Safari Trackers

Apple’s Safari web browser is configured to block third-party cookies by default. We identified four advertising companies that unexpectedly place trackable cookies in Safari. Google and Vibrant Media intentionally circumvent Safari’s privacy feature. Media Innovation Group and PointRoll serve scripts that appear to be derived from circumvention example code.

In the interest of clearly establishing facts on the ground, this post provides technical analysis of Safari’s cookie blocking feature and the four companies’ practices. It does not address policy or legal issues. (More on that soon.)

Before proceeding further, I want to thank the countless friends and colleagues who provided invaluable feedback on this project. In particular: ★★★★★, whose insights have been vital at every step, and Ashkan Soltani, whose crawling data was instrumental in uncovering PointRoll’s practices and understanding the prevalence of cookie blocking circumvention.


Tracking the Trackers: Where Everybody Knows Your Username

Original at the Stanford Center for Internet and Society.

Click the local Home Depot ad and your email address gets handed to a dozen companies monitoring you. Your web browsing, past, present, and future, is now associated with your identity. Swap photos with friends on Photobucket and clue a couple dozen more into your username. Keep tabs on your favorite teams with Bleacher Report and you pass your full name to a dozen again. This isn’t a 1984-esque scaremongering hypothetical. This is what’s happening today.

[Update 10/11: Since several readers have asked – this study was funded exclusively by Stanford University and research grants to the Stanford Security Lab. It was not supported by any advocacy organization.]


Tracking the Trackers: Self-Help Tools

Original at the Stanford Center for Internet and Society.

A number of technologies have been touted to offer consumers control over third-party web tracking. This post reviews the tools that are available and presents empirical evidence on their effectiveness. Here are the key takeaways:

  1. Most desktop browsers currently do not support effective self-help tools. Mobile users are almost completely out of luck.
  2. Self-help tools vary substantially in performance.
  3. The most effective self-help tools block third-party advertising.

Following the usage model in the FTC staff’s 2010 preliminary online privacy report, this post is oriented towards the user who wants a simple, persistent, comprehensive solution such that with high confidence no third party collects her browsing history. We assume that some third-party trackers will use non-cookie tracking methods including supercookies and fingerprinting (e.g. Microsoft, KISSmetrics, Epic Marketplace, BlueCava, Interclick, Quantcast).

Thanks to Jovanni Hernandez and Akshay Jagadeesh for assisting with data collection, and to Arvind Narayanan and Peter Eckersley for input on drafts.


Tracking the Trackers: Microsoft Advertising

Original at the Stanford Center for Internet and Society.

Despite all the attention they’ve received in the debates around online privacy, cookies are far from the only way to track a user. Broadly speaking, a website can either stash a unique identifier anyplace in the browser (“tagging”)1 or explore features of the browser until it becomes unique (“fingerprinting”).2 Tracking technologies that do not rely on cookies are often referred to as “supercookies,” and they are widely viewed as unsavory in the computer security community because they continue tracking even when a user clears her cookies to preserve privacy. Sometimes a site will use a supercookie to “respawn” its original identifier cookie, creating a “zombie cookie” — the basis of several lawsuits.

In one of our recent FourthParty web measurement crawls we included a cookie clearing step to emulate a user’s privacy choice. We observed that after clearing the browser’s cookies an identifier cookie (named “MUID” for “machine unique identifier”) respawned on, a Microsoft domain. We dug into Microsoft’s cross-domain cookie syncing code and discovered two independent supercookie mechanisms, one of which was respawning cookies. We contacted Microsoft with our observations, and we have collaborated to assist in rectifying the issues we uncovered. Here is what we know.

Thanks, once again, to Jovanni Hernandez and Akshay Jagadeesh for their indispensable research assistance.


Tracking the Trackers: The AdChoices Icon

Original at the Stanford Center for Internet and Society.

Jovanni Hernandez and Akshay Jagadeesh are the first authors of this study.

Responding to pressure from the Federal Trade Commission, in mid-2009 the largest advertising industry trade groups joined forces to develop a new self-regulatory program for behavioral advertising: the Digital Advertising Alliance (DAA). Like the parallel self-regulatory program for advertising networks, the Network Advertising Initiative (NAI), the DAA makes no promises about providing privacy choices: DAA members must only provide an opt out of seeing advertising that is based on tracking, not an opt out of tracking itself.1 As Chris Hoofnagle at Berkeley Law has noted on several occasions, the word “privacy” scarcely even appears in the DAA’s documents.


FourthParty: A New Approach to Web Measurement

Original at the Stanford Center for Internet and Society.

Last week marked the twentieth anniversary of the public World Wide Web, and there is much to celebrate. The early web consisted of a few text pages linked together; the modern web supports audio, video, interactivity, complex storage, and even native applications. Both Microsoft and Google are now developing entire operating systems around web technologies.

Tools for measuring the web have not kept pace. Many studies still rely on HTTP header logging and static analysis of HTML, CSS, and JavaScript. Researchers who want to go beyond these simple tools are often forced to develop purpose-built software from scratch.

Today we’re releasing FourthParty, an open-source platform for web measurement. FourthParty is built on Mozilla Firefox and the Add-on SDK, making it fast, modular, easy to use, multi-platform, and up-to-date with the latest web technologies. And FourthParty is already generating research results: it’s the tool we’ve been using in our Tracking the Trackers studies (1, 2). To learn more and get started, visit

Tracking the Trackers: To Catch a History Thief

Original at the Stanford Center for Internet and Society.

Last week we reported some early results from the Stanford Security Lab‘s new web measurement platform on how advertising networks respond to opt outs and Do Not Track. This week we’re back with a new discovery in the online advertising ecosystem: Epic Marketplace,1 a member of the self-regulatory Network Advertising Initiative (NAI), is history stealing.

Many thanks once again to research assistants Akshay Jagadeesh and Jovanni Hernandez.


Tracking the Trackers: Early Results

Original at the Stanford Center for Internet and Society.

Over the past several months researchers at the Stanford Security Lab have been developing a platform for measuring dynamic web content. One of our chief applications is a system for automated enforcement of Do Not Track by detecting the myriad forms of third-party tracking, including cookies, HTML5 storage, fingerprinting, and much more. While the software isn’t quite polished enough for public release, we’re eager to share some unexpected early results on the advertising ecosystem. Please bear in mind that these are preliminary findings from experimental software; our primary aims at this stage are developing the platform and validating the approach to third-party tracking detection. Many thanks to Jovanni Hernandez and Akshay Jagadeesh for their invaluable research assistance.


Do Not Fool Will Make the Internet Explode

Original at the Stanford Center for Internet and Society.

Joint post with Arvind Narayanan.

Earlier today Mozilla announced support for Do Not Fool, a proposed mechanism for opting out of April Fools’ pranks. We cannot support this misguided effort.

First, Do Not Fool would require fundamentally reengineering the Internet, the HTTP protocol, and countless websites. Many of your favorite web destinations like The Onion rely on fooling.

Second, fooling is integral to the American competitive landscape and to innovation. In fact, Do Not Fool would demolish the web’s revenue channels. Don’t just take our word for it—industry-funded, non-peer reviewed, quasi-relevant research proves that fooling accounts for over 99.9% of online revenues.

Third, self-regulation is working. Every time you get fooled today, you have the opportunity to click a tiny icon—on sites that support it—to learn more about how you’ve been fooled. And over fifty major pranksters already allow you to set a cookie to opt out of getting fooled by them, once you figure out who they are. (Though roughly half are just fooling you with that opt out.)

Don’t enable this dangerous new feature. Don’t be fooled by Do Not Fool.