Tracking the Trackers

Abstract

Online tracking poses a serious privacy challenge that has drawn significant attention in both academia and industry. Existing approaches for preventing user tracking, based on curated blocklists, suffer from limited coverage and coarsegrained resolution for classification, rely on exceptions that impact sites' functionality and appearance, and require significant manual maintenance. In this paper we propose a novel approach, based on the concepts leveraged from k-Anonymity, in which users collectively identify unsafe data elements, which have the potential to identify uniquely an individual user, and remove them from requests. We deployed our system to 200,000 German users running the Cliqz Browser or the Cliqz Firefox extension to evaluate its efficiency and feasibility. Results indicate that our approach achieves better privacy protection than blocklists, as provided by Disconnect, while keeping the site breakage to a minimum, even lower than the community-optimized Ad-Block Plus. We also provide evidence of the prevalence and reach of trackers to over 21 million pages of 350,000 unique sites, the largest scale empirical evaluation to date. 95% of the pages visited contain 3rd party requests to potential trackers and 78% attempt to transfer unsafe data. Tracker organizations are also ranked, showing that a single organization can reach up to 42% of all page visits in Germany.

I never signed up for this! Privacy implications of email tracking

“…The most widely used ad-blocking list is EasyList, and the most widely used tracker-blocking list is EasyPrivacy. Filter list based blocking introduces false positives and false negatives [43], but the popularity of ad blocking suggests that many users find the usability trade-off to be acceptable. While request-blocking extensions are supported primarily by web browsers, some email clients also have support for them, notably Thunderbird.…”

Cookie Synchronization: Everything You Always Wanted to Know But Were Afraid to Ask

“…78%) have 3rd parties which synchronize cookies with at least one other party, and they can reconstruct 62-73% of a user's browsing history [11]. Furthermore, 95% of pages visited contain 3rd party requests to potential trackers and 78% attempt to transfer unsafe data [46]. Finally, a mechanism for respawing cookies has been identified, with consequences on the reconstruction of users' browsing history, even if they delete their cookies [1].…”

Browser Fingerprinting

“…Yu et al proposed a concept in which users collectively identify unsafe data elements and report them to a central server [113]. In their model, all data elements are considered unsafe when they are first reported.…”