The…wonderful people…who provide the means to implement this ‘feature’ prefer the term “HTTP Header Enrichment”. A search for that term will bring up documentation from various carrier-switching-widget vendors extolling its virtues(This, from Cisco, is particularly blatant about exactly who is being ‘enriched’ here.).
As you note; absolutely nothing needs to happen on the client, the modifications are made by the carrier to traffic between the cellular device and the remote host. Only viable defense is to force all traffic from the phone through a VPN so that the telco never actually gets to see anything except the tunnel.
