Detecting and defending against third-party tracking on the web

TLDR

Third‑party web tracking is widely discussed but its mechanisms remain poorly understood. The study aims to dissect mainstream web tracking in the wild and evaluate existing defenses, motivating a new defense against social‑media widget tracking. The authors built a client‑side detection system that classifies five tracker types by their manipulation of browser state. The system uncovered more than 500 unique trackers, revealed that most commercial sites are tracked by multiple parties with uneven coverage, showed that some trackers can capture over 20 % of user browsing, and found that current browser defenses fail against social‑media widget tracking.

Abstract

While third-party tracking on the web has garnered much attention, its workings remain poorly understood. Our goal is to dissect how mainstream web tracking occurs in the wild. We develop a client-side method for detecting and classifying five kinds of third-party trackers based on how they manipulate browser state. We run our detection system while browsing the web and observe a rich ecosystem, with over 500 unique trackers in our measurements alone. We find that most commercial pages are tracked by multiple parties, trackers vary widely in their coverage with a small number being widely deployed, and many trackers exhibit a combination of tracking behaviors. Based on web search traces taken from AOL data, we estimate that several trackers can each capture more than 20% of a user's browsing behavior. We further assess the impact of defenses on tracking and find that no existing browser mechanisms prevent tracking by social media sites via widgets while still allowing those widgets to achieve their utility goals, which leads us to develop a new defense. To the best of our knowledge, our work is the most complete study of web tracking to date.