Apart from the obvious data protection issues, perhaps an even more interesting and frightening aspect of the issue is that that phone number is probably there

Apart from the obvious data protection issues, perhaps an even more interesting and frightening aspect of the issue is that that phone number is probably there for a reason. It's entirely possible that some O2 or O2 partner sites use that header field to associate a visitor with an O2 customer. It would be interesting to see if that could be abused somehow, e.g. fake a phone number header to see if it's possible to "prank your friends" who use O2 or do something ever more malicious. (I'm not advocating anything like that, it's illegal and immoral and bad, I'm just curious if that would really work.)