Last year privacy advocates discovered that Verizon has been inserting tracking codes into most of its mobile web traffic—so-called “zombie cookies.” Now the company plans to use those codes to target personalized ads served by AOL, which Verizon acquired earlier this year. But the company says it’s curbing the ability to use the codes beyond its corporate reach.

The company revealed its plans yesterday in a privacy notice spotted by non-profit news outfit ProPublica.

Typically, in order for a website to track its visitors it must leave a small file called a “cookie” on the user’s device. But cookies are tied to the user’s web browser. If they’re using a smartphone app instead of their web browser, it’s difficult to track that user. Plus users can block or delete these cookies.

To get around this, Verizon inserts a code called a Unique Identifier Header (UIDH) into all unencrypted traffic that flows through its networks by default. That code was useable by any website owner or advertising network to which a user connects. Verizon didn’t promote UIDHs as a tool for other companies to use, but ProPublica has identified at least one advertising company, called Turn, that took advantage of them.

Verizon now says it will soon stop inserting the unique identifier into all traffic, instead limiting its use to only Verizon-owned sites and the company’s partners, a company spokesperson told to WIRED today. “The UIDH will be sent only to Verizon companies, including AOL, and to a select set of other companies that help Verizon provide services,” Verizon’s chief privacy officer Karen Zacharia wrote in a blog post today. “These companies will not be allowed to use the UIDH for any purpose outside of providing the Verizon and AOL services.”

While non-Verizon-linked third-party companies will no longer have access to the identifiers, news that AOL will begin using them means that they’re not going away any time soon, and may even see more widespread use than before. AOL’s ads appear on many sites across the web, not just on sites owned by AOL, such as the Huffington Post. Whether those identifiers actually help AOL serve better performing ads than, say, Google remains to be seen, but the strategy is clear. By limiting which companies can access these unique identifiers, Verizon is giving itself and its partners an edge: No other company will be able to target ads to Verizon’s large base of mobile internet customers in quite the same way.

Not Just Dumb Pipes

We normally think of our Internet service providers as providing essentially dumb pipes that carry data back and forth without manipulating it. But as companies like Google and Facebook have minted fortunes off those pipes, ISPs are trying to find new ways to make money off the information that passes through their infrastructure. That’s why Verizon bought AOL in the first place, and it’s why it’s launching things like a new streaming video service. The question as to how and when an Internet service provider can use or manipulate the data it handles are only going to become more important as Google and Facebook become Internet service providers themselves through initiatives like Google Fiber and

Verizon promised earlier this year that it would allow customers to opt out of the tracking code program. Verizon customers can find more information about opting out here.

Go Back to Top. Skip To: Start of Article.


Verizon Curbs ‘Zombie Cookies,’ But They’ll Still Stalk You