Tracing Cross Border Web Tracking

Abstract

A tracking ow is a ow between an end user and a Web tracking service. We develop an extensive measurement methodology for quantifying at scale the amount of tracking ows that cross data protection borders, be it national or international, such as the EU28 border within which the General Data Protection Regulation (GDPR) applies. Our methodology uses a browser extension to fully render advertising and tracking code, various lists and heuristics to extract well known trackers, passive DNS replication to get all the IP ranges of trackers, and state-of-the art geolocation. We employ our methodology on a dataset from 350 real users of the browser extension over a period of more than four months, and then generalize our results by analyzing billions of web tracking ows from more than 60 million broadband and mobile users from 4 large European ISPs. We show that the majority of tracking ows cross national borders in Europe but, unlike popular belief, are pretty well conned within the larger GDPR jurisdiction. Simple DNS redirection and PoP mirroring can increase national connement while sealing almost all tracking ows within Europe. Last, we show that cross boarder tracking is prevalent even in sensitive and hence protected data categories and groups including health, sexual orientation, minors, and others.

Cookie Synchronization: Everything You Always Wanted to Know But Were Afraid to Ask

“…Therefore, it is important to design practical, web transparency tools such as CONRAD, which will be readily available to privacy researchers, regulators and end-users. These tools can be used by plain users or the research community to investigate personal data leakage and anonymity on the web, due to 3rd parties' activities such as CSync [21].…”

Missed by Filter Lists: Detecting Unknown Third-Party Trackers with Invisible Pixels

“…We then use the filter lists to classify follow-up thirdparty requests that would have been blocked by the lists. This technique has been extensively used in the previous works [23,[28][29][30] (for more details, see Table 12 in the Appendix). We classify a request as blocked if it matches one of the conditions: -the request directly matches the list.…”

Characterising Third Party Cookie Usage in the EU after GDPR

“…GDPR is newly introduced, and so there have only been a handful of measurements and analyses: [6] concluded that tracking flows mostly stay within the EU. In a periodic survey of top 500 sites, [3] found that around one-sixth of websites (15.7%) had reorganised privacy policies by May 25, 2018.…”