Third-party Tracking Research Articles

Privacy concerns and the prevalence of third-party tracking cookies on ARL library homepages

PurposeThe integration of third-party resources on library websites may be inadvertently contributing to surveillance technologies without user knowledge. This study set out to determine the prevalence of third-party tracking cookies on Association of Research Libraries (ARL) member homepages, the entities that are tracking users and for what purpose and what control users have over their cookie preferences.Design/methodology/approachHomepages from the 124 ARL member libraries were visited. Evidence of a privacy or cookie statement was collected and cookie logs were captured. This data were compared against the Disconnect list of known trackers and analyzed to determine the extent to which third-party tracking cookies were used across ARL sites, who was setting the cookies and for what purpose, and whether this use differed with regards to a library's identifying features.FindingsIt was determined that many ARL libraries do contribute to the ability to track a user's activity across the web, with one-third containing third-party tracking cookies. A user's contact with tracking cookies is influenced by various traits defining the institution. Users are given very little control over the cookies logged on their machines.Originality/valueThis study explores library efforts to protect user privacy, adopting an introspective approach that focuses on library websites. It will provide discussion points for librarians to question not only what third-party tracking cookies are present on their sites and why, but also how to educate their users about privacy issues.

Planning for a cookie-less future: How browser and mobile privacy changes will impact marketing, targeting and analytics

Recent and impending changes to the way that browsers and mobile platforms handle third-party cookies and ad IDs will have a profound impact on the digital advertising ecosystem. This paper examines these changes in the context of the development of the ad-tech and digital media industry, and concludes that while these developments may benefit users by protecting them from intrusive third-party tracking and targeting, they risk further consolidating power with the three dominant companies in the sector, namely Google, Facebook and Amazon, and advertisers and marketers will have to work hard to ensure they do not become over-dependent on these suppliers. At the same time, the changes offer an opportunity to move back to a better equilibrium between advertising and the content that it appears alongside, driving value for both advertisers and consumers.

CNAME Cloaking-Based Tracking on the Web: Characterization, Detection, and Protection

Third-party tracking on the Web has been used for collecting and correlating user's browsing behavior. Due to the increasing use of ad-blocking and third-party tracking protections, tracking providers introduced a new technique called CNAME cloaking. It misleads Web browsers into believing that a request for a subdomain of the visited website originates from this particular website, while this subdomain uses a CNAME to resolve to a tracking-related third-party domain. This technique thus circumvents the third-party targeting privacy protections. The goals of this paper are to characterize, detect, and protect the end-user against CNAME cloaking based tracking. Firstly, we characterize CNAME cloaking-based tracking by crawling top pages of the Alexa Top 300,000 sites and analyzing the usage of CNAME cloaking with CNAME blocklist, including websites and tracking providers using this technique to track users' activities. We also point out that browsers and privacy protection extensions are largely ineffective to deal with CNAME cloaking-based tracking except for Firefox with a developer's version of the uBlock Origin extension. Secondly, we propose a supervised machine learning-based approach to detect CNAME cloaking-based tracking without the on-demand DNS lookup. We show that the proposed approach outperforms well-known tracking filter lists. Finally, to circumvent the lack of DNS API in Chrome-based browsers, we design and implement a prototype of the supervised machine learning-based browser extension to detect and filter out CNAME cloaking tracking, called CNAMETracking Uncloaker. Our evaluation shows that CNAMETracking Uncloaker is able to filter out CNAME cloaking-based tracking requests without performance degradation when compared with the vanilla setting on the Chrome browser.

Notified But Unaware: Third-Party Tracking Online

Drawing from conceptual studies on transparency, particularly with regard to market complexity, user literacy and resignation, this article studies and analyzes the practices of third-party data collection online. Empirically, we map third-party trackers on a sample of Swedish websites in five sectors (media, retail, banking/insurance, public sector, and health), and the trackers are compared to lists of known trackers to determine their main purpose. These results are then used in digital focus groups divided into high-trust and low-trust individuals, to better understand how everyday consumers perceive and cope with the tracking infrastructure. The main results indicate that third-party tracking is omnipresent online, particularly for media and retail sites, showing that data-driven markets depend on the collection, sharing and trade of consumers’ personal data. Furthermore, despite regulatory provisions promoting clearer notifications and designs within the EU, many users are still highly unaware of the data collection practices and their underlying purposes. The results indicate a weak consent base for data collection and a market structure and data collecting practices that are highly non-transparent. We recommend more active supervisory authorities, and more stringent requirements primarily in relation to the obscure ad tech infrastructures to improve transparency and promote consumer awareness.

A Measurement Study of Online Tracking and Advertising in Ibero-America

The ability of the online marketing industry to track and profile users' Web-browsing activity is what enables effective, tailored-made advertising services. The intrusiveness of these practices and the increasing invasiveness of digital advertising, however, have raised serious concerns regarding user privacy. Although the level of ubiquity of tracking and advertising has been investigated in top-world sites based in North America and Western Europe, the extent to which those practices are carried out in territories with less or no legal coverage -in terms of data protection- has not been studied so far. In this work, we present the first detailed measurement of online tracking and advertising conducted to date in one of those regions, namely, Ibero-America, by analyzing local websites (e.g., education and government sites). In doing so, our measurement study aims to find out how user location as well as the type of publisher may impact on tracking and advertising and thus user privacy. Lastly, our thorough, extensive analysis also explores whether differences are appreciated between Latin America and the EU with regard to the third-party tracking conducted from and towards the corresponding countries.

Online Advertising, Data Sharing, and Consumer Control

We examine how policies for the ownership and control of consumer-generated data affect market outcomes in the online advertising industry. When advertisers have strong property rights over data regarding consumers' active purchase interests, competition between ad exchanges leads to too little sharing of data between advertisers. This harms consumers, who receive too few pertinent ads, and advertisers themselves can also be harmed due to a situation resembling a prisoner's dilemma. We show that giving consumers property rights over their own data can improve outcomes; this happens when consumers can directly share data about their browsing history with ad exchanges. On the other hand, simpler consumer data rights, such as the right to not be tracked, can actually harm consumers due to how ad exchanges respond. Finally, initiatives by Apple and Google to limit third-party tracking, and introduce alternative tracking systems such as FLoCs, can benefit consumers by weakening the property rights of advertisers over consumer data. Because more data is shared by default under such systems, this is true even if these systems are less accurate than the third-party cookie system.

Prevalence of Third-Party Tracking on COVID-19–Related Web Pages

This study uses webXray, an automated tool that detects tracking on websites, to describe the prevalence and characteristics of third-party data requests and cookies on the top 20 COVID-19–related websites, including academic and government sites, from US-based search results in May 2020.

Enhanced Performance and Privacy for TLS over TCP Fast Open

Abstract Small TCP flows make up the majority of web flows. For them, the TCP three-way handshake induces significant delay overhead. The TCP Fast Open (TFO) protocol can significantly decrease this delay via zero round-trip time (0-RTT) handshakes for all TCP handshakes that follow a full initial handshake to the same host. However, this comes at the cost of privacy limitations and also has some performance limitations. In this paper, we investigate the TFP deployment on popular websites and browsers. We found that a client revisiting a web site for the first time fails to use an abbreviated TFO handshake in 40% of all cases due to web server load-balancing using multiple IP addresses. Our analysis further reveals significant privacy problems of the protocol design and implementation. Network-based attackers and online trackers can exploit TFO to track the online activities of users. As a countermeasure, we introduce a novel protocol called TCP Fast Open Privacy (FOP). TCP FOP prevents tracking by network attackers and impedes third-party tracking, while still allowing 0-RTT handshakes as in TFO. As a proof-of-concept, we have implemented the proposed protocol for the Linux kernel and a TLS library. Our measurements indicate that TCP FOP outperforms TLS over TFO when websites are served from multiple IP addresses.

Excessive data collection: Privacy considerations and abuse of dominance in the era of big data

The present era of big data challenges many of the basic assumptions of competition law. One particularly pressing question is: to what extent should privacy considerations and data protection filter into competition law assessments? The paper focuses on personalized user data that companies gather through third-party tracking on the web. This practice allows the tracker to build comprehensive user profiles across platforms and devices, placing an unprecedented volume of up-to-date personal data in the hands of a small number of globally active companies. Focusing on the stage of data acquisition, the paper assesses two scenarios under which EU competition law may deem the vast amounts of data gathered by certain digital platforms excessive under Article 102(a) TFEU: excessive data “prices” and data policies as unfair trading conditions. In both cases, the competition law assessment is autonomous from other areas of the law: while a breach of data protection rules is not automatically a breach of competition law, a company adhering to data protection rules may still violate competition laws. The paper finds that EU competition law already possesses the necessary tools to address excessive data collection, while data protection rules provide much-needed context for this type of exploitative abuse.

Excessive Data Collection: Privacy Considerations and Abuse of Dominance in the Era of Big Data

The digital economy challenges many of the basic assumptions of competition law. With the rise of big data and big data analytics, one question has become particularly pressing: to what extent should privacy considerations and data protection laws filter into competition law assessments? The present paper focuses on personalized user data that companies gather online through third-party tracking. This practice allows the tracker to build comprehensive user profiles across platforms and across devices, resting an unprecedented volume of up-to-date personal data in the hands of a small number of globally active companies. Starting from the question whether and to what extent competition law should be concerned about privacy, the paper addresses the question whether the vast amounts of data gathered by certain companies through third-party tracking may be deemed excessive under Article 102(a) TFEU, thus making an analogy with excessive prices possible. It is also considered whether excessive data collection may constitute a stand-alone abuse under the heading of unfair trading conditions, based on a decrease in quality or the mere excessiveness of the personal data gathered. In this context, the paper discusses the recent German Facebook decision as a test case for excessive data collection.

Competition, Market Power and Third-Party Tracking

The prevalence of third-party tracking in our modern ecosystem cannot be ignored. Trackers, on our websites and apps, enable multi-sourced data gathering, at distinct volume, variety, velocity and veracity. While numerous operators engage in tracking, the majority of these trackers are controlled by a small number of data giants. In this article we consider the rise and growth of this industry, the power it has bestowed on a handful of platforms, and the possible implications for consumer welfare and competition.

A Cartography of Web Tracking using DNS Records

Web tracking plays a crucial role in the Web ecosystem. It relies on third-party tracking actors collecting user information that are used for various applications such as advertisement and analytics, etc. With the massive growth of the Internet, understanding the geography of tracking is of strategic importance. The goal of this paper is to propose a thorough investigation of web tracking inside China taking advantage of a large dataset (1011 records) containing two days of full DNS access from a major ISP providing both mobile and landline ADSL. Our results show that a strong Pareto principle applies on the traffic toward trackers, with only 26 trackers, representing 90% of tracking activity. We then show that although most first-party sites accessed from China are owned by Chinese corporations, large proportion of trackers belong to US ones. This raises concerns about the advertisement industry in China, and more generally shed new lights on the international data flows, the interdependency of the main actors, and the complexity of the threats for both people and states.

Competition, Market Power and Third-Party Tracking

The prevalence of third-party tracking in our modern ecosystem cannot be ignored. Trackers, on our websites and apps, enable multi-sourced data gathering, at distinct volume, velocity, verity and veracity. While employed by numerous operators, the majority of these trackers are controlled by a handful of data giants. In this article we consider the rise and growth of this industry, the power it has bestowed on a handful of businesses, and the possible implications for consumer welfare and competition.

Third-Party Onboarding Organizations as Gatekeepers for Student Placement Decisions

Health system human resource departments are putting new requirements, paperwork, and processes in place to meet new Joint Commission standards for treating students like employees who onboard at the beginning of employment. These processes have significantly increased the workload of experiential education offices and present an additional burden to students. In an attempt to streamline these processes, health systems are contracting with third-party tracking and placement organizations. Converting this process to an electronic one (such as what third-party organizations offer) could present advantages; however, there are many concerns about going through a third-party organization that could control placement decisions. This commentary describes these concerns and provides guidance to schools should they choose to work with one of these organizations.

Privacy on Adult Websites

As it does in polite conversation, pornography goes unmentioned in policy discussions. This paper begins a conversation about this major use of the web, one that is sensitive and could lead to embarrassment and harm to users if publicized. In countries where pornography is illegal, tracking of these behaviors could have profound consequences for users. Viewing such material is legal in the US, yet authorities may wish to avoid the topic of protecting its consumers.We document and discuss the user tracking dynamics on the most popular adult-oriented websites (N=11). Tracking dynamics are different on adult sites than other popular sites. There are relatively fewer third-party tracking companies involved and fewer cookies than on comparably popular sites. However, we found that Google trackers (Google Analytics and/or DoubleClick) were present on almost all the sites and that search terms were often leaked in plaintext to third parties and sometimes encoded in cookies. Finally, the dominance of video in pornography could explain the presence of Flash on almost half the sites. We found Flash being used to read HTTP cookie values, but we did not find any evidence of Flash cookies respawning.

TrackerDetector: A system to detect third-party trackers through machine learning

Privacy violation caused by third-party tracking has become a serious problem, and the most effective defense against it is blocking. However, as the core part of blocking, the blacklist is usually manually curated and is difficult to maintain. To make it easier to generate a blacklist and reduce human work, we propose an effective system with high accuracy, named TrackerDetector, to detect third-party trackers automatically. Intuitively, the behaviors of trackers and non-trackers are different, which leads to different JavaScript API sets being called. Thus, an incremental classifier is trained from JavaScript files crawled from a large number of websites to detect whether a website is a third-party tracker. High accuracy of 97.34% is obtained with our dataset and that of 93.56% is obtained within a 10-fold cross validation.

"I would have never allowed it": User Perception of Third-party Tracking and Implications for Display Advertising

This study examines the perception on third-party tracking of German Internet users. For that purpose, 20 users without a technical background were interviewed. Results indicate that users are not aware of online tracking. They are often surprised by the magnitude of tracking programs they are exposed to during everyday life online activities like travel planning, job or product research. While the interviewees were willing to concede the theoretical advantages of such data collection, e.g. for behavioral targeting, they considered the price as too high to compensate for the loss of privacy control. The participants showed concerns that tracking could possibly lead to disadvantages in real life. In addition, behavioral targeting is assessed fairly redundant. Asked about concepts for enhanced transparency and control, the interviewed people still emphasized their distrust toward tracking. Thus, third-party tracking is a doubled edged sword for online advertising. On the one hand, it is a central means to improve the relevancy of the often unwanted display ads. At the same time, there is a great danger of increasing ad aversion for privacy reasons.

Belgium ∙ Facebook Loses the First Round of Its Battle with the Belgian Privacy Commission

1. It all started in February 2015. University researchers, commissioned by the Belgian Privacy Commission, published a report containing a legal analysis, under Belgian law, of Facebook’s revised terms of use and privacy policy. Facebook had applied them as from 30 January 2015.1 These revised terms allowed Facebook to track both users and nonusers across websites and devices, by using social plug-ins and cookies. In particular, by using the socalled ‘datr’ cookie, Facebook was able to monitor both users and non-users in a variety of ways, on and off Facebook.2 The academic research report concluded that these ‘tracking’ activities violated both European and Belgian data protection legislation.3 2. On 13May 2015, the Privacy Commission issued a formal recommendation. It criticised Facebook’s tracking activities, and it formally requested Facebook to cease these activities.4 Although recommendations of the Belgian Privacy Commission are not legally binding, they should de facto be obeyed in order to avoid non-compliance issues. According to the Privacy Commission, Facebook’s tracking activities are more intrusive than other cases of so-called ‘third-party tracking’. It is indeed able to track surfing behaviour over a large number of websites, and to link this surfing behaviour to users’ real identity, social network interactions and even their medical information and religious, sexual and political preferences. To justify its collection of data through social plug-ins, Facebook relies upon the individual’s consent. The Privacy Commission, however, concluded that the conditions for valid (free and informed) consent were not met, and that there was no legal ground for Facebook’s tracking activities, particularly when it came to the tracking of nonusers. 3. After several months of negotiations, it was clear that no amicable solution could be found. The Privacy Commission consequently sued Facebook before the President of the Brussels Court of First Instance in summary proceedings. The relief sought was an injunction prohibiting the use by Facebook of the ‘datr’ cookie through social plugins to track non-users, without first giving them sufficient and adequate information in this re-

Browse at your own risk

The paper states that even without cookies, fingerprinting lets advertisers track your every online move. In the past, clearing cookies after each session or selecting your browser's “Do Not Track” setting could prevent third-party tracking. But the advent of browser fingerprinting makes it very difficult to prevent others from monitoring your online activities. The diagram at right outlines how an online advertising network can track the sites you visit using fingerprinting.

Do-Not-Track and the Economics of Third-Party Advertising

Two recent disruptions to the online advertising market are the widespread use of ad-blocking software and proposed restrictions on third-party tracking, trends that are driven largely by consumer concerns over privacy. Both primarily impact display advertising (as opposed to search and native social ads), and affect how retailers reach customers and how content producers earn revenue. It is, however, unclear what the consequences of these trends are. We investigate using anonymized web browsing histories of 14 million individuals, focusing on “retail sessions” in which users visit online sites that sell goods and services. We find that only 3% of retail sessions are initiated by display ads, a figure that is robust to permissive attribution rules and consistent across widely varying market segments. We further estimate the full distribution of how retail sessions are initiated, and find that search advertising is three times more important than display advertising to retailers, and search advertising is itself roughly three times less important than organic web search. Moving to content providers, we find that display ads are shown by 12% of websites, accounting for 32% of their page views; this reliance is concentrated in online publishing (e.g., news outlets) where the rate is 91%. While most consumption is either in the long-tail of websites that do not show ads, or sites like Facebook that show native, first-party ads, moderately sized web publishers account for a substantial fraction of consumption, and we argue that they will be most affected by changes in the display advertising market. Finally, we use estimates of ad rates to judge the feasibility of replacing lost ad revenue with a freemium or donation-based model.