Commentary

Turn Faces Skeptical Judges In Battle Over Zombie Cookies

Ad company Turn was met with a skeptical reception today in court, where the company argued that wireless users don't have the right to pursue a privacy lawsuit centering on allegations that it used "zombie" cookies for tracking.

Turn allegedly tracked Verizon wireless users via "headers" -- 50-character alphanumeric strings, called X-UIDHs -- that Verizon injected into all unencrypted mobile traffic. Those headers enabled ad companies to compile profiles of users and serve them targeted ads. The X-UIDHs also are known as “zombie” cookies, or "supercookies," because they allow ad companies to recreate cookies that users delete.

Turn, which recently settled Federal Trade Commission charges related to the headers, also was sued in federal court by two users who sought to bring a class-action against the company.

The company convinced a trial judge to send the matter to arbitration on the grounds that Verizon's contracts with users require arbitration of disputes. Turn argued that the users were bound by the arbitration clauses in their contracts with the users.

Lawyers for the consumers then asked the 9th Circuit to reverse that move, arguing that their contracts were with Verizon, not Turn.

Three appellate judges heard the dispute today and their questions suggested they were troubled by the trial judge's decision.

"It strikes me that the district court did err," Circuit Judge William Fletcher told Turn's attorney.

Fletcher suggested during the hearing that Turn could only rely on Verizon's agreement with the customers if Turn provided them with a benefit related to that agreement.

"What benefit are they getting from you?" Fletcher asked Turn's lawyer.

The attorney, Michael Rubin of Wilson Sonsini, said the customers received phone service and ads.

"It's not a benefit at all," Fletcher said, referring to the customers' feelings about the targeted ads. "They hate it. they don't want it."

Another judge on today's panel, Roslyn Silver, noted that Verizon's privacy policy didn't mention Turn. Verizon's current privacy policy includes the following language: "Some advertisements are chosen by companies that operate on our sites and other sites (for example, ad servers, ad networks, or technology platforms) to place ads on behalf of advertisers."

Silver quoted from that policy, and then asked Turn's lawyer how users could be expected to know that Turn would use zombie cookies to determine which ads to show.

At the same time, the appellate panel also questioned the consumers' lawyer about the procedural posture of the case, including whether the consumers should have waited until after the arbitration to appeal the trial judge's decision.

Verizon used the headers for ad targeting between 2012 and 2015. Initially, the wireless carrier didn't let its subscribers opt out of the header insertions. But in 2015, faced with pressure from lawmakers, Verizon revised its policies to allow opt-outs. The company later narrowed the program by saying it would only send the header to Verizon companies, including AOL.

In January of 2015, researcher Jonathan Mayer reported that Turn drew on Verizon's headers to collect data and send targeted ads to mobile users who delete their cookies.

Turn initially acknowledged Mayer's report, and defended use of the tracking headers. Several days later, the company changed its position and stopped using the headers.

Next story loading loading..