The two-year saga of the super cookie has come to a close. Today, the Federal Trade Commission announced it has settled with digital ad firm Turn, which allegedly tracked people's web and mobile app interactions even after they did what the industry considers the best method for protecting privacy – opted out.
"What happened here is that there was a lack of transparency for consumers," said Jamie E. Hine of the FTC's Bureau of Consumer Protection, who was the lead attorney on the case. The FTC believes Turn misrepresented its opt-out process.
"Sometimes privacy policies are criticized because they can be vague," said Justin Brookman, another attorney in the Bureau of Consumer Protection who worked on the Turn case. Going forward, he said, it is recommended that Turn and other firms using digital and mobile tracking technologies provide a more thorough description in privacy policies of how people are tracked.
In January 2015 after coming under fire for invading consumer privacy by enabling Verizon's so-called zombie cookies that persisted even after people thought they'd removed them, Turn said it would stop using Verizon's unique identifiers or super cookies.
In March, the Federal Communications Commission, which has jurisdiction over telco carriers, settled its investigation of Verizon Wireless and its use of the mobile unique identifiers or super cookies. The company was slapped with a $1.35 million FCC fine. The FTC's settlement with Turn involves no monetary penalty, though if Turn is found to be in violation of compliance with the agreement, it could be fined.
"The settlement validates the steps we took early in 2015, when Turn terminated the partnership and ceased using the Verizon Wireless identifier," said John Wolf Konstant, general counsel and chief privacy officer at Turn, who stressed that the tracking system did not intercept personally-identifiable data.
"We take our obligations regarding consumer privacy very seriously. Our system was built with privacy in mind, and it is first and foremost designed to avoid the collection of personally identifiable information (PII)," he wrote in a company statement.