Snip

Verizon overrides users’ opt-out preferences in push to collect browsing history

Verizon renamed scanning program and enrolled customers who previously opted out.

Verizon is automatically enrolling customers in a new version of a program that scans mobile users’ browser histories—even when those same users previously opted out of the program when it had a different name.

The carrier announced changes to its “Verizon Selects” program along with a new name a few days ago. “Verizon Custom Experience Plus is the new name of our Verizon Selects program,” Verizon said in an FAQ. Verizon is ignoring the previous opt-out preferences for at least some customers by enrolling them in “Custom Experience,” which collects browser and app-usage history but doesn’t use device location data and other personal information collected in “Custom Experience Plus.”

Verizon says it does not sell the information collected in either version of Custom Experience and that the program “no longer supports third party advertising.” But Verizon does share the data with “service providers who work for us” and says it uses the data to “personalize our communications with you, give you more relevant product and service recommendations, and develop plans, services, and offers that are more appealing to you. For example, if we think you like music, we could present you with a Verizon offer that includes music content or provide you with a choice related to a concert in our Verizon Up reward program.”

How to opt out (again)

Privacy-conscious users will likely want to opt out using the instructions provided by Verizon or in this article. To opt out, go to your Verizon account privacy preferences page. Scroll down a bit and you’ll see options to “Manage Settings” for both Custom Experience and Custom Experience Plus. You can also try this link to go directly to the Custom Experience settings, or you can select “Manage privacy settings” in the “My Verizon” mobile app.

In either the website or the mobile app, the options to manage settings will let you opt in to or out of the two versions of the Custom Experience program. You can also delete any browsing and location data history that Verizon previously collected by clicking “Reset.” Additionally, account owners can use the Verizon website to block Custom Experience enrollment for specific phone lines.

Verizon customers have good reason to be wary of the carrier’s privacy practices. The Federal Communications Commission last year found that “Verizon apparently disclosed its customers’ location information, without their consent, to a third party who was not authorized to receive it.” The commission proposed a fine of $48 million. In 2016, Verizon agreed to pay a $1.35 million fine for inserting “supercookie” identifiers into customers’ mobile Internet traffic without users’ knowledge or consent.

In 2017, then-President Donald Trump and the Republican-controlled Congress blocked implementation of FCC privacy rules that would have required home-Internet and mobile broadband providers to get consumers’ opt-in consent before using, sharing, or selling browser history, app-usage history, and other private information.

Opted out? “You will still be included”

Verizon has been sending emails to customers notifying them about the program changes. There are different versions of the email, one of which states that Verizon is ignoring previous opt-out preferences in cases where people “recently opted out.” That email, which was forwarded to Ars by a Verizon customer named Jordan Hirsch, says:

As a Verizon Selects participant, you will automatically be included in the Custom Experience Plus and Custom Experience programs.

If you recently opted out of participating in Verizon Selects, you will still be included in the Custom Experience program unless you opt out.

Hirsch also tweeted a screenshot of the email he received from Verizon. The Verizon email Hirsch received did not state a specific time frame for the “recently opted out” phrase. We contacted Verizon today and asked for that detail and asked why Verizon is enrolling people who previously opted out of the same program before the program’s name was changed. We’ll update this article if we get any answers.

The Verizon FAQ does not include the “recently opted out” language and instead makes it sound like all customers may be enrolled in Custom Experience (the non-Plus version) regardless of previous opt-out status:

You will be part of the Custom Experience program unless you opt out. You can opt out using the privacy preferences page on the My Verizon site or the privacy setting page within the My Verizon app.

You must opt in to the Custom Experience Plus program to be a part of it unless you are already participating in Verizon Selects. Verizon Selects participants will automatically be included in the renamed program.

Browsing, location data, and call records

What information does the newly renamed program collect? Both versions of Custom Experience use “information about the websites you visit and the apps you use on your mobile device to help us determine your interests, such as ‘sports lover’ or ‘outdoor enthusiast,'” the Verizon FAQ says. “We use only the first part of the web addresses (URLs) you visit (the part that includes the top level domain and subdomain of the URL); we do not use information past the first ‘/’ or ‘?’ in the URL. For example, we would be able to infer you are interested in ‘news’ if you visit a news-related website, but we wouldn’t know what news article you read.”

Custom Experience Plus uses all of the above plus “Device location information we obtain from the Verizon network and from Verizon apps you have permitted to collect location for these purposes; Information about your Verizon FiOS services; and Customer Proprietary Network Information (CPNI), including information about the phone numbers you call or that call you and the times you receive these calls. It also includes information about the quantity, type, destination, location, and amount of use of your Verizon telecommunications and interconnected Voice over Internet Protocol (VoIP) services and related billing information.”

Although general call data is collected, “The programs do not use what you or others say during calls or the content of your emails or texts with other people,” Verizon says. “Custom Experience Plus does use call detail records including the phone numbers you call and those that call you, and the times and durations of the calls.”

Verizon says it tries to avoid collecting sensitive browsing and location information:

We make efforts to eliminate the use of websites that may be sensitive in nature; for example, we employ filters that are designed to exclude websites related to adult content, health conditions, sexual orientation and others. We also make efforts to eliminate the use of location information about sensitive points of interest in these same areas.

The “make efforts” phrasing suggests that these filters will fail to prevent collection of sensitive data in some cases. Verizon also says that if you opt in to Custom Experience Plus, you will automatically be included in Verizon’s Business and Marketing Insights program.

Verizon shares your data with vendors

Verizon says it shares data collected in Custom Experience with service providers:

We do not share information that identifies you outside of Verizon as part of these programs other than with service providers who work for us. These service providers are required to use the information only for the purposes Verizon defines and not for their own or others’ marketing or advertising purposes. They are also required to protect the information. We do not sell information we use in these programs to others for them to use for their own advertising.

Verizon said it “keep[s] information about the websites you visit for no more than 6 months. We keep location and CPNI information we use for these programs for approximately one year. We regularly refresh the interest categories we develop as part of the Custom Experience programs (e.g., ‘coffee lover’ or ‘sports enthusiast’) and keep them as long as you are participating in the programs or until you reset your line.”