Variable subscriber identifiers (V-SubIds) for protecting subscriber privacy are generated and managed. In one aspect, an Anonymous Customer Reference Services (ACRS) component generates a V-SubId, which is a short-lived subscriber identifier that is inserted in a request received from a user equipment during request enrichment. Moreover, a different V-SubId can be inserted in subsequent request from the user equipment and thus, cross-site behavior tracking can be mitigated. In one aspect, the V-SubId can be exchanged for a subscriber identifier (SubId) associated with the user equipment, upon query by trusted systems/applications. Further, the V-SubId can be exchanged for a site-specific Anonymous Customer Reference (ACR) upon query by untrusted systems/applications, if user authorization is received. Moreover, the life cycle of the ACR is managed by the ACRS component, based on subscriber input.