Verizon's Mobile ‘Supercookies’ Seen as Threat to Privacy
For the last several months, cybersecurity experts have been warning Verizon Wireless that it was putting the privacy of its customers at risk. The computer codes the company uses to tag and follow its mobile subscribers around the web … Tweets: @robpegoraro and @juliaangwin Tweets: Rob Pegoraro / @robpegoraro : Touching mix of arrogance and naiveté by VzW: You can't opt out of our supercookie—but nobody would dare exploit it! http://www.nytimes.com/... Julia Angwin / @juliaangwin : Buried news in this NYT story: Verizon considering an opt out for customers tagged with undeletable tracking number http://www.nytimes.com/...
Context & Ripple Effects
This January 2015 report was the opening move of a six-year arc. Cybersecurity experts had spent months warning Verizon Wireless off tagging mobile subscribers with an undeletable identifier, and the paper's reporting — carried by Julia Angwin and Rob Pegoraro — flushed out a buried concession: Verizon was reportedly weighing an opt-out option, which became a complete opt-out within days.
What followed shows why the initial story mattered. The opt-out shipped in April, yet by October Verizon had merged the supercookie into AOL's ad network so advertisers could match browsing habits with personal details, and by 2016 its ad partner Turn was settling with the FTC for continuing to track consumers who had opted out.
First-order effects
- Verizon Wireless subscribers were being tagged by a persistent, non-deletable identifier that followed them around the web with no removal mechanism — exactly the exposure the warning experts had flagged for months.
- The reporting forced a fast policy reversal: within four days Verizon moved from defending the practice to committing to a complete opt-out, which went live for customers by April.
Second-order effects
- Rather than abandoning the identifier, Verizon folded it into AOL's ad network that October, turning a criticized tracking header into matching infrastructure that links online habits with personal details — the opt-out did not stop the commercial buildout.
- Partner-side misuse surfaced next: ad-tech firm Turn tracked consumers even after they opted out, forcing an FTC settlement that shifted enforcement burden onto partners while the carrier program itself continued.
Third-order effects
- By 2021 the pattern had generalized — Verizon, AT&T, and T-Mobile all ran programs collecting app usage and web history, generally opt-out only — indicating the supercookie episode normalized default-on carrier data collection industry-wide rather than ending it.
- Disclosure controls proved weaker than regulatory posture: coverage framing Verizon's expansion as riding an impotent FCC suggests the durable risk is that opt-out toggles substitute for consent rules, leaving carrier ad-tracking to scale whenever oversight recedes.
The trend: Carrier-grade tracking identifiers have evolved from hidden experiment to core mobile-advertising infrastructure, with opt-out-only data collection spreading across all three major US wireless carriers.