I don't understand how verizon can supercookie an unlocked generic device that only has a verizon SIM in it. If you don't have verizon apps installed, and it's

I don't understand how verizon can supercookie an unlocked generic device that only has a verizon SIM in it. If you don't have verizon apps installed, and it's not a branded handset, how are they attaching a supercookie to web browser traffic? If the traffic is secure (https), how do they change the http request headers?