Web Tracking Technologies and Privacy

🎯 Learning Objectives

• Identify different web tracking mechanisms (cookies, fingerprinting, pixels)
• Explain how third-party tracking works across sites
• Analyze the privacy implications of tracking technologies
• Implement privacy-preserving alternatives
• Evaluate legal frameworks regulating web tracking

1. Introduction to Web Tracking

1.1 Intuition

1.2 The Tracking Ecosystem

2. Cookies: The Original Tracker

2.1 How Cookies Work

2.2 Third-Party Cookie Tracking

python
Run Inline
# Simulating how third-party cookies track across sites
class ThirdPartyTracker:
    def __init__(self, tracker_id):
        self.tracker_id = tracker_id
        self.user_profiles = {}  # user_id → {interests, sites visited}
    def record_visit(self, user_id, site, page_category):
        if user_id not in self.user_profiles:
            self.user_profiles[user_id] = {
                'sites_visited': set(),
                'interests': [],
                'first_seen': None
            }
        profile = self.user_profiles[user_id]
        profile['sites_visited'].add(site)
        profile['interests'].append(page_category)
        return self.get_ads_for_user(user_id)
    def get_ads_for_user(self, user_id):
        profile = self.user_profiles.get(user_id, {})
        interests = profile.get('interests', [])
        # Target ads based on accumulated interests
        if 'shoes' in interests and 'sports' in interests:
            return "Ad: Running shoes - 20% off!"
        elif 'travel' in interests:
            return "Ad: Flight deals to Europe"
        else:
            return "Ad: Generic product"
# Simulate user browsing
tracker = ThirdPartyTracker("ad_network_1")
# User visits different sites
print(tracker.record_visit("user123", "news.com", "sports"))
print(tracker.record_visit("user123", "shop.com", "shoes"))
print(tracker.record_visit("user123", "blog.com", "travel"))

pseudo
Ad: Generic product
Ad: Running shoes - 20% off!
Ad: Flight deals to Europe

2.3 Cookie Attributes (Security)

3. Browser Fingerprinting

3.1 Intuition

3.2 Fingerprint Components

3.3 The Panopticlick Study

3.4 Canvas Fingerprinting

javascript
Run Inline
// Simulated canvas fingerprinting
function getCanvasFingerprint() {
    const canvas = document.createElement('canvas');
    const ctx = canvas.getContext('2d');
    // Draw text with specific font
    ctx.textBaseline = 'top';
    ctx.font = '14px Arial';
    ctx.fillStyle = '#f60';
    ctx.fillRect(0, 0, 100, 50);
    ctx.fillStyle = '#069';
    ctx.fillText('Browser fingerprint!', 2, 2);
    // The exact rendering depends on GPU, fonts, OS
    const dataURL = canvas.toDataURL();
    // Hash the rendering differences
    return hashCode(dataURL);
}

4. Tracking Pixels and Beacons

4.1 How Pixels Work

html
<!-- Tracking pixel in email -->
<img src="https://tracker.com/pixel?user=abc&email_id=123&action=open"
     width="1" height="1" style="display:none;" />

• Email opened (loads pixel from server)
• IP address (geographic location)
• Timestamp (when you read the email)
• Device info (via User-Agent header)
• Referrer (which page/site you came from)

5. Privacy-Preserving Alternatives

5.1 Defense Mechanisms

5.2 ITP (Intelligent Tracking Prevention)

6. Common Pitfalls

Pitfall 1: Assuming Incognito = Private

Pitfall 2: Forgetting About Fingerprinting

Pitfall 3: Misunderstanding SameSite Attributes

7. Key Concepts Reference

8. 📝 Practice Questions

Q1: How does a third-party cookie track you across different websites?

Answer: When you visit Site A, it loads content from Tracker X (ad, analytics script). Tracker X sets a cookie in your browser. When you visit Site B, which also loads content from Tracker X, your browser sends the same cookie. Tracker X sees the cookie and knows it's the same user, recording both visits. Over time, Tracker X builds a profile of all the sites you visit that use its services. Q2: Why is canvas fingerprinting harder to block than cookies?

Answer: Canvas fingerprinting doesn't use storage — it's a normal browser function (drawing on a canvas). Blocking it would break legitimate canvas use (games, data visualization, photo editing). It's indistinguishable from legitimate canvas operations. Detecting canvas fingerprinting requires heuristic analysis (e.g., drawing in a hidden canvas), which can have false positives. Q3: A browser has a 1 in 100,000 unique fingerprint. How many bits of entropy does this represent?

Answer: Entropy = log₂(100,000) = 16.6 bits. This means the fingerprint carries 16.6 bits of identifying information. Combined with IP address (~16 bits), the pair is almost certainly unique — sufficient to identify a specific device among all internet users. Q4: What's the difference between SameSite=Lax and SameSite=Strict?

Answer: SameSite=Strict: Cookie is never sent for cross-site requests (including when clicking a link from Site A to Site B). SameSite=Lax: Cookie is sent for top-level navigation GET requests from other sites (clicking a link), but not for embedded requests (images, iframes, scripts). Lax is the default since Chrome 80 — it prevents CSRF attacks while allowing most legitimate navigation flows. Q5: How does ITP in Safari differ from third-party cookie blocking in Chrome?

Answer: Safari's ITP uses a more nuanced approach: it blocks third-party cookies by default but allows them if the user directly interacted with the domain recently. Chrome's approach is more binary: third-party cookies are either fully blocked (in Incognito) or fully allowed. Both are moving toward phasing out third-party cookies entirely (Chrome's Privacy Sandbox), but with different timelines and replacement mechanisms. Q6: What information does a tracking pixel in an email reveal?

Answer: (1) That the email was opened (and when), (2) the IP address (approximate location), (3) device/browser info from headers, (4) whether images were loaded (vs. text-only view), (5) engagement time (how long before the pixel loaded). This is why privacy-conscious email clients block images by default. Q7: Why is the combination of browser fingerprint and IP address usually unique?

Answer: An average browser fingerprint has ~18 bits of entropy (unique among ~286,000), and an IP address/User-Agent combination also carries ~16 bits. The combined entropy is ~34 bits, meaning the pair is unique among ~17 billion devices — far more than the ~5 billion internet users. Even a moderately unique fingerprint combined with a common IP is enough to identify a specific device.

9. 🔗 Cross-References

• Week 8 - Privacy Mechanisms: Anonymization techniques
• Week 5 - Case Studies: Cambridge Analytica tracking
• BSCS4024 (Computer Networks): HTTP, cookies, headers Join Discord PreviousText AnalysisNextCyber Crime