Attack of the Zombie Cookies: Verizon and a Turn for the Worse

In a number of columns last year, I called on the digital media industry to increase the level of transparency and choice for consumers in the digital marketplace, because I’m concerned about new ways in which companies are collecting data in a post-cookie world. This included Facebook’s collection and use of data through “Like” buttons across the Web, even when the user doesn’t interact with them.

Yesterday’s ProPublica’s article, “Zombie Cookie: The Tracking Cookie That You Can’t Kill,” tops all prior concerns. The article details how Verizon is bluntly broadcasting a unique ID from consumers’ phones, which Turn, a third-party data collector, then exploits in a variety of ways to make the consumer’s unique ID indestructible — even if they have explicitly requested not to be tracked. On top of that, Verizon’s publishing of that broadcast ID fuels sharing of data across a number of third parties through “cookie-syncing.”

In the article, computer scientist and Stanford lawyer Jonathan Mayer deftly breaks down how it’s done. In essence, Turn identifies consumers using Verizon’s Unique ID Header (UIDH) and then regenerates cookies that the consumer had previously deleted. Once the cookies are regenerated, Turn can continue tracking the consumer, building a profile, serving targeted advertising and sharing the ID with other third parties.

There is no transparency for consumers about this practice. Turn doesn’t even discuss in its privacy policy these “zombie cookies” that spawn back to life. And Verizon only recently even disclosed that they broadcast a UIDH (much less this practice), although the article quotes a spokeswoman saying they are “reviewing the information you shared and will evaluate and take appropriate measures to address.”

Clearly there’s no actual “choice” for consumers in this scenario, particularly because the odds of them being aware of Turn — much less “zombie cookies” — are next to none. Opting out requires a consumer to go to Turn’s website, where an opt-out cookie is dropped on their device. Ironically, when Turn regenerates cookies on a consumer device, reportedly they don’t regenerate the opt-out cookie.

Verizon claims that it and its advertising partners (one of which is Turn) don’t use the UIDH to track consumers who have opted out. But according to the research, Verizon continues to broadcast the UIHD to the world, they just promise not to use it. Not sure that promise carries much weight, given the lack of transparency. And worse, it’s still there for anyone to see and use.

This kind of surreptitious behavior does nothing to build trust between consumers, advertisers and publishers, and this trust is what’s needed for fostering clean and safe environments that, ultimately, fund the content of the future. It’s long past time for all industry players to honor Do Not Track signals, which would give consumers a robust, effective and simple way to opt out of tracking.

Jason Kint is the CEO of Digital Content Next, a trade association that exclusively serves the diverse needs of digital content companies that manage direct, trusted relationships with consumers and marketers. A 20-year veteran of the digital media industry, he previously led the evolution of CBS Sports into a multi-platform brand offering premier broadcast, online and mobile sports content as SVP and General Manager of CBS Interactive’s Sports Division. Reach him @jason_kint.

This article originally appeared on Recode.net.