• by Wendy Davis  @wendyndavis, April 9, 2015

Two New York state residents have sued ad company Turn for its prior use of a controversial technology that enabled it to track consumers for online ad purposes, even when they delete their cookies.

The lawsuit, filed last week by Rosedale resident Anthony Henson and Newburgh resident William Cintron, stems from reports that Turn tracked Verizon users' Web activity by drawing on headers that the telecom injects into mobile traffic. The headers, called UIDHs, enable ad companies to compile profiles of users and serve them targeted ads. The UIDHs also are known as “zombie” cookies because they allow ad companies to recreate cookies that users delete.

“With these zombie cookies, Turn persistently and surreptitiously tracked all of users’ Web-based activities without their knowledge or consent, and in disregard of users’ efforts to prevent the tracking,” Henson and Cintron allege in their complaint, filed in U.S. District Court for the Northern District of California.

Henson and Cintron, who are seeking class-action status, add that Turn's tracking “vastly eclipsed traditional methods of gathering user data.”

Cintron says in the complaint that he deleted cookies and his browsing history from his smartphone on a daily or weekly basis, while Henson says he deleted his cookies and browsing history at least once every few months.

They allege that Turn's use of the UIDHs for tracking purposes violates a New York consumer protection law prohibiting deceptive practices. While they argue that Turn's conduct was “misleading,” the complaint doesn't appear to allege that Turn violated its own privacy policies or other representations to consumers.

Cintron and Henson also allege that Turn violated a state law regarding property because it “physically interfered with” users' smartphones. “Turn dispossessed plaintiffs and class members of the use of their mobile devices, or parts of them, for a substantial time by commandeering the resources of the mobile devices for Turn’s own purposes,” the complaint alleges.

Verizon uses UIDHs to track people's activity online and send them targeted ads. The company has always allowed people to opt out of receiving targeted ads powered by its own ad programs, but until last week, didn't allow users to avoid header insertions.

Last year, privacy advocates raised concerns that outside ad companies could draw on the UIDHs to target Verizon users. At the time, Verizon dismissed that scenario as unlikely.

But in January, Stanford's Jonathan Mayer published research showing how Turn leveraged the headers for its behavioral advertising program. Several days later, Turn said it would stop doing so. The company declined to comment for this article.

Earlier this year, a Mississippi resident sued Verizon and Turn over the UIDH injections, but that lawsuit was quietly withdrawn last month.