No One Has Privacy Now, Thanks to Super Cookies

Our private information is being catalogued and used by government and private industry, both with and without our knowledge. There was no consequence, fine or penalty, for example, following the revelation late in 2011 that Carrier IQ collected massive amounts of data from millions of cell users. Why? Probably because cell users allowed that information to be collected.

Does anyone really think that we have any privacy? Probably not. Between GPS tracking and our favorite app, most of us gave up on privacy long ago.

Some privacy advocates claim that cell carriers have not been transparent about what personal data they have been gathering and using, although we now know that in order to use a cellular device, we must agree to Terms of Service and privacy policies that permit the cell carriers to obtain a great deal of information about us.

EFF: Verizon Has Gone Over the Edge

Verizon is “silently modifying its users’ Web traffic on its network to inject a cookie-like tracker … sent to every unencrypted website a Verizon customer visits from a mobile device,” according to Jacob Hoffman-Andrews, senior staff technologist at the Electronic Frontier Foundation.

Further, Verizon’s tracker “included in an HTTP header called ‘X-UIDH,'” he noted.

What about AT&T?

AT&T also is testing super cookies, noted Kashmir Hill, a senior editor at Forbes, although company spokesperson Mark Siegel said it had “nothing ready to announce.”

While there may have been nothing ready to announce, that does not mean AT&T is not using super cookies.

Kenneth White, one of the researchers who discovered the tracking, claimed to have found three identifying codes being sent by AT&T, according to Hill, contradicting the company’s claim that it was not using super cookies.

Hill quoted an AT&T statement:

AT&T does not currently have a mobile Relevant Advertising program. We are considering such a program, and any program we would offer would maintain our fundamental commitment to customer privacy … . For instance, we are testing a numeric code that changes every 24 hours on mobile devices to use in programs where we serve ads to the mobile device. This daily rotation on the numeric code would help protect the privacy of our customers. Customers also could opt out of any future AT&T program that might use this numeric code.
It is difficult to understand exactly how AT&T’s comments address White’s claims, and perhaps AT&T’s use of the term “relevant advertising” suggests something different from what the EFF has alleged Verizon is doing with super cookies.