T-Mobile The Latest Snooping Company To Pretend 'Anonymized' Data Means Anything

from the not-so-'uncarrier' dept

As companies like Google shift away from individual behavior tracking in their ad efforts, telecoms like T-Mobile are headed in the opposite direction. The wireless giant this week announced it would be automatically enrolling all of its customers (including recently acquired Sprint customers) in a new behavioral tracking and ad system the company is launching on April 26. Whereas Google is shifting to its FLOC system that tends to clump consumers into groups of like minded consumers (an approach that still comes with its own issues), T-Mobile is doubling down on individualized targeting, and will start sharing its customers’ web and mobile-app data with advertisers.

While this sort of tracking is nothing new for AT&T and Verizon, it's a shift away from T-Mobile's more consumer friendly branding, and will be something new for recently acquired Sprint customers. Fortunately users can opt out of the tech, though that may not always mean what you think it does. AT&T, for example, has historically viewed "opting out" as meaning "we will no longer hit you with targeted ads based on your online data," not that they won't gather data whatsoever. Other times in telecom, opting out can easily be reverted to opting in without the consumer really knowing.

T-Mobile, like so many companies before it, tries a bit too hard to hide behind the claim that "anonymization" of individual user data makes collecting it ok, something that's been disproven by a repeated barrage of different studies. It only takes a small number of additional data points to quickly make users not so anonymous.

One investigation of "anonymized" user credit card data by MIT found that users could be correctly "de-anonymized" 90 percent of the time using just four relatively vague points of information. Another study looking at vehicle data found that 15 minutes’ worth of data from just brake pedal use could lead them to choose the right driver, out of 15 options, 90% of the time.

Despite this, companies continue to toss around the word "anonymization" as some kind of get out of jail free card, as if the terminology means anything. Case in point: T-Mobile's comments to the Wall Street Journal, which were thankfully quickly corrected by the EFF's Aaron Mackey:

"T-Mobile said it masks users’ identities to prevent advertisers and other companies from knowing what websites they visit or apps they have installed. The company tags the data with an encoded user or device ID to protect the customers’ anonymity.

But privacy groups say those IDs can be linked back to people by comparing different data sets.

“It’s hard to say with a straight face, ‘We’re not going to share your name with it,’ ” said Aaron Mackey, a lawyer for the San Francisco-based Electronic Frontier Foundation, a consumer-privacy advocate. “This type of data is very personal and revealing, and it’s trivial to link that deidentified info back to you."

T-Mobile's move comes in stark, opposite contrast to the shifting winds across the rest of the tech sector as America belatedly considers having a privacy law for the internet era. It also comes fresh off the telecom industry successfully convincing at least half of DC that "big tech" is the only sector worth thinking and worrying about, and "big telecom" is comprised of nothing less than a group of utterly innocent sweethearts.

Filed Under: ads, anonymized data, behavioral tracking, privacy, tracking
Companies: t-mobile

Verizon May Soon Get to Enjoy a Lawsuit Over Its Sneaky Use of Perma-Cookies

from the privacy-schmivacy dept

Over the last few years, Verizon has been ramping up its behavioral tracking efforts via programs like Verizon Selects and its Relevant Mobile Ad system, which track wireless and wireline subscriber web behavior to deliver tailored ads and sell your information to third parties. Unknown until a few weeks ago however was the fact that as part of this initiative, Verizon has started using what many are calling controversial "stealth," "super" or "perma" cookies that track a user's online behavior covertly, without users being able to disable them via browser settings.

Lawyer and Stanford computer scientist Jonathan Mayer offered up an excellent analysis noting that Verizon was actively modifying its users' traffic to embed a unique identifier traffic header, or X-UIDH. This header is then read by marketing partners (or hey, anybody, since it's stamped on all of your traffic) who can then build a handy profile of you. It's a rather ham-fisted approach, argues Mayer, who notes that while you can opt-out of Verizon selling your data, you can't opt out of having your traffic embedded with the unique identifier. He also offered up a handy graphic detailing precisely how these headers work:

As the story grew the last few weeks, ProPublica noted that Twitter's mobile advertising arm is already one of several clients using Verizon's "header enrichment" system, though Twitter didn't much want to talk about it. Several tools like this one have popped up since, allowing users to test their wireless connections (note it doesn't work if your cellular device is connected to Wi-Fi, and may be masked by the use of Google Mobile Chrome, Opera Mini, or if viewed through apps like Flipboard).

Kashmir Hill at Forbes also has a great article exploring the ramifications of the system and asked Verizon and AT&T (who has started trials of a similar system) what consumer protections are in place. Both companies proclaimed that the characters in their headers are rotated on a weekly and daily basis to protect user information. But as we've noted time and time again, there's really no such thing as an anonymized data set, and security consultant Ken White argues that only part of the data in the headers is modified, if at all:

"White has been tracked for the past 6 days across 550 miles with a persistent code from both Verizon and AT&T. He has a smartphone with Verizon service and a hotspot with AT&T service. In AT&T’s case, the code has four parts; only one part changes, he says. “It’s like if you were identified by a birth month, a birth year, a birth day, and a zip code, and they remove one of those things,” said White. You’d still be able to reasonably track that person with the other three. Verizon’s code meanwhile hasn’t changed for him, and it’s been almost a week."

Amusingly, I remember back in 2008 when concerns about deep packet inspection and behavioral ads were heating up, Verizon declared there really wasn't any need for consumer protections or privacy rules governing such technologies, because, the company claimed, public shame and the oodles of competition in the broadband space would somehow keep them honest:

"A couple of years back during the debate on net neutrality, I made the argument that industry leadership through some form of oversight/self-regulatory model, coupled with competition and the extensive oversight provided by literally hundreds of thousands of sophisticated online users would help ensure effective enforcement of good practices and protect consumers."

Yet here we have an example where the behavior Verizon was engaged in was so surreptitious, even some of the best networking and security experts in the business didn't notice Verizon was doing it until two years after the effort was launched. Apparently, holding Verizon accountable is going to take a little more than a public scolding in the town square. The EFF has stated they're taking a look at possible legal action against Verizon for violating consumer privacy law.

Filed Under: behavioral tracking, perma-cookies, spying, tracking
Companies: at&t, verizon