A Longitudinal Analysis of the ads.txt Standard

Bashir, Muhammad Ahmad; Arshad, Sajjad; Kirda, Engin; Robertson, William; Wilson, Christo

doi:10.1145/3355369.3355603

Cited by 18 publications

(18 citation statements)

References 36 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To identify resource inclusion from third-party A&A domains, we apply two heuristics to the HTTP requests in our inclusion trees. First, we match each requested URL against the EasyList and EasyPrivacy 10 block lists [10,11,13]. Second, we apply the methods developed by Fouad et al to identify inclusions of tracking pixels [35].…”

Section: Identifying Aanda Domainsmentioning

confidence: 99%

“…To estimate the number of unique Californians visiting websites in our corpus, we use data from the marketing research company Semrush. 11 In September 2020 we purchased a "custom report" from Semrush for $750 that contained the unique monthly US visitors to 203,365 of the 497,870 domains in our corpus in August 2020 (Semrush did not have visitor estimates for the remaining domains). These visitor counts are based on Semrush's proprietary measurement and estimation methods.…”

Section: Estimating Unique Visitorsmentioning

confidence: 99%

“…We scaled the unique visitor counts down by 88%, since California accounts for 12% of the internetenabled US population. 12 Thus, we assume that unique visitors to websites are uniformly distributed throughout the US. We revisit this limitation in § 6.1.…”

Section: Estimating Unique Visitorsmentioning

confidence: 99%

See 2 more Smart Citations

Setting the Bar Low: Are Websites Complying With the Minimum Requirements of the CCPA?

Nortwick

Wilson

2021

Proceedings on Privacy Enhancing Technologies

Self Cite

View full text Add to dashboard Cite

On June 28, 2018, the California State Legislature passed the California Consumer Privacy Act (CCPA), arguably the most comprehensive piece of online privacy legislation in the United States. Online services covered by the CCPA are required to provide a hyperlink on their homepage with the text “Do Not Sell My Personal Information” (DNSMPI). The CCPA went into effect on January 1, 2020, a date that was chosen to give data collectors time to study the new law and bring themselves into compliance. In this study, we begin the process of investigating whether websites are complying with the CCPA by focusing on DNSMPI links. Using longitudinal data crawled from the top 1M websites in the Tranco ranking, we examine which websites are including DNSMPI links, whether the websites without DNSMPI links are out of compliance with the law, whether websites are using geofences to dynamically hide DNSMPI links from non-Californians, how DNSMPI adoption has changed over time, and how websites are choosing to present DNSMPI links (e.g., in terms of font size, color, and placement). We argue that the answers to these questions are critical for spurring enforcement actions under the law, and helping to shape future privacy laws and regulations, e.g., rule making that will soon commence around the successor to the CCPA, known as the CPRA.

show abstract

Section: Identifying Aanda Domainsmentioning

confidence: 99%

Section: Estimating Unique Visitorsmentioning

confidence: 99%

See 1 more Smart Citation

Setting the Bar Low: Are Websites Complying With the Minimum Requirements of the CCPA?

Nortwick

Wilson

2021

Proceedings on Privacy Enhancing Technologies

Self Cite

View full text Add to dashboard Cite

show abstract

“…In this type of attack, fraudsters take advantage of the impossibility to validate the veracity of the information included in ad-tags or OpenRTB messages. Domain spoofing is a wellknown attack to introduce counterfeit inventory in the programmatic ecosystem [16]. In particular, fraudsters launch fraudulent ad requests from instrumented browsers claiming to come from popular domains, referred to as premium sites, where ad spaces are more expensive.…”

Section: B Lack Of Transparency and Fraud In Online Advertising 1) Pmentioning

confidence: 99%

“…There is a not negligible portion of publishers not adopting it. Moreover, Ads.txt imposes to blindly trust authorized sellers [20] and authorized resellers that could have received the requests through an unauthorized source [16]. Given the limitations of Ads.txt, the IAB launched the Ads.cert specification, whose beta version is included in OpenRTB 3.0.…”

Section: B Lack Of Transparency and Fraud In Online Advertising 1) Pmentioning

confidence: 99%