• by Wendy Davis  @wendyndavis, August 24, 2016

A federal appellate panel has directed ad company Turn to respond to arguments by two New York residents who want to proceed in court with a privacy lawsuit against the company.

The consumers, Anthony Henson and William Cintron, are seeking to vacate a trial judge's order sending the case to arbitration. They raised issues that "warrant an answer," a three-judge panel of the 9th Circuit Court of Appeals said Tuesday. The appellate panel gave Turn until Sept. 6 to respond.

The battle between the consumers and Turn dates to last year, when Henson and Cintron alleged in a potential class-action that Turn used a controversial tracking method. The technology, which relied on "supercookies," enabled Turn to track consumers for ad purposes even when people deleted their cookies.

The allegations centered on Verizon's decision to insert headers into all unencrypted mobile traffic. Those headers -- 50-character alphanumeric strings -- enabled ad companies to compile profiles of users and serve them targeted ads. The headers are known as “zombie” cookies, or "supercookies," because they allow ad companies to recreate cookies that users delete.

Turn asked for the case to be sent to arbitration on the grounds that the consumers' allegations were closely connected to their agreements with Verizon, and those subscriber agreements call for arbitration of all disputes.

U.S. District Court Judge Jeffrey White in the Northern District of California agreed with Turn. He sent the case to arbitration, ruling that questions raised by the matter "concern substantially interdependent and concerted conduct" between Turn and Verizon.

In June, lawyers for Henson and Cintron asked the 9th Circuit to order White to vacate that order. Among other arguments, the consumers say their arbitration agreements were with Verizon, not Turn.

They also argued that any agreements between Turn and Verizon "did not contemplate Turn secretly subverting users’ efforts to protect their privacy and security."

Verizon has used the headers since 2012 to track people's activity online and send them targeted ads, but didn't disclose their existence in its privacy policy until last year. The company always allowed people to opt out of receiving targeted ads powered by its own ad programs, but didn't initially allow them to avoid header insertions. Last year, Verizon changed its policies to allow people to opt out of the header injections. In October, Verizon again narrowed the program by deciding to only send the header to Verizon companies, including AOL.

In January of 2015, researcher Jonathan Mayer -- now with the FCC -- reported that the Turn was using Verizon's headers to collect data and send targeted ads to mobile users who delete their cookies.

Turn initially acknowledged that it used the headers for ad targeting and defended the practice, arguing that the company uses the “most stable identifier” possible.

Several days later, Turn said it had re-evaluated and would stop using Verizon's headers to target ads.

Turn consistently said it honors the industry's self-regulatory code and doesn't serve targeted ads to users if their cookies reveal that they opted out via links at sites operated by the self-regulatory groups Network Advertising Initiative or Digital Advertising Alliance.

But when people clear cookies -- often in order to protect their privacy -- they also delete the opt-out cookies installed by the DAA and NAI.

Turn also says it won't serve targeted ads to people who opt out via its own link, or Verizon's opt-out mechanism. (Verizon's mechanism can persist even when users delete their cookies, according to Turn.)

Earlier this year, the Federal Communications Commission fined Verizon $1.35 million to settle an investigation surrounding the header injections. The FCC's investigation focused on whether Verizon violated customers' privacy, and whether it violated a 2010 net neutrality rule requiring disclosure of broadband management practices.

The FCC is now considering whether to ban broadband providers from using persistent tracking mechanisms similar to Verizon's headers.