Cross-Device Tracking: Measurement and Disclosures

Abstract

Internet advertising and analytics technology companies are increasingly trying to find ways to link behavior across the various devices consumers own. This cross-device tracking can provide a more complete view into a consumer's behavior and can be valuable for a range of purposes, including ad targeting, research, and conversion attribution. However, consumers may not be aware of how and how often their behavior is tracked across different devices. We designed this study to try to assess what information about cross-device tracking (including data flows and policy disclosures) is observable from the perspective of the end user. Our paper demonstrates how data that is routinely collected and shared online could be used by online third parties to track consumers across devices.

I Spy with my Little Sensor Eye - Effect of Data-Tracking and Convenience on the Intention to Use Smart Technology.

“…In general, tracking can be understood as an analytic procedure with a user-centric view where personal and behavioral data are collected and aggregated to a detailed, person-specific profile [3,15]. A number of studies revealed that user behavior can be traced back even across multiple devices and that different websites pass on user information to third parties [7,[15][16][17].…”

I never signed up for this! Privacy implications of email tracking

“…PII leaks enable trackers to potentially attach identities to browsing histories. More recent work includes detection of PII leakage to third parties in smartphone apps [34,40], PII leakage in contact forms [38], PII leakage that enables cross-device tracking [12], and data leakage due to browser extensions [39].…”

“…This is an area for future work. Finally, our own approach is most similar to that of Brookman et al [12] and Starov et al [39] who test combinations of encodings and/or hashes.…”

“…The resulting links between identities and web history profiles belie the claim of "anonymous" web tracking. The practice enables onboarding, or online marketing based on offline activity [9], as well as cross-device tracking, or linking between different devices of the same user [12]. And although email addresses are not always shared with third parties in plaintext-sometimes they are hashed-we argue that hashing does little to protect privacy in this context (Section 8).…”

When the cookie meets the blockchain: Privacy risks of web payments via cryptocurrencies

“…There are a few straightforward mitigations that merchants could deploy: (1) enabling HTTPS on all shopping (and especially payment-related) pages -this would protect against network adversaries, but not third-party trackers, our main adversary of interest (2) generating Bitcoinaddress QR codes internally instead of outsourcing it to a third party; (3) avoiding leaks of the Bitcoin address from payment receipt pages; and (4) avoiding unintentional PII leaks. As to the last point, however, note that the attack succeeds as long as some first party website visited by the user leaks PII to third parties, and at least some PII leakage is for crossdevice linking purposes [24], and thus intentional. Beyond these obvious steps, merchants could share less data with third parties, and with fewer of them, but this would come at the expense of their advertising and analytics objectives.…”