Mobile Internet is still on the rise and used by hundreds of millions of people around the globe to access the Internet. Mobile advertising is on the rise as well and with it comes the desire to track users to improve its effectiveness.
One way of doing that is to use data provided by mobile carriers. Back in 2014 it became known that two large mobile carriers from the United States -- Verizon and AT&T -- were injecting special tracking headers to mobile connections of their customers which advertisers could use to track users across the Internet by identifying them using provided data about customers.
It is nearly impossible for customers to tell if headers are injected when they connect to services, websites or other Internet resources as this happens on the network level.
Carriers receive all requests that users make when connected to their network. Carriers who inject tracking headers add a unique identifier to the (HTTP) request automatically before the connection to the actual resource is completed. The resource can then use the unique identifier to track users across the Internet.
Even more problematic than that is that advertisers can pay to access data profiles of customers provided by the carrier.
The information can be used to change content on the page or redirect users to a different page altogether.
The research paper "The Rise of Mobile Tracking Headers: How Telcos Around the World Are Threatening Your Privacy" a0a7cea86cc5eee2d1_kjm6ig8y3.pdf by the Internet rights organization Access highlights that tracking started much earlier than 2014.
Am I Being Tracked is an online tool that Access' researchers created for the study to find out how widespread the injection of tracking headers really is.
Simply visit the website using your mobile device, turn off WiFi if it is turned on, and click on the test now button.
The service returns whether your mobile carrier is injecting headers to connections you make or not.
Here is how it works:
Key Findings of the study
Mobile users have several options to prevent this from happening. First, all connections to secure sites (HTTPS) are not modified by carriers. While that is helpful, it leaves all regular (HTTP) connections vulnerable.
The use of a virtual private network puts an end to tracking and is currently the best option to block mobile carriers from injecting tracking headers.
Last but not least, you may want to consider switching to a carrier that is not injecting headers.
Now You: Are you being tracked by your mobile carrier?
Please click on the following link to open the newsletter signup page: Ghacks Newsletter Sign up
Ghacks is a technology news blog that was founded in 2005 by Martin Brinkmann. It has since then become one of the most popular tech news sites on the Internet with five authors and regular contributions from freelance writers.
Thanks.
it’s all rather worrying…good to know about this kind of activity, thank you :)
just checked UK provider “Orange Personal Communications Services” and happily (for the moment at least) not being tracked
Martin, thanks for raising awareness of carrier-injected tracking headers. I worry that the practice isn’t specific to wireless carriers.
I’m on Project Fi and this test site shows as T-Mobile with no injected headers. Will try again when I’m connected to a Sprint network.
Not being tracked … yet
Thanks for this info!
If you use Google Chrome on Android and use the save data feature all of your http traffic is funneled through Google servers and is not injected. This website even identifies the carrier as Google Inc.
And google is doing the tracking rather than your cell provider :)
If I was a carrier, I would instantly add the site to the white list and then the check is worthless :)