Recent news reports about Verizon using a tracking number that broadcasts a Unique ID Header (UIDH) to track the internet activity of its subscribers may have been missed among election news, trailing Ebola coverage and other big tech stories. But it’s important to stop and take the time to understand what this somewhat generically-named tracker actually does. Fundamentally, I believe it breaches consumer trust and, because of its poor design, it seriously risks consumer data getting into the hands of bad actors.
For the last two years, Verizon has used this Unique ID to identify consumers and serve targeted advertising. While they do offer consumers a way to opt-out, nobody knew about it until press reports started covering it a few weeks ago. In fact, a Verizon executive vice president told a Senate Committee in 2008 that “Verizon believes that before a company captures certain Internet-usage data. it should obtain meaningful, affirmative consent from consumers.” Such practices go beyond lack of transparency and head into the realm of consumer deception.
On top of the lack of transparency, the Verizon program is poorly designed. That Unique ID can be used by random, unknown companies to track consumers across apps and websites. The Company claims they reset the ID periodically but they won’t say how often – again showing a propensity for lack of transparency. Even then, there are questions about whether resetting the ID really matters if companies can correlate all the data to a cookie.
In essence, the flawed opt-out removes any benefit of targeted ads while not addressing any of the privacy concerns. Verizon’s program seems sloppy and smacks of a “consumer comes last” mentality.
Think of that UIDH as much like a phone number assigned to a device. If a customer makes a phone call then the recipient of the call can see that phone number using Caller ID. Now imagine if the customer activated Caller ID Blocking. In response, Verizon promised not to use your number for marketing but still displayed the number. The consumer likely would feel betrayed. And an opaque promise that the number changes from time to time isn’t likely to provide much comfort.
Consumer trust is undermined with this kind of lack of transparency, minimalist effort to educate consumers and sloppy engineering. ISPs like Verizon and AT&T know all kinds of highly sensitive information about us: who we are, who we interact with, precise location, the apps and websites we use and visit. In light of this unique and protected relationship with consumers, we should hold them to a higher standard when it comes to how they identify us and how they broadcast that to the world.
