FTC Settles 'Supercookies' Case
In the sci-fi movie Minority Report, Tom Cruise has his eyes removed in a gross scene that you cannot unsee. So don't watch it just because of this movie reference.
But there is another part of the movie that you can't ignore. In the future, the movie shows how companies will be able to track us and push custom-tailored ads at us wherever we go. There is no escape from the Big Brother ad man.
Well, that movie was made 15 years ago and the future is now. "Supercookies" or "zombie cookies" are the villains in this tale.
"Supercookies and Zombie Cookies"
The Federal Trade Commission, the good guy this time, ordered an ad company to stop secretly tracking phone users' browsing habits and pushing ads to them. The FTC announced a settlement that prohibits Turn from misrepresenting its data-gathering practices and requires the company to give people an effective opt-out mechanism.
The company denied any wrongdoing, but reportedly had used "supercookies" or "zombie cookies" to track Verizon wireless customers -- without their knowledge. The FTC alleged that Turn misled consumers by implying they could control online tracking by refusing to accept cookies.
The company's privacy policy did not disclose, however, the use of tracking headers. Those headers -- 50-character alphanumeric strings -- were injected into all unencrypted mobile traffic, the FTC said.
Turn used the information to push ads to customers, the agency said, and did not give them an effective way to opt-out of the advertisements.
Show Me the Money
The FTC received complaints over the settlement from individuals who said Turn should have been punished financially. The agency responded that it lacked authority to impose civil penalties because it was the company's first offense.
"We believe the prohibition against misrepresentations about the privacy of covered information, the required disclosure and Opt-Out mechanism, and the requirement that Turn honor mobile operating system controls, will deter future violations," the FTC said in a written response.
While the Commission does not have authority to obtain civil penalties for an initial violation, the statement said, Turn will risk civil penalties of up to $40,654 per violation per day if it violates the orders.
Last year, the Federal Communications Commission fined Verizon $1.35 million to settle an investigation of the headers. That focused on whether Verizon violated the Communications Act's privacy provisions to protect users' "proprietary information."
Related Resources:
- FTC Fines Upromise for Failing to Disclose Data Collection Practices (Media Post)
- Cybersecurity Tips for When You're out of the Office (FindLaw's Technologist)
- How Using AI Can Be Your Marketing Boon (FindLaw's Technologist)