Ad company Turn said today that it will suspend its controversial practice of re-creating cookies that users have deleted, pending further review.

“We have heard the concerns and are actively re-evaluating this method,” Turn's general counsel and chief privacy officer Max Ochoa said today in a blog post. He says the company will change its practice by early February.

The move comes two days after Stanford's Jonathan Mayer published a report exposing Turn's “zombie cookie” activity. Mayer explained how Turn leveraged data originating with Verizon -- the UIDH header, which Verizon sends to all unencrypted sites visited by its users -- to deliver behaviorally targeted ads to people who tried to avoid tracking by deleting their cookies.

Specifically, Mayer showed how Verizon's UIDH allows Turn to recreate deleted cookies -- the small text files that store information used for ad targeting.

Turn acknowledged doing so. “At Turn, we always use the most stable identifier available to inform our bidding and campaign execution,” Ochoa wrote earlier this week in a blog post. “In the case of Verizon devices, we use the non-cookie UIDH identifier.”

He added that Turn honors people's request to opt out, but said that “clearing a cookie cache is not a widely recognized method of reliably expressing an opt-out preference.”

Instead, Ochoa said the company honors opt-out mechanisms endorsed by self-regulatory groups. But those opt-out requests are stored on cookies; when users clear their cookies, the opt-out requests also disappear.

The result is that Turn ended up using behavioral advertising techniques on Verizon Wireless users who deleted their cookies, regardless of whether they clicked on opt-out links.

Mayer's findings spurred a wave of criticism of both Verizon and Turn. The digital rights group Electronic Frontier Foundation called on Verizon to immediately stop broadcasting the UIDH header.

Jason Kint, CEO of the trade association Digital Content Next, pointed out that consumers have no practical way of knowing about the practice. “Turn doesn’t even discuss in its privacy policy these 'zombie cookies' that spawn back to life,” he wrote in a Re/code column. “Clearly there’s no actual 'choice' for consumers in this scenario, particularly because the odds of them being aware of Turn -- much less 'zombie cookies' -- are next to none.”

He adds in an email to MediaPost: “There is nothing about this practice that is in line with consumer expectations ... Practices like this drag down an entire category of good actors and harms trust in the entire digital media ecosystem."