Consumers can't see the supercookies Verizon and AT&T are baking into their networks, but advertisers can and are eagerly following the web trails left by the digital serial numbers.
Though called supercookies, the x-UIDH headers Verizon and AT&T are using to track users aren't technically a cookie. The tracker is included in an HTTP header called X-UIDH and is sent to every unencrypted website that is visited.
Like cookies, supercookies use encrypted sequences of numbers to identify users as they navigate between websites. Cookies enable web users to make changes to a web page, navigate away from the website and return to the site with many of the previous alterations still in place.
Unlike traditional cookies, supercookies aren't stored locally. Supercookies are tied to user accounts and are inserted at the network level, which is out of reach when users erase local browsing histories.
Even after users wipe mobile devices of local cookies, ad networks can attach a new supercookie to the individual accounts to chain together the erased data with new browsing information, according to the Electronic Frontier Foundation.
"Indeed, while we're concerned about Verizon's own use of the header, we're even more worried about what it allows others to find out about Verizon users," states the EFF's Jacob Hoffman-Andrews.
Beyond retaining persistent records of users' browsing activities, the nature of supercookies allows app activity into the mix. Apps that connect to the Internet are also given free supercookies.
Verizon has been using supercookies since 2012, but news of the wireless carrier's use of the tracking techniques has just now made it to the surface. It's "disconcerting" that this practice has just now come to light, as it has been going on for years, CNET editor Tim Stevens told CBS in an interview.
"Anyone on the web can look at these identifiers and do a reverse look-up and figure out who you are and where you've been going across the web," says Stevens.
Verizon is offering users the ability to opt-out of supercookie tracking, but the measure only covers the sharing of detailed information. The supercookie will remain, but Verizon promises it won't allow advertisers to harvest demographic information from subscribers who choose to opt out.
Less is known about AT&T's use of supercookies, though the wireless carrier has confirmed it is has been using x-UIDH tracking for some time. AT&T says it alters its supercookies every day to make it more difficult for advertisers to create extensive records of users, while Verizon won't disclose how frequently it refreshes is x-UIDH trackers.
While AT&T and Verizon are sharing subscribers' information with ad networks, the pair are also working together on an initiative to expand voice-over-LTE calling. The pair hope to link their LTE networks in 2015, so that each company's subscribers can place call VoLTE calls across the two networks.
