What are zombie cookies?

A zombie cookie is a tracking identifier that comes back after you delete it, because a backup copy exists somewhere your deletion never reaches. That backup can live in a browser storage mechanism you didn't know to clear — or, in the most striking real-world case, in your mobile carrier's own network traffic, completely outside your browser and your control entirely.

How respawning works, in general

The pattern is always the same regardless of where the backup lives: store a tracking ID in one location a normal "clear cookies" action reaches, and a second, separate location it doesn't. When a script or server checks the primary location and finds it empty, it reads the surviving backup and rewrites the ID back into the primary spot — restoring exactly what the user just tried to delete. Evercookie, covered in a separate guide, is the most extreme version of this idea, spreading the same ID across a dozen or more browser storage locations simultaneously for maximum redundancy. The Verizon case below shows the opposite extreme: one single backup location was enough, because it sat somewhere users had no way to reach at all.

The Verizon/Turn case: a zombie cookie that never touched your browser

Starting in 2014, Verizon began inserting a unique tracking header — internally called the UIDH, widely reported as a "supercookie" — directly into a customer's mobile web traffic at the network level, invisible to any browser and impossible to delete through any browser setting. In January 2015, ProPublica reporters Julia Angwin and Jeff Larson revealed that an advertising company called Turn, whose ad-auction technology ran across sites tied to Google, Yahoo, and Facebook's ad ecosystems, was using that Verizon header specifically to rebuild its own tracking cookies for users who had deleted them — a discovery credited to Stanford researcher Jonathan Mayer.

Turn's own opt-out cookie made the situation worse, not better. ProPublica's testing found that even users who had installed Turn's opt-out cookie kept receiving the tracking cookie anyway — the "opt out" signal itself didn't survive being respawned. Turn's chief privacy officer told ProPublica the company was "trying to use the most persistent identifier that we can," and the company suspended the practice within two days of the story running.

Why deleting cookies did nothing here

In a browser-storage zombie cookie, at least one of the redundant copies lives somewhere on your device — inconvenient to find, but technically reachable. The Verizon header wasn't stored on the device at all. It was inserted into outgoing traffic by Verizon's own network infrastructure, which meant no combination of browser settings, private browsing, or manual cookie deletion could touch it. The only way to stop it was for Verizon itself to change how its network operated.

What actually stopped it

Verizon began letting users opt out in early 2015, though initially only by digging into account privacy settings rather than anything automatic. In 2016, Verizon agreed to pay $1.35 million to settle FCC charges over the practice and committed to making the tracking opt-in by default rather than opt-out. A separate class action against Turn was allowed to proceed by a federal appeals court in September 2017, rejecting Turn's attempt to force the case into private arbitration.

How to check your own exposure

A carrier-injected header only appears in unencrypted traffic — running any traffic through a VPN prevents the carrier from seeing or modifying it at all, which is a meaningfully different defense than what protects against browser-storage zombie cookies. For the browser-storage kind, clearing "all site data" rather than just cookies, and periodically checking what's actually stored via your browser's developer tools, remains the only real check — there's no single setting that guarantees every possible backup location is empty.