Don’t Count Me Out: On the Relevance of IP Address in the Tracking Ecosystem

Abstract

Targeted online advertising has become an inextricable part of the way Web content and applications are monetized. At the beginning, online advertising consisted of simple ad-banners broadly shown to website visitors. Over time, it evolved into a complex ecosystem that tracks and collects a wealth of data to learn user habits and show targeted and personalized ads. To protect users against tracking, several countermeasures have been proposed, ranging from browser extensions that leverage filter lists, to features natively integrated into popular browsers like Firefox and Brave to combat more modern techniques like browser fingerprinting. Nevertheless, few browsers offer protections against IP address-based tracking techniques. Notably, the most popular browsers, Chrome, Firefox, Safari and Edge do not offer any. In this paper, we study the stability of the public IP addresses a user device uses to communicate with our server. Over time, a same device communicates with our server using a set of distinct IP addresses, but we find that devices reuse some of their previous IP addresses for long periods of time. We call this IP address retention and, the duration for which an IP address is retained by a device, is named the IP address retention period. We present an analysis of 34,488 unique public IP addresses collected from 2,230 users over a period of 111 days and we show that IP addresses remain a prime vector for online tracking. 87 % of participants retain at least one IP address for more than a month and 45 % of ISPs in our dataset allow keeping the same IP address for more than 30 days. Furthermore, we also detect the presence of cycles of IP addresses in a user's history and highlight their potential to be abused to infer traits of the user behaviour, as well as mobility traces. Our findings paint a bleak picture of the current state of online tracking at a time where IP addresses are overlooked compared to other techniques like cookies or fingerprinting. CCS CONCEPTS • Security and privacy → Privacy protections; Social aspects of security and privacy.

Survival Analysis and Prediction Model of IP Address Assignment Duration

“…Paper [5] studied the possibility of user tracking by their device IP addresses. For this purpose, the authors evaluated the stability of the addresses assigned to the end devices (or NAT device).…”

Privacy Limitations Of Interest-based Advertising On The Web: A Post-mortem Empirical Analysis Of Google's FLoC

“…Even without cookies, fingerprinting [13] allows third-parties to collect information from a user's browser to help identify the user, such as through IP addresses [20] or device-specific information [17]. Although cohorts are k-anonymous, when combining cohort IDs with fingerprinting data, it may be possible to isolate individuals into groups much smaller than the minimum target cohort size (k) or uniquely identify users.…”

OmniCrawl: Comprehensive Measurement of Web Tracking With Real Desktop and Mobile Browsers

“…Network-level Tracking. Researchers have demonstrated how to perform browser-independent tracking via DNS requests [55], TLS implementations [95], and IP addresses [68]. Also, because our work aims at getting measurements on the client side, we do not cover serverside HTTP headers fingerprinting [26,50,57], whose results cannot be observed on the client.…”