Cookie Synchronization: Everything You Always Wanted to Know But Were Afraid to Ask

Abstract

User data is the primary input of digital advertising, fueling the free Internet as we know it. As a result, web companies invest a lot in elaborate tracking mechanisms to acquire user data that can sell to data markets and advertisers. However, with same-origin policy, and cookies as a primary identification mechanism on the web, each tracker knows the same user with a different ID. To mitigate this, Cookie Synchronization (CSync) came to the rescue, facilitating an information sharing channel between third parties that may or not have direct access to the website the user visits. In the background, with CSync, they merge user data they own, but also reconstruct a user's browsing history, bypassing the same origin policy.In this paper, we perform a first to our knowledge in-depth study of CSync in the wild, using a year-long weblog from 850 real mobile users. Through our study, we aim to understand the characteristics of the CSync protocol and the impact it has on web users' privacy. For this, we design and implement CONRAD, a holistic mechanism to detect CSync events at real time, and the privacy loss on the user side, even when the synced IDs are obfuscated. Using CONRAD, we find that 97% of the regular web users are exposed to CSync: most of them within the first week of their browsing, and the median userID gets leaked, on average, to 3.5 different domains. Finally, we see that CSync increases the number of domains that track the user by a factor of 6.75.

Editors’ Introduction

“…Second, we are able to infer data sharing relationships between advertisers and trackers irrespective of whether it is happening at the client-side or the server-side. While prior work could only detect client-side data sharing [69] or infer serverside data sharing relationships when retargeting occurs [35], our approach is able to infer client-side and serverside data sharing for any advertiser placing bids without relying on specific triggers such as retargeting.…”

“…Advertisers making bids without correctly accounting for this parameter will generate zero bids. Second, and more interestingly, zero bidding is a form of underbidding -i.e., purposely making low bids with the motivation to gain access to user data (e.g., synced cookie [46,69]) associated with the impression rather than to win the auction. Although most exchanges which facilitate RTB auctions typically ban such behaviour and enforce mandatory minimum bidding participation, we find no such enforcement in HB auctions.…”

“…The entities in online advertising ecosystem use the cookie syncing mechanism to share user identifiers at the client-side while circumventing the browser's same-origin policy. Using the heuristic presented in [69], we detect client-side cookie syncing by looking for identifiers in the URL and the referrer field during our measurements.…”

“…Analysis of client-facilitated mechanisms in RTB, such as cookie syncing, to detect data sharing between entities is limited due to two reasons. First, prior research relies on different heuristics to detect cookie syncing at the client-side [32,67,69]. Unfortunately, these heuristics are brittle to changes in nonstandardized implementations of cookie syncing, especially when obfuscation is employed [35].…”

Tracking Users across the Web via TLS Session Resumption

“…User tracking via HTTP cookies and browser fingerprinting is a reality [2,4,15]. Tracking mechanisms are commonly used to observe conversions, namely whether an advertisement on website A leads to a desired user activity on website B. Herrmann et al [5] revealed that temporary tracking mechanisms can be used to identify users based on their characteristic browsing patterns over longer time periods.…”