Hacker News Reader

Comment by gergles | Hacker News Reader

They don't appear to be doing this if you've opted out of "Relevant Mobile Advertising", which is another option [separate from CPNI] on http://verizonwireless.com/myprivacy.

Here's the setting you're looking for:

http://i.imgur.com/QFJJNV5.png

Mods may also want to update the title to include "Wireless" after Verizon; Verizon landline is not doing this anywhere AFAIK.

View on HN

I have a prepaid account, and I'm not allowed to change privacy settings either online or over the phone. The web tells me I am an account member and not owner, and the phone just says prepaid is not eligible to opt out. I can fix it by using a VPN, but isn't it illegal to not even allow me to opt out? Postpaid is significantly more expensive than prepaid and not available to people with bad credit. How can they discriminate like that?

I'm not clear why you think it would be illegal. There may be rules against not allowing people to opt out, I don't know. But when you ask "How can they discriminate like that?", there's nothing illegal about discriminating on the basis of credit or willingness to pay for a more expensive product.

I can understand discriminating on quality or something like that, but we're talking about not being able to opt out of having your personal information sold. It seems like there should be some kind of a law where that has to be made absolutely clear. It doesn't even seem to be buried anywhere in the Terms of Service, which say:

"Verizon Wireline consumers and certain business customers may opt-out by calling 1-866-483-9700. Verizon Wireless consumer and certain business customers may call 1-800-333-9956."

Only after calling that number are you told you are ineligible because you are prepaid.

This is advertised as a prepaid account, not a personal-information-selling subsidized account. It's also not even really competitive with other plans. Verizon gives you up to 1GB/month for $45, only with recurring payments, while Cricket gives you 10GB 4G with unlimited throttled data for $55. Unfortunately, Verizon has a monopoly in most of my area. T-Mobile and Sprint don't operate here, and AT&T is spotty.

I'm attracting a lot of downvotes, and I feel like people think I'm supporting Verizon. I agree with you in that I think they're being scummy, but I guess I was just saying that when you ask "How can they discriminate like that?" the answer is that lots of scummy things aren't illegal. I agree it might be nice to see much stronger privacy laws in this area, but they don't exist yet and that's most of what I was trying to say. I think I thought you were saying that you thought it was illegal ("isn't there a law...") whereas you were really just saying you thought it should be illegal.

I do think it should be illegal, but "isn't it illegal?" was a genuine question. I don't know the specifics, but I'm surprised there isn't some legal requirement. You can't even send e-mail without allowing an opt-out, and every ad network I know of has an opt-out policy, so sending tracking information to every website you visit and selling that information with no option to opt-out just seems over the top and out of step with what everyone else offers.

You want to know how to opt out? You cancel your contract. Verizon is under no obligation to provide you with phone and internet access, ad-free or otherwise. They offer a product on the free market, and if you don't like that product, you should not buy it. While I think their policies and attitude toward privacy is despicable, accusing them of doing anything illegal is simply incorrect.

While what you said may seem logically correct, there are a myriad of privacy protections that corporations are expected to adhere to regarding the information customers entrust to them. One reason for these protections is that the "resolution" you've suggested --- that the customer can simply choose not to use their services --- provides no protections against future-use of information. Say a customer chooses a vendor that sells his information after he ends his service with them. Under your strategy - the customer would have absolutely no recourse since he has no leverage against that vendor. He's already "walked" so to speak - yet they still may have information of value about that customer.

Take another example. A medical facility cannot take customer information about a person with a specific ailment and sell that information to advertisers for the purpose of earning a commission on the sale of those targeted ads. There are laws forbidding how that information is shared.

The following link outlines some of the state and federal laws specific to California, but each state has their own, and the federal laws obviously apply to the entire United States.

http://oag.ca.gov/privacy/privacy-laws

>I'm not clear why you think it would be illegal.

Consent matters. In Europe it would most certainly be illegal.

What's Europe got to do with this?

Because somebody seemed surprised that people expected this to be illegal. The fact that it is illegal in a large number of countries is a useful datapoint, and shows that the initial reaction of "shouldn't this be illegal" isn't completely off the wall.

> Postpaid is significantly more expensive than prepaid and not available to people with bad credit. How can they discriminate like that?

I agree this is terrible, but I should point out that T-mobile's prepaid and postpaid plans are priced the same (and neither requires a contract - only difference is that the latter requires a credit check).

If T-mobile is an option for you, I would recommend their prepaid options.

Also, if your credit is bad, you may be able to pay a ~ $500 deposit (steep, I know) for a postpaid account on Verizon/AT&T. IIRC, the deposit is only needed for the first year, after which you get it back.

Thanks for the suggestions, but I really don't want an expensive postpaid contract. I don't even need service every month. WiFi calling is better than cell calling most of the time, and unfortunately, no carrier other than Verizon operates in most of the places around where I live. I'll stick to a VPN.

My "Relevant Mobile Advertising" was already long-ago opted-out ("No, I don't want to participate in Relevant Mobile Advertising"). Still, last night, my "Verizon 3G" (iPhone 4s) was definitely adding the header to all plain-HTTP traffic, including that from private/incognito-mode tabs, and from another machine sharing the "personal hotspot".

I then changed the other two settings ("Customer Proprietary Network Information" and "Business & Marketing Reports") to opt-out, and it was still sending the header about a half-hour or hour later, and I contacted @VZWSupport on Twitter. This morning, the header was no longer being sent.

So I don't know if:

• one of those other settings eventually took effect; or...

• contacting @VZWSupport caused them to fix something with my account, either based on my support-expressed preference or remedying a bug in respecting prior preferences; or...

• general reporting of this has caused a change at VZW, perhaps in finally respecting previous opt-outs

And... the header is back again. Haven't made any further changes to privacy preferences (all opt-out).

I'm opted out of everything on that page and I'm still seeing the header sent.

Maybe the header isn't being sent for you due to this change possibly being a gradual rollout.

Same. Opted out of everything (since months ago). Still seeing the header. :(

The header is sent if you opt out. It's explicitly stated in the privacy policy, which i've copied into a parent post on this HN thread.

I don't see how the privacy policy wording can be interpreted that way.

The wording you've clipped does not suggest that the "unique, anonymous identifier" will be sent to every website. (It does suggest there's a customer choice in some way, but that's unclear and so far no one has reported a reliable way to have Verizon suppress the X-UIDH header.)

The note that "many opt-outs are cookie-based" may not be relevant to this tampering. In particular, there's no clear way that cookies to Verizon websites could be consulted when doing the tampering on each HTTP request to other websites: they're not part of the connection. (I suspect this section is boilerplate related to some other opt-out.)

I am opted out of everything. The header is sent in mobile Chrome and Firefox, with incognito mode, and with DNT enabled.

My account has had this disabled for months, the header still shows

In addition to all of the other users reporting that it isn't actually disabled, they publicly claim that it's disabled for enterprise and government customers but I confirmed that it's still being sent there as well.

Just checked my configurations, those settings are all set 'off' for my lines (I turned them all off months ago, not just this moment), but the uidh.crud.net site is still receiving the header.

Likewise. They were set to off when I visited the page and the header still shows.

They're ignoring it for me. See: https://twitter.com/kennwhite/status/525374343074029568 Can you confirm you connected over cellular when testing?

Yep, over LTE on an iPhone 6, in NYC. The only thing unique is I have Safari configured to send the DNT header. It would be amusing (in a good way) if that made VZ's infrastructure not tag all my traffic.

Interesting. They're definitely ignoring it my case: https://twitter.com/kennwhite/status/525369304456658944

Yeah, I've got nothing. Maybe it's only specific IP blocks that have the 'feature' enabled yet?

http://imgur.com/mLxVTrL

That setting doesn't exist on my version of the page.. I get a link to "more information" on "Verizon Selects", but none of my lines are listed there.

I'm going to make a few phone calls...

Using and ad blocker? I disabled mine and that section showed up.

I can confirm that disabling adblock allows these settings to show up.

Even with ad blockers disabled, I only see CPNI settings (which I'd already set to "Don't Share") at https://wbillpay.verizonwireless.com/vzw/accountholder/profi...

http://uidh.crud.net/ also says "did not receive X-UIDH header."

California, Verizon Wireless, Business Account, not on contract.

EDIT: Now an hour later, the headers DO appear. No setting to disable on the VZW site though.

That did it! Thanks!

My phone's VWZ http requests are sending the header, where I have been opted out of "Relevant Mobile Advertising" since they sent me information about it in the mail earlier this year.

This is disabled across all of my lines and is still showing.

as a pageplus user, I don't know if there is a way to op out of this. actually I havenmt found a way to opt out of either.

Edited Title- You're correct, no reason to believe this is happening anywhere else (e.g. FIOS)

Reply on news.ycombinator.com