• by Wendy Davis , Staff Writer @wendyndavis, October 8, 2015

When Verizon announced in May that it was going to acquire AOL for $4.4 billion, consumer advocates warned that the deal raised "urgent privacy concerns."

Those concerns largely stemmed from Verizon's controversial use of "supercookies" for ad targeting. Last October, it emerged that Verizon Wireless was inserting its own tracking headers -- 50-character alphanumeric strings -- into unencrypted traffic on its network. Those headers enabled Verizon (and other companies) to track customers' Web activity, even if they attempted to avoid being tracked.

When the company first rolled out the system, users couldn't opt out of the header insertions. This January, faced with pressure by lawmakers, the company decided to allow customers to avoid having the headers injected into traffic.

But privacy advocates say that broadband providers shouldn't track users without their explicit consent.

Verizon tracks consumers' Web-surfing activity in order to decide which types of ads to send them. In the past, Verizon arranged to serve ads via partnerships with various ad tech companies -- one of which, Turn, is now facing litigation for allegedly leveraging the headers for its own behavioral advertising efforts.

This week, Verizon revised -- and narrowed -- the program. Now, the company says it will only send the header "to Verizon companies, including AOL, and to a select set of other companies that help Verizon provide services."

In practical terms, the revamp means that Verizon will no longer insert the tracking headers whenever customers' visit unencrypted sites, according to Nate Cardozo, an attorney with the digital rights group Electronic Frontier Foundation. Instead, the headers will be used on sites affiliated with AOL's ad network -- which reaches around 40% of the Web.

From a privacy viewpoint, that narrowing of the program marks a "significant positive development," Cardozo says.

But he adds that the EFF wants Verizon to still stop tracking users without their explicit permission. "From our perspective, Verizon should kill the program," says Cardozo. "Verizon is tampering with its customers' traffic without effective notice and choice."