after a customer opts out of the Relevant Mobile Advertising program or activates an ineligible line. If a customer chooses to participate in Verizon Selects, the UIDH will be present even if the customer has also opted out of the RMA program."
Users can either opt out of the company's snoopvertising via the privacy settings at the Verizon website, or by calling 866-211-0874.
So was Verizon right in that the public would keep the company honest? While that did ultimately happen here, it's worth noting that it took the nation's best security researchers two years to even notice that Verizon was embedding the headers. It took Verizon another six months (and a pretty merciless and sustained beating from the media and privacy advocates) before it finally allowed users to opt out of the traffic manipulation. And, while groups like the EFF would prefer the system be opt in, this is likely where Verizon's latest privacy scandal gets put to bed.
It makes you wonder just how long it will take the public to discover Verizon's next great innovation in snoopvertising?
One of the very first things new FCC boss Tom Wheeler did when he entered office was to get wireless carriers to agree to a list of voluntary cell phone unlocking guidelines. The six "demands" are largely common sense and uncontroversial, and include requiring that carriers offer unlocked devices to active overseas service members, make their postpaid and prepaid unlocking policies as clear as possible, respond to unlocking requests within two business days, and automatically notify customers when their contract period ends and their phone can be unlocked.
I'd heard that carrier lobbyists balked at this last request fearing it would "advertise" unlocking, but ultimately acquiesced out of fear of tougher, non-voluntary rules coming down the pike. Note this is entirely separate from the fight over keeping cell phone unlocking legal and the need for DMCA exemption process reform. The rules also don't require that carriers simply sell unlocked phones outright, since that would probably make a little too much sense. After agreeing to the rules, carriers had more than a year to adhere to all six requirements, and the final deadline arrived last Wednesday.
Interestingly it's Verizon and AT&T, arguably the worst of the major carriers when it comes to attempts to stifle openness over the years, that come out ahead in adhering to all six guidelines (though your mileage may vary, and since the rules don't require much, this may not mean much). For Verizon, that's in part thanks to the Carterfone conditions placed on its 700 MHz spectrum, though that hasn't stopped the company from fighting openness in general tooth and nail in other ways. As I've noted previously the conditions have plenty of loopholes -- and anti-competitive behavior is allowed just as long as companies ambiguously insist that what they're doing (like blocking Google Wallet, or locking bootloaders) is for the "safety and security of the network."
Similarly interesting is the fact that T-Mobile, despite a recent reputation for being a fierce consumer advocate, sits right alongside Sprint when it comes to failing to adhere to the fairly simple requirements after a year's head start. Khanifar notes T-Mobile saddles prepaid and postpaid users with a number of strange restrictions, including the fact that users can't unlock more than 2 devices per line of service in a 12 month period. Between this, the company's opposition to Title II and its failure to understand the problems with zero rated apps, T-Mobile's showing it still needs to actually earn that ultra-consumer-friendly reputation.
Khanifar proceeds to note that despite carrier struggles this is at least a step in the right direction, even if we still need DCMA reform to ensure unlocking remains perfectly legal. That said, he quite justly highlights how cell locking no longer makes any coherent sense, for anybody:
"It's worth taking a step back and examining the absurdity of these locks. If you've paid for your AT&T phone, committed to a 2-year contract, and agreed to an "early termination fee," what purpose does a lock really serve? If you've paid cash to purchase a prepaid device, why should it come locked to just one carrier? There's plenty of evidence that locks serve little real commercial purpose. Verizon's business hasn't suffered since they stopped locking their phones. Countries like China and Israel have made locking devices outright illegal with no harm to their wireless industries and plenty of gain for consumers. But unfortunately it's unlikely that Congress or the FCC will take action to implement a similar policy here in the US."
Of course unlocked, open devices widens the competitive door, and with the kind of lobbying power AT&T, Verizon and the entertainment industry wield over Congress, getting real DMCA reform or mandated unlock-at-sale rules in play will likely be nothing short of a miracle.
If you recall, the wireless industry has spent much of the last decade proclaiming that a "spectrum crunch" was afoot, declaring that unless the government did exactly as requested, wireless growth and innovation would grind to a halt. AT&T was quick to claim that it needed to buy T-Mobile because of said spectrum crunch, though the company's own leaked documents highlighted that this simply wasn't true (this hubris being a big reason the deal was rejected). Verizon has also spent years crying spectrum poverty when convenient, despite repeated analysis showing its holdings lead the industry.
Yes, there is finite spectrum, but as with all network capacity constraints this has increasingly been mitigated by Wi-Fi offloading, new technologies and smart engineering (not to mention unlicensed options and technologies we haven't even conceived yet). If there is a "spectrum crunch," it's predominantly among smaller competitors that lack the resources to buy huge swaths of spectrum, or the political power to get regulators to tilt the entire playing field (and spectrum auction process) in their direction. Of course, both AT&T and Verizon have breathlessly and repeatedly denied that they warehouse extra spectrum to help keep would-be competitors at bay.
After years of warning of spectrum armageddon, Verizon's again making it clear that the entire spectrum crisis was contrived nonsense. After nabbing another $10.4 billion at the recent AWS-3 auction, Verizon CTO Tony Melone this week stated that despite years of claiming spectrum poverty, Verizon never really felt pressured to buy such a huge swath of spectrum:
"In a conference call with investors, Tony Melone, Verizon Communications' executive vice president of network, said that "entering the auction there was no markets where we felt compelled to acquire spectrum, irrespective of the price." Verizon did not feel pressure to aggressively bid for spectrum because it already had at least 40 MHz of AWS-1 spectrum in many U.S. markets, especially in the eastern United States, Melone said."
It's always kind of amusing when the network guys forget to adhere to narratives set by the policy folks (like the Verizon CFO's recent slip up in admitting Title II isn't a big deal). But Melone's comments are a far cry from claims made by Verizon's policy blog just a few years ago, when the company was trying to get regulatory approval for a huge co-marketing deal with the cable industry:
"Rather than waste time arguing about spectrum efficiency, let’s focus on the issue on which we all agree: America’s wireless consumers face a spectrum crunch that won’t be relieved by Verizon’s spectrum purchase. It’s up to the industry, as well as policymakers, to help ensure that more spectrum reaches the marketplace soon, so America’s wireless industry remains the global leader in innovation that it is today."
Said spectrum crisis seems to materialize out of thin air when Verizon needs something, then just as quickly disappears when the company candidly decides to talk about its holdings. Of course, Verizon gets away with this kind of stuff, in part, because the tech press (with the occasional exception) loves to regurgitate company claims unskeptically. And if you've been paying attention, you'll note that congestion has long been a useful bogeyman to scare regulators into bending rules to the benefit of the biggest, least competitive companies. Remember the Exaflood? How about usage caps? Does anybody notice a pattern?
With Verizon's bloated belly full from the recent AWS-3 spectrum purchases, and new technologies constantly evolving to more than meet mobile network demands, that should be the last we hear about Verizon's spectrum shortfall for a long while, right? Of course not. The big telco threat these days is that if the government imposes tough net neutrality protections, we'll see a dramatic decrease in innovation and network investment leading to (you guessed it) network performance and capacity issues (though we've illustrated how these claims too are bunk).
You'd think we'd reach a point, after so many years of false claims, where the press would no longer just take the claims of lumbering, bloated duopolists at face value. If there's a crisis, it remains a crisis of critical thinking.
from the that-only-took-two-years-and-four-months dept
It took a while, but Verizon appears to finally have gotten the message that consumers don't like companies fiddling with their traffic and ignoring all of their privacy preferences (weird, right?). The wireless carrier has taken heat for several months now for its practicing of embedding all wireless user traffic with a unique identifier traffic header (or UIDH). That header was intended to help Verizon track user online behavior via its own programs, but because it's transmitted for everyone to see, the potential for abuse was high and -- despite Verizon's claims to the contrary -- it pretty quickly wound up being abused.
One of the biggest problems with the program (aside from modifying user traffic to begin with) was that if a user opted out of Verizon's program, they were only able to opt out of personalized ad delivery -- not the embedding of the UIDH. After months of staying largely mute on the subject, Verizon has issued a statement saying that its opt-out service will actually work -- sometime "soon":
"Verizon takes customer privacy seriously and it is a central consideration as we develop new products and services. As the mobile advertising ecosystem evolves, and our advertising business grows, delivering solutions with best-in-class privacy protections remains our focus.
We listen to our customers and provide them the ability to opt out of our advertising programs. We have begun working to expand the opt-out to include the identifier referred to as the UIDH, and expect that to be available soon. As a reminder, Verizon never shares customer information with third parties as part of our advertising programs."
Again, you're not "taking customer privacy seriously" when you develop and use a system that not only makes all of their privacy choices completely irrelevant, but broadcasts their online behavior for any unethical nitwit to abuse. That would, by fairly strict definition, be not taking consumer privacy seriously.
While not engaging in this practice at all (or requiring that users opt in) would be a preferred solution, functional opt out would at least be an improvement, though it still raises questions about what kind of privacy protections need to be in place to prevent us from playing Whac-a-Mole with an endless parade of bad ideas just like this one. Back in 2008, Verizon stated that the wireless industry didn't really need consumer privacy protections because public shame would keep them honest; though it's worth repeating that this program was in play for two years before security researchers even noticed it. It stumbled forth another four months before Verizon finally stated it would do something about it -- eventually.
Verizon's decision came a day after the company received a letter from the Committee on Commerce, Science and Transportation asking for more details on the program. So while the company's hoping to avoid tougher consumer protections (like oh, any location data privacy protections whatsoever or Title II), it's once again proving quite clearly why we actually need someone guarding the privacy henhouse with notably sharper teeth.
You'll recall that the CTIA recently argued that the wireless industry doesn't need to be governed by net neutrality rules (or any rules, really) because it's a sector that's just so gosh-darned competitive. And while it's true T-Mobile has been shaking things up of late (thanks in part to regulators blocking the AT&T acquisition), the market's big four players continue to make it clear that once you dig past a number of largely cosmetic promotions, the sector still isn't really all that competitive. That's especially true when it comes to seriously competing on price, something all four major carriers repeatedly make clear they intend to avoid at any cost.
Case in point is T-Mobile's latest effort to offer rollover data, or letting users store unused bits and bytes at the end of the month for future use. I already noted how AT&T's competitive response to this was to offer a rollover service of its own that's largely a joke; rolled over data allotments only having a shelf life of one month, and that data being unusable until you finish your normal data allotment. Yet that's better than Verizon Wireless, which responded to the growing trend toward rollover data by refusing to participate entirely:
"We're a leader, not a follower," (Verizon CFO Fran Shammo) said in an interview on Thursday..."We did not go to places where we did not financially want to go to save a customer," Shammo said. "And there's going to be certain customers who leave us for price, and we are just not going to compete with that because it doesn't make financial sense for us to do that."
Of course, when a market is truly competitive, you're not supposed to have a choice in the matter. While Verizon pretends it doesn't compete on price because it offers a "premium experience," the reality is Verizon doesn't compete on price because it has used regulatory capture to build a market that ensures it never has to. The result is a Verizon-AT&T duopoly that owns most of the nation's spectrum, dominates 80% of the retail market, and enjoys a stranglehold on the special access (fiber backhaul) market. As a result, Sprint's been barely hanging on for years, and T-Mobile's owner Deutsche Telekom isn't sure T-Mobile can survive long-term. What the media calls a "price war" is more like a "light price scuffle."
It's something worth remembering the next time someone (usually a wireless industry lobbyist) tries to tell you the wireless industry is ultra-competitive (or doesn't need net neutrality protections) simply because there are four companies in play. What we usually see, with the occasional exception, is a pantomime of real competition. In this case, Verizon can't even be bothered to go that far.
from the we-love-privacy-so-much-we're-killing-it dept
Last week we noted how an ad clearinghouse company by the name of Turn was found to be abusing Verizon's sneaky new stealth cookie, just a few months after Verizon claimed their new technology couldn't be abused by third parties. Verizon's basically modifying wireless user traffic streams and injecting a unique identifier traffic header, or UIDH. This header allows Verizon (and any third-party website that uses it) to track, collect and broadcast your online behaviors regardless of browser settings, and while Verizon's opt-out preferences opt you out of behavioral ads, they don't stop Verizon from fiddling with your traffic.
A great investigation by ProPublica found that Turn had been using Verizon's header for some time to re-enable cookie tracking, and that Turn's opt-out functionality didn't work either (despite repeated claims that it did). Turn initially penned a blog post that tried to downplay the story by claiming it was "disappointed" in ProPublica for failing to "educate the public." With that clearly not working, Turn has now posted a second blog entry that states it's suspending the program for "re-evaluation." As with so many PR responses, Turn just can't help itself when it comes to insisting this is still largely a matter of ProPublica being misleading and the public being confused:
"We appreciate the opportunity that Ms. Angwin provided us to discuss the method prior to publishing her and Mr. Migas’s story. While we were disappointed with certain inaccuracies in the story and missed opportunities to further educate the public, we value the work that ProPublica is doing to bring attention to the broad issues of data privacy. Had Mr. Mayer offered us the same opportunity, we could also have helped to address some of the inaccuracies and misconceptions evident in his piece. I’m a strong believer in the power of direct dialogue and I have reached out to Mr. Mayer so that it can begin."
In other words, we're so in love with consumer privacy we've been helping pioneer a technology that helps make consumer privacy choices entirely moot! Verizon meanwhile continues to happily modify user traffic, and when the company can be bothered to address concerns about the program, it largely tries to lay the blame at the foot of other companies for using Verizon's technology. Verizon's program FAQ, for example, implies that everything would be fine if companies would just use Verizon's UIDH header as it intended:
"Recent news reports have raised concerns about how TURN is using the UIDH for purposes outside of Verizon's advertising programs. TURN has announced its intent to discontinue this practice and we will work with other partners to ensure that their use of UIDHs is consistent with the purposes we intended."
Of course Turn is just one company, and since the UIDH is broadcast to every site and service a Verizon Wireless user visits, there will soon be a large number of other companies (many impervious to public outrage) joining the party. The EFF continues to urge Verizon to shutter the program, and Verizon pretty clearly continues to not give a damn.
from the your-privacy-preferences-now-mean-absolutely-nothing dept
A few months ago, we noted how Verizon and AT&T were at the bleeding edge of the use of new "stealth" supercookies that can track a subscriber's web activity and location, and can't be disabled via browser settings. Despite having been doing this for two years, security researchers only just noticed that Verizon was actively modifying its wireless users' traffic to embed a unique identifier traffic header, or X-UIDH. This identifier effectively broadcasts user details to any website they visit, and the opt-out settings for the technology only stopped users from receiving customized ads -- not the traffic modification and tracking.
AT&T responded to the fracas by claiming it was only conducting a trial, one AT&T has since claimed to have terminated. Verizon responded by insisting that the unique identifier was rotated on a weekly basis (something researchers found wasn't true) and that the data was perfectly anonymous (though as we've long noted anonymous data sets are never really anonymous). While security researchers noted that third-party websites could use this identifier to build profiles without their consent, Verizon's website insisted that "it is unlikely that sites and ad entities will attempt to build customer profiles" using these identifiers.
As such, you'll surely be shocked to learn that sites and ad entities are building customer profiles using these identifiers.
Not only that, they're using the system to resurrect deleted tracking cookies and share them with advertising partners, making consumer opt-out preferences moot. According to security researcher Jonathan Mayer (and tested and confirmed by ProPublica), an online advertising clearinghouse by the name of Turn has been using Verizon's modifications when auctioning ad placement to websites like Google, Facebook and Yahoo for some time. When asked, Verizon pretends this is news to the company:
"When asked about Turn's use of the Verizon number to respawn tracking cookies, a Verizon spokeswoman said, "We're reviewing the information you shared and will evaluate and take appropriate measures to address." Turn privacy officer Ochoa said that his company had conversations with Verizon about Turn's use of the Verizon tracking number and said "they were quite satisfied."
Like Verizon's implementation of the program, Turn lets users opt out of receiving targeted ads, but users have no way of really opting out of being tracked or having their packets manipulated without prior consent. As the EFF notes, your only option is to use a VPN for all your traffic, or to use a browser add-on like AdBlock, which doesn't fully address the issues with the use of a UIDH header. Amusingly, Turn tries to claim to ProPublica that it's actually using Verizon's UIDH to respect user behavioral ad opt out preferences, but the website found that repeatedly wasn't working:
"Initially, Turn officials also told ProPublica that its zombie cookie had a benefit for users: They said they were using the Verizon number to keep track of people who installed the Turn opt-out cookie, so that if they mistakenly deleted it, Turn could continue to honor their decisions to opt out. But when ProPublica tested that claim on the industry's opt-out system, we found that it did not show Verizon users as opted out. Turn subsequently contacted us to say it had fixed what it said was a glitch, but our tests did not show it had been fixed."
Even if Turn's being honest, there are plenty of companies that aren't going to bother being ethical. Verizon, which in 2008 insisted that consumer privacy protections weren't necessary because public shame would keep them honest, pretty clearly isn't interested in stopping the practice without legal or regulatory intervention. So yeah, again, we've got a new type of supercookie that tracks everything you do, can't be opted out of, and is turning consumer privacy completely on its ear, but there's absolutely nothing here you need to worry your pretty little head about.