Report: Tracking the Trackers

Trackers are lurking in all areas of the Internet today, according to an international study conducted by Cliqz and Ghostery called “Tracking the Trackers: Analyzing the global tracking landscape with GhostRank.” The study was conducted using anonymous statistics from 850,000 users; it examined the risks of data collection posed by third-party trackers to users’ privacy.

It is the most comprehensive such study ever conducted: more than 144 million page loads were examined during the analysis. The research covered more than 12 countries, including the United States, Canada, Great Britain, France, Germany, Austria and Switzerland.

The study found that at least one tracker was prowling around 77.4 percent of the tested page loads. With the help of cookie or fingerprinting processes, these trackers tag along as users surf the Web, carefully recording their every move. In the most benign cases, this information is used only for statistical and advertising purposes. As a rule, a number of third-party tracking scripts hang out on popular websites, and they hitch a ride with users as they pass through domains. Ten or more trackers that amass personal data were found on 21.3 percent of the sites (unique domains) analyzed in the study.

Generally speaking, users never have any inkling that someone is looking over their digital shoulder – trackers are like apparitions to them. There is little or no transparency about the individuals who are chronicling users’ activities on a website. In addition, the site operators themselves frequently have no idea about the type of tracking scripts and pixels that are keeping company on their website.

The study also identified the most widely used trackers online. Google and Facebook stood out in particular, here. Google ranks in the top ten of the most widely used trackers based on page loads with five services. Facebook has three. Google Analytics was found on nearly half of all loaded pages (46.4 percent). Facebook Connect was on more than a fifth (21.9 percent).

A similar picture emerges when the total range of various tracking operators is examined: Google and Facebook are the leading duo here as well with a share of 60.3 percent and 27.1 percent, respectively. They are followed by ComScore (11.4 percent) and Twitter (10.5 percent).

When a user visits one website after another where an operator has planted trackers, the operator can then create a detailed profile of the user. The operator can see which online shops and news portals the user has visited. This peeping-tom activity extends to websites containing content about sex, addictions and even private bankruptcy.

Trackers can gain access to highly personal information from which conclusions can be drawn, not only about an individual’s financial situation, interests and shopping plans, but also about his or her sexual orientation, health, political views and religious beliefs. When a user then logs into his or her personal account on a web service, private information from previous site visits can be easily linked to him or her. The massive collection of data poses an imminent threat to people’s privacy.

Internet users are not even safe from trackers when they visit the websites of banks or hospitals. During the study, Cliqz even discovered a tracker on the web page where users reset their passwords. Theoretically, this could mean that a tracker operator could obtain the login information to the user’s online banking site and then have complete access to the account.

In the United States, the Mayo Clinic provides information about HIV tests to visitors of its website. Many different trackers keep a close eye on people who drop by the information page – knowing whether a site visitor clicks a button to arrange an appointment. This means that third-party companies are privy to very personal information about these individuals, including if they are taking an HIV test or being treated for the disease.

The results of the study show that trackers are omnipresent online. On occasion, significant regional differences were found among operators. But the largest tracking companies have a significant presence around the world. There is virtually no way that Internet users can escape the trackers placed by Google or Facebook. Even if a user consciously decides to avoid the services or products offered by Google and Facebook, the Internet companies can still monitor much of the user’s online activities with the help of tracking scripts they have planted on websites run by third parties.

Furthermore, 15 percent of analyzed websites share private data, some of which is very personal, to 10 or more tracker operators. The way that Google, Facebook, ComScore, Amazon and thousands of other tracking companies use this mountain of data is largely a mystery. Internet users know little about such questions as which specific data are being collected, where and for how long the data are stored, with which data the information is linked and who is given access to data.

In the universe without borders known as cyberspace, national data protection laws will never be able to form an invincible shield from trackers. For this reason, Internet users who want to protect their privacy have to take matters into their own hands if they want to screen themselves from the prying eyes of the omnipresent trackers. One simple and efficient step they can take is to use anti-tracking tools like Ghostery.

Most anti-tracking tools regularly use updated white and black lists containing tracking scripts and pixels that are authorized or should be blocked. Blocked trackers are simply not loaded when a website is called up. This reduces the time needed to completely load the site. Data usage is also lowered because no tracking data are being transmitted. But there is a downside to blocklists. First, the restrictive blocking rules can hamper certain website functions. Second, defined exceptions to prevent website malfunctions can enable trackers to gain access to some personal data anyway. Another problem is that tracker operators can change their URLs, domains and methods in order to bypass barriers at any time and the blocklist providers have to manually adjust their lists each time. Data may be possibly read until these changes are made.

To put an end to this cat-and-mouse game, Cliqz has developed an artificial-intelligence-based anti-tracking system with dynamic recognition ability. With the help of the local and global review of tracking data, it filters out those data in tracker inquiries that could be used to identify a user (user identifier, UID). These data will then be overwritten with random information before being transmitted to the trackers. As a result, tracker operators cannot identify visitors to a site. The AI-based technology has two major pluses: it hinders website functions much less frequently, and it works regardless of the tracking method being employed. As a result, it offers protection from modified and new types of tracking processes (including fingerprinting) and from specific measures taken to bypass anti-tracking defenses.

As the world’s most comprehensive anti-privacy tool, Ghostery combines the strengths of blocklist- and AI-based anti-tracking systems (blocklist + UID stripping). By melding these two technological approaches, Ghostery 8 sets new privacy standards for the Internet. Users will enjoy more speed and use less data while surfing because Ghostery will block the most popular trackers at the very start and will not load them. Furthermore, it also reliably and smoothly offers protection from tracking methods that are designed to identify users on the basis of personal data. Ghostery 8 accelerates web surfing, simplifies the process and increases its security. In doing so, it returns control of personal data to Internet users.

METHODOLOGY: The study is based on data collected via the GhostRank function of Ghostery from May 1 to May 14, 2017. GhostRank is a component of the browser expansion offered by Ghostery to all popular desktop browsers like Chrome, Edge and Firefox as well as mobile browsers. Users can select the opt-in function to share information about trackers to Ghostery. This information comprises a signal for each visited site and a signal for each query during a page load that corresponds to a pattern in Ghostery’s tracker database.