"Am I Being Tracked?" Access report raises privacy concerns over cellphone tracking headers

In August 2015, Access released its report "The Rise of Mobile Tracking Headers: How Telcos Around the World Are Threatening Your Privacy".  The report investigates the global use of so-called “supercookies” or “permacookies” to track web browsing on cellphones. The results were based on almost 200,000 tests taken on Amibeingtracked.com — a site developed by Access to allow people to test their devices to see if they were being tracked.

The report stated that the following mobile carriers had been found to be using tracking headers: AT&T, Bell Canada, Bharti Airtel, Cricket (part of AT&T), Telefonica de España, Verizon, Viettel Peru S.a.c., Vodafone NL, and Vodafone Spain.

Business & Human Rights Resource Centre invited the companies to respond.  Responses by AT&T, Cricket (part of AT&T), Telefónica, Verizon and Vodafone (headquarters) are below.  The other companies have not yet responded to the Resource Centre's request, although some such as Bharti Airtel have provided comments to the media. 

We are continuing to follow up with Bell Canada, Bharti Airtel and Viettel and will indicate on this page whether or not they respond.

Get RSS feed of these results

All components of this story

Article
9 October 2015

Access reviews telco company responses to its "Am I Being Tracked?" report

Author: Peter Micek and Deji Olukotun, Access

"Zombie cookies rise again as telcos respond to our report on tracking headers", 9 Oct 2015

...

We have fought to expose the use of mobile tracking headers, and made some progress in holding companies to account. We built a tool at Amibeingtracked.com that allowed mobile device users to test whether they were being tracked, and nearly 200,000 people took our test over a six month period. In our report, released in August, we found around 15% of the tests showed evidence of tracking headers in 10 countries around the globe.

The nonprofit Business and Human Rights Resource Centre invited formal responses from the companies named in our report. As shown on their website, we have now received responses from five of the telcos: AT&T, Cricket, Telefónica, Verizon, and Vodafone. A sixth, Indian firm Bharti Airtel, responded to media and reached out with questions to Access, but never followed up or responded to us directly.

Let’s go through the responses, one by one...

Read the full post here

Company response
18 September 2015

Cricket response to Access report on mobile tracking headers

Business & Human Rights Resource Centre invited Cricket (part of AT&T) to respond to the report by Access: "The Rise of Mobile Tracking Headers: How Telcos Around the World Are Threatening Your Privacy".  Cricket sent the following response:

"Thank you for your inquiry and the opportunity to respond.   Very simply put, Cricket does not use tracking headers.  We’ve verified this with our head of Networks and can confirm that we are not inserting tracking headers on our network. 

We agree consumer privacy is an important issue and we take the matter seriously at Cricket.  Customer care and satisfaction are incredibly important to us and we work hard – every day – to earn our customers business and their trust.  Again, thank you for the chance to respond."

Download the full document here

Company response
14 September 2015

AT&T response to Access report on mobile tracking headers

Business & Human Rights Resource Centre invited AT&T to respond to the report by Access: "The Rise of Mobile Tracking Headers: How Telcos Around the World Are Threatening Your Privacy".  AT&T sent the following response:

“AT&T maintains a fundamental commitment to customer privacy, which is detailed at http://att.com/privacy.”

Company response
14 September 2015

Verizon response to Access report on mobile tracking headers

Author: Verizon

Download the full document here

Company response
10 September 2015

Telefónica response to Access report on mobile tracking headers

Author: Telefónica

Download the full document here

Company response
7 September 2015

Vodafone response to Access report on mobile tracking headers

Author: Vodafone

...Header enrichment is not Vodafone’s default operation, and we do not routinely share information with the websites our customers visit. We use header enrichment for a limited number of Vodafone and trusted third-party services where it is necessary for them to work. For example, if a customer visits a site or app store that offers a “charge to bill” service and where there is a direct billing relationship between the site/app store owner and Vodafone, the customer requires an enriched header containing an anonymised customer reference to allow the goods to be charged to their phone bill. The enriched header does not allow third parties to access personal information, create profiles or track internet behaviour...

Download the full document here

Article
19 August 2015

Privacy: Amobee user tracker found on some tests from Airtel users [India]

Author: Nikhil Pahwa, Medianama

A report from human rights organization Access indicates that in some cases, Indian telecom operator Bharti Airtel was inserting a “tracking header” in the connections of some users. While the data sample is clearly very small – only four tests from Airtel were confirmed as being tracked by Access over a six month period, it is also dependent on users testing their own connection on Access’ AmIBeingTracked.com tool...

...An Airtel spokesperson sent the following statement in response, which doesn’t address the questions [sent to the company by Medianama]:

“We take customer privacy laws/ rules very seriously and do not track our customers’ journey online. Specifically, we do not use super cookies on our network. Infact – www.amibeingtracked.com, the testing website created by Access, validates this and confirms that the Airtel network does not track its customers’ data.”

Read the full post here