A very troubling recent ProPublica investigation found that Turn, an online advertising company is "using tracking cookies [i.e. "Zombie Cookies"] that come
back to life after Verizon [Wireless] users have deleted them." These revelations are very troubling and demonstrate why stronger privacy laws are needed and why state and federal regulators need to investigate and take action against those companies that abuse their access to our personal information.
According to ProPublica, "Some users try to block such tracking by turning off or deleting
cookies. But Turn says that when users clear their cookies, it does not
consider that a signal that users want to opt out from being tracked....Turn executives said the only way users can opt out is to install a Turn opt-out cookie
on their machine. That cookie is not designed to prevent Turn from
collecting data about a user - only to prevent Turn from showing
targeted ads to that user. ProPublica's tests showed that even Verizon users who installed the
Turn opt-out cookie continued to receive the Turn tracking cookie as
well. Turn said despite the appearance of the tracking cookie, it
continues to honor the opt-out cookie. Initially, Turn officials also told ProPublica that its zombie cookie
had a benefit for users: They said they were using the Verizon number
to keep track of people who installed the Turn opt-out cookie, so that
if they mistakenly deleted it, Turn could continue to honor their
decisions to opt out. But when ProPublica tested that claim on the industry's opt-out system,
we found that it did not show Verizon users as opted out. Turn
subsequently contacted us to say it had fixed what it said was a glitch,
but our tests did not show it had been fixed."
Within a couple of days of ProPublica's excellent investigation, Turn announced that it "would stop using tracking cookies [i.e. Zombie Cookies] that are impossible to delete." While this is a welcome development there are many questions left unanswered. For example:
How long was Turn using Zombie Cookies?
What information was Turn's Zombie Cookies collecting and how was it being utilized?
Will Turn permanently delete all the data its Zombie Cookies collected?
How can we verify that the Zombie Cookie program has been terminated?
How can Turn be trusted not to create similar programs that are as troubling as the Zombie Cookie?
Zombie and Super Cookies are not only a threat to our personal privacy, they are also a threat to our personal safety and may lead to hidden discrimination against people based upon their race, religion, sexual orientation, age, health, etc...
Last week, during President Obama's history making privacy speech at the FTC he stated, "[i]f we are going to be connected we need to be protected." Will Turn and its advertising clients change its practices and heed the President's call to better protect our privacy?
Copyright 2015 by Shear Law, LLC All rights reserved.
