The online advertising company at the center of Verizon's "zombie" cookie controversy cannot avoid a proposed class action lawsuit filed by Verizon Wireless customers, a federal appeals court ruled this week.

Turn, Inc. is an online advertising clearinghouse that allegedly attached un-deletable tracking cookies to Verizon customer identifiers to collect and send their Web browsing and usage data to Turn’s servers. Verizon customers Anthony Henson and William Cintron filed a proposed class action lawsuit against Turn on behalf of all Verizon customers in New York, but the company argued that the customers should be forced into arbitration.

Previously, the US District Court in Northern California granted Turn's motion to compel arbitration. But a panel of three judges at the US Court of Appeals for the Ninth Circuit unanimously overturned that ruling on Tuesday.

"Turn attempts to invoke the arbitration agreement between Henson and Verizon to compel arbitration, but Henson and Turn do not have an arbitration agreement with each other," judges wrote this week.

Verizon's agreement with customers requires them to arbitrate disputes, but "Turn is not a signatory to the Customer Agreement and does not otherwise have an arbitration agreement with Henson," the ruling said. The judges vacated the district court order that granted Turn's motion to stay the lawsuit and compel arbitration, and they ordered Turn to "bear all costs of appeal."

Tracking cookies respawned after deletion

ProPublica reported in January 2015 that Turn was "taking advantage of a hidden undeletable number that Verizon uses to monitor customers' habits on their smartphones and tablets. Turn uses the Verizon number to respawn tracking cookies that users have deleted."

Shortly after that, Verizon said it would offer customers a way to opt out from having their devices tracked by the hidden identifiers, and Turn said it would stop using tracking cookies that can't be deleted. In March 2016, Verizon agreed to pay a $1.35 million fine and give users more control over "supercookies" in a settlement with the Federal Communications Commission. Verizon's use of the zombie cookies violated a net neutrality rule that requires Internet providers to disclose accurate information about network management practices to consumers, the FCC said.

But the class action is all about Turn's actions rather than Verizon's. This played a role in the judges' decision this week. Besides the fact that the arbitration clause doesn't apply to Turn, the lawsuit's claims against Turn were not even based on the customer agreement with Verizon, judges wrote:

Henson's complaint is replete with allegations of wrongdoing against Turn that have nothing to do with the Customer Agreement. Among other allegations, Henson claims that Turn violated Verizon users' "reasonable expectations of privacy by creating zombie cookies that users could neither detect nor delete, and which monitored user behavior well beyond web browsing"; that Turn acted "to disable the standard privacy controls employed by individuals (such as deleting or blocking cookies)"; that Turn "used Class members' personal, private, and confidential data for commercial gain without their knowledge or consent"; and that Turn consistently altered users' mobile devices by "circumventing privacy controls in said devices and causing said devices to transmit information to Turn to which Turn was not entitled." None of these allegations rely on the Customer Agreement or attempt to seek any benefit from its terms.

Henson also did not allege that Verizon colluded with Turn. "On the contrary, Henson alleges that 'Turn conducted its practices in secret' and acted without Verizon's knowledge, consent, or approval," the judges wrote. "Indeed, Henson claims that Verizon publicly rebuked Turn's alleged practices upon discovering them."

A separate business agreement between Turn and Verizon stipulated that the two companies were "independent of each other" and not acting in any sort of partnership or joint venture. The arbitration clause in Verizon's contract with customers thus wouldn't apply to disputes between Verizon customers and Turn, the appeals court ruled.

There was also a dispute over whether California or New York law should apply to the arbitration question. Turn argued that a New York law bound the parties to a choice-of-law provision in the customer agreement. But a choice-of-law clause is "a contractual right and generally may not be invoked by one who is not a party to the contract in which it appears," judges wrote. That means Verizon could benefit from the choice-of-law clause, but Turn could not.

Turn operates its business in California. "Because Henson sued Turn in the Northern District of California, we apply California’s choice-of-law principles," judges wrote.

Forced arbitration clauses aren't going away

The complaint against Turn was filed in April 2015 and asks the court to require Turn to delete all user data, change its data collection and opt-out practices, and return all "ill-gotten gains" to class members. The plaintiffs say that Turn "engaged in deceptive business practices" in violation of New York law and "committed trespass to chattels by intentionally interfering with the use and enjoyment of Verizon subscribers’ mobile devices."

Mandatory arbitration clauses deprive customers of their rights and help ISPs avoid serious punishment for actions that harm consumers, FCC Commissioner Mignon Clyburn and US Sen. Al Franken (D-Minn.) have argued. Franken has authored Senate legislation that would ban mandatory arbitration clauses, but the clauses remain legal.