• by Wendy Davis  @wendyndavis, May 20, 2015

Ad company Turn is asking a federal judge to send a lawsuit centering on its alleged use of “supercookies” to an arbitrator.

The lawsuit against Turn, filed last month by New York residents Anthony Henson and Newburgh resident William Cintron, grew out of reports that Turn tracked Verizon users' Web activity by drawing on headers that the telecom injects into mobile traffic. The controversial “unique identifier headers,” called UIDHs, enable ad companies to compile profiles of users and serve them targeted ads. The UIDHs also are known as “supercookies” and “zombie cookies” because they allow ad companies to recreate cookies that users delete.

Turn argues in papers filed late last week that Verizon's contract with mobile users requires arbitration of all disputes.

“If Verizon had provided the tailored advertising feature to Plaintiffs using only its own internal resources -- instead of partnering with Turn to provide it jointly -- there would be no question that any claims arising from that feature would be subject to plaintiffs’ arbitration agreement. That Verizon chose to partner with Turn does not alter the analysis.”

The lawsuit came soon after Stanford lawyer and Ph.D candidate Jonathan Mayer published research showing how Turn leveraged the headers for its behavioral advertising program. Mayer reported in January that Turn uses Verizon's UIDH to collect data and send targeted ads to mobile users who delete their cookies. He wrote that Verizon's UIDH allows Turn to recreate deleted cookies -- small text files that store the kind of information used for ad targeting.

At the time, Verizon allowed people to opt out of receiving targeted ads powered by its own ad programs but didn't let users avoid header insertions. Mayer's report spurred an inquiry by lawmakers, which seemed to prod Verizon into changing its policy. As of April, the company allows subscribers to opt out of the headers.

In its latest court papers, Turn specifically denies that it engaged in cookie respawning -- but defined that concept narrowly, as storing data cookies in a part of users' browsers where the information wouldn't be deleted if users erased their cookies.

Despite the denial, Turn appears to acknowledge in a carefully worded sentence that it recreated data about users that their browsers had erased. “In certain situations in the past, when Turn encountered a mobile browser with no Turn cookie, it set new cookies containing an existing Turn ID if the browser was identifiable to Turn based on identifiers passed to Turn during the real-time ad bidding process," the company writes.

Turn also says in its legal papers that even though Verizon periodically changed users' UIDHs, it provided Turn with enough information to connect new headers to the old ones.

“Verizon worked with Turn to design a solution that enabled Turn to handle advertising campaigns lasting more than one UIDH rotation, in part to account for advertising campaigns lasting longer than one UIDH rotation,” Turn says. “Because Verizon changes the UIDH for a particular device on a regular basis, an essential part of the integration of the Verizon UIDH into Turn’s system was to associate any new UIDH with the preceding UIDH when the UIDH rotated.”

Turn adds that it didn't draw on UIDHs to send targeted ads to people who had opted out of receiving behaviorally targeted ads.

Turn has asked U.S. District Court Judge Jeffrey White to dismiss the case and send it to arbitration, or to stay the matter while it goes to arbitration.

But it's not clear whether White will agree that Turn can enforce the arbitration clause, given that the users' agreement was with Verizon and not Turn, says cyber law expert Venkat Balasubramani. “Courts may be reluctant to allow a non-party to invoke an arbitration clause” he says, adding that judges are especially likely to be reluctant in a situation where the users' accepted a form contract.

The matter is slated for a hearing on July 24.