Verizon altering web traffic, inserting a unique identifier allowing websites to track you, with no opt-out available
Verizon's ‘Perma-Cookie’ Is a Privacy-Killing Machine — Verizon Wireless has been subtly altering the web traffic of its wireless customers for the past two years …
Context & Ripple Effects
The perma-cookie is the sharpest escalation yet of a practice Verizon has been building since at least 2011, when a privacy alert flagged the carrier monitoring customers' mobile web habits. In April 2014 it went further with plans to pass desktop browsing data to mobile advertisers (Salon's report on desktop-to-mobile ad targeting). What changed today is the mechanism itself: rather than observing traffic, Verizon alters it, injecting a unique identifier (UIDH) into every unencrypted page request — and unlike a browser cookie, users cannot clear or refuse it.
Because the identifier rides at the network level, deleting cookies or using private browsing does nothing, which is why Wired calls it a 'perma-cookie.' The pickup across DSLreports, the Washington Post, and The Register shows how quickly the finding travelled once researchers surfaced it.
First-order effects
- Verizon Wireless subscribers are being tracked across every non-HTTPS site they visit without consent, with no opt-out mechanism available as of publication.
- Advertising networks gain a persistent device-level identifier that survives cookie deletion, making previously anonymous visitors re-identifiable.
Second-order effects
- Ad-tech platforms move fast to exploit the free identifier: within days, ProPublica reported that Twitter's MoPub exchange was already reading Verizon's UIDH from web requests.
- Rival carriers and publishers face scrutiny over whether they run similar header-injection schemes, since any network operator with the same access could replicate the technique.
Third-order effects
- Carrier-injected tracking proved politically untenable enough that by January 2015 Verizon conceded a complete opt-out (the supercookie opt-out reversal) — a template for how network-level surveillance gets regulated only after exposure.
- Once the identifier exists, carriers have an incentive to monetize it directly: Verizon ultimately fused its supercookie data with AOL's ad targeting (the AOL ad-network merger), pointing toward access providers competing in behavioral advertising rather than selling connectivity alone.
The trend: Wireless carriers are converting their position inside the traffic path into an advertising asset — injecting identifiers first, retreating to opt-outs when caught, then folding the data into owned ad networks.