I guess I'll never know, either. I've never understood why there are so many trucks on the road. If you need a truck to do truck-things, I can understand that. But most of the ones I see aren't hauling a damned thing. Those trucks are obnoxious and dangerous to everyone else on the road, I'd love to see most of them gone.

True. And oddly enough, I manage to hear bicycles in operation just fine (even around blind turns) even though they lack engine noises. This is one of the reasons why I think the "engine noise is a safety issue" argument is a bit bogus.

Because that sound is being inflicted on everyone around the car, not just the customer.

So the auto manufacturers have been intentionally making their cars annoying to the people who don't own those cars? Screw them. I want cars and trucks to be as close to silent as possible. Cars already create far too much noise pollution. Perhaps auto manufacturers to just pipe the sounds inside the car for those owners who desire that, while leaving the rest of us in a more peaceful world?

I saying that it is technically feasible for a competent engineer. I'm not commenting on the contractor's ability to do it.

The ultimate blame falls on governmental policy, not the contractors, though. It is the government who decides what the acceptance criteria are, not the people the government hires. It is the government who approves or disallows the use of third party services, not the people the government hires.

Yes, I understand. I'm just saying that definition of PII is a worthless definition, so it doesn't matter at all. When a company says things like they don't store or share any PII, they're saying nothing that is of any actual value to me. because the definition of PII is too narrow to be meaningful in a privacy or security sense.

IANAL, but I am generally familiar with HIPPA. This is probably not a HIPPA violation because the HIPPA rules only apply to specific sorts of businesses, and the healthcare.gov site is not one of them. For instance, I could share any medical details I had on you as much as I want without violating HIPPA laws.

It sounds like you're using the ad industry's definition of "PII". That definition is ludicrous. The bulk of information that can be used to identify me personally falls outside of the standard definition of "PII", and so the term "PII" is pretty much devoid of meaning.

I disagree. The evidence is that the data is being sent to them. Nothing more needs to be proven. There is no -- as in zero -- legitimate reason for the site to be doing this. All performance analysis they need can be done in-house.

I honestly don't see any difference between the two scenarios. I have no reason to think that domestic ad companies are any more trustworthy than 3rd world country companies (and I have several reasons to think that they're not). I'm pretty sure it will be sold either way.

Ahh, I understand. You'd also have to not be an AT&T user. Best bet is to actually test for header injection first, since we don't really know all the carriers that do this. Particularly with the small carriers, since they are just reselling service from the major carriers.

There are only three possible explanations for this: the two phones were using different carriers, or they were being tested in different geographical locations, or the cell carrier itself is making the distinction for some weird reason. The header injection itself is totally unrelated to the phone, the operating system, or what the software on the phone does.

My definition of "tiny" is "under 5,000 people". I live in a state that has no city that is as large as 3 million people. But perhaps there are more than the usual number of electronics hobbyists in my state.

The browser has nothing to do with this at all, and there's nothing a browser (or any other software you can run on the phone) can do about it short of using a VPN.

When you did your tests on the Android phone, are you quite certain that you weren't using the WiFi connection? The tracking header is only inserted into traffic that goes over the cell network.

No, that wouldn't work. The header is inserted well after the request leaves your phone. If you insert the header yourself first, it will just get overwritten once you've sent it.

I have never lived in a larger-than-tiny town that didn't have at least one independent electronic supply store within driving range. I haven't set foot in a Radio Shack in years, but I am always totally able to run out and grab components at the last minute.