Commentary

Mobile Users Suing Over 'Supercookies' Need Not Hand Over Phones

Ad company Turn has lost another round in a long-running privacy lawsuit over “supercookies.”

The lawsuit, filed in 2015 by New York residents Anthony Henson and William Cintron, centers on allegations that Turn, now owned by Amobee, tracked mobile users via headers -- 50-character alphanumeric strings -- that Verizon inserted into mobile traffic. Those headers, also called supercookies, or zombie cookies, allowed Turn to recreate cookies that privacy-conscious users had deleted.

Turn recently attempted a hardball gambit in the long-running litigation: The company demanded to inspect Henson's and Cintron's mobile phones and all data on the devices -- including photos, emails and text messages.

Lawyers for Henson and Cintron argued the request was too broad; Turn then asked for records of all “web browsing history” stored on the phones, and for all cookies stored on their phones. Turn argued that it needed this information for several reasons, including to determine whether Henson and Cintron visited sites with Turn cookies, and to learn whether they in fact attempted to protect their privacy by deleting their browsing history.

Attorneys for Henson and Cintron offered instead to provide Turn with records of their browsing history associated with sites that partnered with Turn.

After Turn and the consumers were unable to reach an agreement, they asked a judge to decide what information must be turned over. This week, U.S. Magistrate Judge Laurel Beeler in the Northern District of California sided with Henson and Cintron.

“There is an Orwellian irony to the proposition that in order to get relief for a company’s alleged surreptitious monitoring of users’ mobile device and web activity, a person has to allow the company unfettered access to inspect his mobile device or his web browsing history,” she wrote. “Allowing this discovery would further invade the plaintiffs’ privacy interests and may deter current and future plaintiffs from pursuing similar relief.”

She said Turn was entitled to know which of its partner sites were visited by Henson and Cintron, and the date of those visits.

Beeler said in her ruling that there may be times when it was appropriate for a company to demand that litigants turn over their devices, but that Turn had not shown it was necessary here.

“Turn’s request for the plaintiffs to allow it to directly inspect their mobile devices (or produce complete forensic images of their devices) and for the plaintiffs to produce their complete browsing history and cookies, is denied,” she wrote.

Turn previously argued it shouldn't have to face a civil class-action suit because Henson and Cintron had agreed to arbitrate any disputes with Verizon. The 9th Circuit Court of Appeals rejected that argument last year, ruling that Turn wasn't entitled to benefit from Verizon's arbitration agreement with customers.

When information about Verizon's mobile headers first became public, Verizon said ad companies like Turn were unlikely to use the headers to compile profiles of consumers. But in January of 2015, researcher Jonathan Mayer reported that Turn was drawing on Verizon's headers to collect data and send targeted ads to mobile users who delete their cookies.

Turn initially acknowledged Mayer's report, and defended use of the tracking headers. Several days later, the company changed its position and stopped using the tracking headers. 

In 2016, Turn settled Federal Trade Commission charges related to the tracking technology by agreeing to refrain from misrepresenting its online data collection practices.

Next story loading loading..