Verizon Agrees To Notify Subscribers on 'Supercookies'

The FCC reached a settlement with Verizon Wireless resolving an Enforcement Bureau investigation into the carrier’s practice of inserting unique identifier headers (UIDHs), also known as supercookies, into its customers’ mobile Internet traffic without their knowledge or consent. Verizon agreed to notify consumers about its targeted advertising programs, obtain customers’ opt-in consent before sharing the supercookies with third parties and obtain customers’ opt-in or opt-out consent before sharing UIDHs within the Verizon corporate family, the agency said. Verizon Wireless also agreed to pay a fine of $1.35 million. Enforcement Bureau Chief Travis LeBlanc said Verizon cooperated with the investigation. “Consumers care about privacy and should have a say in how their personal information is used, especially when it comes to who knows what they’re doing online,” LeBlanc said in a Monday news release. “Privacy and innovation are not incompatible. This agreement shows that companies can offer meaningful transparency and consumer choice while at the same time continuing to innovate.” Senate Commerce Committee ranking member Bill Nelson, D-Fla., said he had asked the FCC to investigate (see 1502060039 and 1502060039). “This is a win for consumers that will hopefully make companies think twice before engaging in practices that violate consumer privacy,” he said in a statement. “Verizon gives customers choices about how we use their data, and we work hard to provide customers with clear, complete information to help them make decisions about our services," a company spokesman emailed. "Over the past year, we have made several changes to our advertising programs that have provided consumers with even more options. Today’s settlement with the FCC recognizes that. We will continue to give customers the information they need to decide what programs and services are right for them.” The bureau said it launched an investigation of the practice in December 2014. “The investigation sought to determine Verizon Wireless’s compliance with Section 222 of the Communications Act of 1934, as amended, and Section 8.3 of the Commission’s rules,” according to the consent decree. The bureau found that Verizon Wireless began inserting UIDH into consumers’ Internet traffic as early as December 2012, but didn't disclose it until October 2014. In March, Verizon updated its privacy policy to include notice of the use of supercookies, the agency said. “The Bureau’s investigation also found that at least one of Verizon Wireless’s advertising partners used UIDH for unauthorized purposes to circumvent consumers’ privacy choices by restoring deleted cookies.” "Recently, carriers and their anti-privacy supporters have claimed that FCC enforcement would hamper ISP ‘innovation,'" Public Knowledge Senior Vice President Harold Feld said in a news release. "The only ‘innovation’ this consent decree prevents is the ability of Verizon to collect information from customers without their knowledge, and to expose that information to third parties without customer consent. Customers that value Verizon’s targeted advertising can still participate, but Verizon can no longer force them to participate without informed consent.”