Source-linked AI summary
Tracing Information Flows Between Ad Exchanges Using Retargeted Ads
Muhammad Ahmad Bashir, Sajjad Arshad, William Robertson, Christo Wilson
TL;DR
Ad exchanges share user data, but prior cookie-matching methods rely on brittle heuristics. This paper uses retargeted ads to detect information flows; it reports that existing heuristics miss 31% of sharing pairs and discusses flow-based ad blocking as a possible user tool.
Problem
Ad exchanges routinely share user data through cookie matching, while prior studies use brittle heuristics that do not capture all sharing behaviors.
Source: §1 · p. 1Method
The method uses retargeted ads and their serving conditions to infer information flows between exchanges without depending on particular cookie-matching mechanisms.
Source: §1 · p. 2, §7 · p. 14Results
31% of ad-exchange pairs that share data are missed by prior heuristic methods, and the method categorizes four kinds of information sharing.
Source: §1 · p. 2, §7 · p. 14Takeaways & Limitations
Flow-based browser tools could block cookie-matching flows while still allowing advertising, although making such a system cost effective remains an open challenge.
Source: §7 · p. 14False negatives may miss sharing pairs, though the authors say the practical impact is low because one correctly identified retargeted ad suffices to infer sharing.
Source: §5.3 · p. 9
Abstract
from arXiv · showhide
Numerous surveys have shown that Web users are concerned about the loss of privacy associated with online tracking. Alarmingly, these surveys also reveal that people are also unaware of the amount of data sharing that occurs between ad exchanges, and thus underestimate the privacy risks associated with online tracking. In reality, the modern ad ecosystem is fueled by a flow of user data between trackers and ad exchanges. Although recent work has shown that ad exchanges routinely perform cookie matching with other exchanges, these studies are based on brittle heuristics that cannot detect all forms of information sharing, especially under adversarial conditions. In this study, we develop a methodology that is able to detect client- and server-side flows of information between arbitrary ad exchanges. Our key insight is to leverage retargeted ads as a tool for identifying information flows. Intuitively, our methodology works because it relies on the semantics of how exchanges serve ads, rather than focusing on specific cookie matching mechanisms. Using crawled data on 35,448 ad impressions, we show that our methodology can successfully categorize four different kinds of information sharing behavior between ad exchanges, including cases where existing heuristic methods fail. We conclude with a discussion of how our findings and methodologies can be leveraged to give users more control over what kind of ads they see and how their information is shared between ad exchanges.
1 Introduction
Ad exchanges routinely share user data, but prior cookie-matching heuristics miss obfuscated and server-side flows. The paper uses retargeted ads to infer information sharing and reports that existing heuristics miss 31% of sharing pairs.
1 Introduction
- Ad exchanges routinely match cookies to synchronize identifiers and share user data, despite users’ naïve belief that privacy policies prevent third-party sharing.Cookie matching is a precondition for exchanges to participate in Real Time Bidding auctions.Source: §1 · p. 1
- Prior methods based on HTTP-message strings are brittle under obfuscation and cannot detect server-side information flows between ad networks.DoubleClick cryptographically hashes cookies before sending them to other networks.Source: §1 · p. 1
- The method detects client- and server-side flows between arbitrary exchanges by using retargeted ads, whose strict serving conditions reveal the tracking information flow.The approach relies on ad-serving semantics rather than particular cookie-matching mechanisms.Source: §1 · p. 2
- The study analyzes 35,448 inclusion chains linked to 5,102 retargeted ads, using instrumented Chromium and pattern matching to identify exchange pairs and sharing mechanisms.The chains came from crawls using 90 shopper personas and major publishers.Source: §1 · p. 2
- 31% of ad-exchange pairs that share data are missed by prior cookie-matching heuristics, while the proposed method categorizes four kinds of information sharing.The paper also reports empirical evidence that Google uses its data-sharing capability to serve retargeted ads, and uses graph analysis to infer exchange roles.Source: §1 · p. 2
- The authors propose that flow-based browser tools could block cookie matching while still allowing untargeted ads, unlike tools that block all ads.They note such a system would need to be cost effective because it relies on crowdsourced labor.Source: §1 · p. 2
2 Background and Definitions
Online display advertising connects publishers’ inventory with advertisers seeking particular users, increasingly through real-time auctions. Tracking, cookie matching, and retargeting allow exchanges to identify users and serve product-specific ads.
2.1 Online Display Advertising
- Ad networks aggregate publisher inventory and connect it with advertisers, generating publisher revenue through impression- or click-based models.Inventory may be sold by Cost per Mille or Cost per Click.Source: §2.1 · p. 2
- In Real-time Bidding, advertisers bid on individual impressions, while SSPs work with publishers and DSPs assess impressions for advertisers.Some companies offer products spanning multiple exchange roles.Source: §2.1 · pp. 2–3
2.2 Targeted Advertising
- Behavioral targeting relies on trackers collecting users’ browsing actions through embedded scripts or tracking pixels and third-party cookies.All major ad exchanges track users, while some companies specialize in tracking.Source: §2.2 · p. 3
- Cookie matching uses an HTTP redirect to map an SSP cookie to a DSP cookie, allowing the DSP to recognize matched users in a later auction.Some exchanges send cryptographically hashed cookies to partners, preventing their true cookies from leaking.Source: §2.2 · p. 3
- A retargeted ad requires a DSP to know that a user browsed a specific product on a specific retailer and to identify that user during an auction.Cookie matching enables the second condition.Source: §2.2 · pp. 3–4
3 Related Work
Prior work measured advertising, tracking, and cookie matching, but did not capture all information sharing between exchanges. The paper’s approach is motivated by gaps in methods that rely on visible identifiers and HTTP headers.
3.1 Measuring the Ad Ecosystem
- Prior ecosystem studies measured ad targeting, tracker prevalence, tracking mechanisms, user profiles, and mobile or malicious advertising; the cited studies did not examine retargeted ads or exchange information sharing.Carrascosa et al. specifically excluded retargets.Source: §3.1 · p. 4
3.2 Cookie Matching and Retargeting
- Empirical cookie-matching studies found widespread identifier sharing, while retargeting studies measured ad identification or costs rather than general exchange-to-exchange flows.Prior work reported 125 exchanges using cookie matching and retargeted-ad costs exceeding $1 per impression.Source: §3.2 · pp. 4–5
- Earlier methods miss obfuscated identifiers and cannot reliably determine which exchanges send or receive data because they depend on HTTP headers and specific matching patterns.The proposed study instead seeks mechanism-agnostic detection based on the semantics of ad exchanges.Source: §3.2 · p. 5
4 Methodology
The methodology infers information sharing from retargeted ads, then uses browser instrumentation, shopper personas, and publisher crawls to collect the evidence. Inclusion chains capture resource provenance, while the study’s crawl design covers diverse shopping sites and publishers.
4.1 Insights and Approach
- A retargeted ad generally implies that exchanges shared user information, because the DSP must know the product browsing and identify the user in an auction.The workflow has a clean browser visit e-commerce sites, then crawl publishers and gather ads.Source: §4.1 · p. 5
4.2 Instrumenting Chromium
- Instrumented Chromium records inclusion chains that capture resource origins even when JavaScript or Flash dynamically generates requests, unlike DOM trees or Referer headers.These chains help distinguish client-side cookie matching from server-side flows.Source: §4.2 · p. 6, Figure 3 · p. 6
4.3 Creating Shopper Personas
- The researchers chose 90 minimally overlapping shopping categories, covering 738 e-commerce sites with 100 product URLs per persona.84% of the top 100 e-commerce trackers also appeared among trackers on Alexa Top-5K sites.Source: Figure 4 · p. 6, §4.3 · p. 7
4.4 Collecting Ads
- The crawls sampled 150 publishers and 15 URLs per publisher, with 90 shopping personas and one control visiting the same publisher pages in tandem.Nine rounds ran from December 4–19, 2015; crawlers recorded inclusion trees, HTTP headers, cookies, and images without clicking ads.Source: §4.4 · p. 7
5 Image Labeling
The section describes how the authors filtered crawled images, used crowdsourced labels and manual review to identify retargeted ads, and assessed labeling uncertainty.
5.1 Basic Filtering
- 571,636 unique images became 93,726 after EasyList filtering and 31,850 after four filters, including size and persona-specific exclusions.Images under 50×50 pixels were removed, as were ads shown to the control account or to more than one persona.Source: §5 · p. 7, §5.1 · pp. 7–8
5.2 Identifying Targeted & Retargeted Ads
- AMT HITs paired 30 ads (27 unlabeled, three controls) with category and visited-site questions; dual labels agreed on 92.4% of images.Workers had to pass eligibility and control-image checks; authors resolved disagreements between the two labels.Source: §5.2 · p. 8
- Manual chain review added 3,743 retargets; the smaller labeled dataset identified 96% of the top 25 networks in the larger set.Workers had identified 1,359 retargeted ads, and authors reviewed behavioral-ad images and their inclusion chains for additional examples.Source: §5.2 · pp. 8–9
- 5,102 of 31,850 labeled images were retargeted ads, advertising 281 distinct e-commerce websites.The labeling effort covered 1,142 AMT HITs and 7,563 behavioral targeted ads.Source: §5.2 · p. 9
5.3 Limitations
- Labeling errors could not be bounded without ground truth or reliable automatic detection; false positives may misclassify sharing, while one correctly identified retarget suffices to infer a sharing pair.The authors used a control crawl to mitigate false positives, but acknowledge that they can still occur.Source: §5.3 · p. 9
6 Analysis
The analysis classifies retargeted-ad inclusion chains by information-sharing mechanism, compares cookie-matching detection with prior heuristics, and uses an exchange graph to examine ecosystem roles.
6.1.1 Categorization Rules
- The four chain classes distinguish direct matches, cookie matches, indirect sharing of browsing-history metadata, and latent matches where another exchange may share information behind the scenes.Direct matches need no exchange-to-exchange sharing; indirect matches can enable retargeting without cookie matching.Source: §6.1.1 · p. 10
6.2 Cookie Matching
- The analysis finds cookie matching in both directions and notes that some pairs use different mechanisms depending on the direction of matching.The authors also observe participants such as Adacado and AdRoll that prior work did not identify, consistent with their mechanism-agnostic approach.Source: §6.1.1 · p. 10, §6.2 · pp. 12–13
6.1.2 Categorization Results
- Cookie matching is the most frequent classification; indirect and latent matches account for 7% and 15%, respectively, and fall to 1% after domain clustering.The percentages do not add to 100% because a pair may match in both forward and backward directions; uncategorized chains are 1–2%.Source: §6.1.2 · p. 11
- 731 indirect chains become cookie-matching chains after Google domains are clustered, providing evidence of latent information sharing across Google domains.The authors report that Google Syndication is the DSP in most such cases and suggest it ingests tracking data and identifiers from other Google services server-side.Source: §6.1.2 · p. 11
6.2 Cookie Matching
- Cookie-matching frequency is concentrated among heavy hitters, especially Google and Criteo, while exchange pairs vary in whether they send, receive, or do both.Adacado is described as only ingesting cookies, whereas Criteo sends or receives data from many partners.Source: §6.2 · p. 12
- 31% of cookie-matching partners evade the tested heuristics, while 4.1% of cookie-matching chains would be missed entirely.The authors attribute this gap in part to obfuscation and argue that it supports their mechanism-agnostic classification.Source: §6.2 · p. 13
6.3 The Retargeting Ecosystem
- The exchange graph distinguishes SSPs, which tend to facilitate connections among publishers, DSPs, and other SSPs, from DSPs, which often terminate chains by serving ads.Most observed SSPs also serve some retargeted ads, while Casale Media and OpenX are described as pure SSPs.Source: §6.3 · pp. 13–14, Table 3 · p. 13
7 Concluding Discussion
The paper presents a content-agnostic method for detecting tracking-information flows between ad exchanges, including server-side flows that string-based heuristics can miss. Its findings suggest ways to balance user privacy with publishers’ revenue needs, while leaving implementation costs and obfuscated flows as practical considerations.
7 Concluding Discussion
- The content-agnostic method detects client- and server-side information flows, while prior cookie-matching heuristics miss 31% of matching pairs.The authors note that obfuscation may make those heuristics fail more often as ad networks adopt such techniques.Source: §7 · p. 14
- Existing ad-blocking choices are described as unsatisfactory: some are complicated or deprive publishers of revenue, while blocking third-party cookies does not stop first-party trackers.The authors also note concerns about Acceptable Ads, DNT, and privacy-preserving ad exchanges that have not been widely adopted.Source: §7 · p. 14
- A proposed browser extension could block identified cookie-matching flows while still allowing advertising, but its cost effectiveness remains an open challenge because it relies on crowdsourced labor.The authors frame this as a possible middle ground between privacy protection and publishers’ revenue needs.Source: §7 · p. 14
- Information from the method could serve as ground truth for a JavaScript information-flow-control blocker that marks incoming data and restricts outgoing flows containing it.The authors caution that IFC alone cannot block cookie matching when ad networks obfuscate data.Source: §7 · p. 14
A.1 Clustered Domains
The appendix groups domains into clusters for classifying publisher-side chains.
A.1 Clustered Domains
- The listed clusters include Google, OpenX, and Affinity, each grouping related domain names.The Google cluster includes domains such as doubleclick, googlesyndication, and googletagservices.Source: §A.1 · p. 16
- These domain clusters are used when classifying publisher-side chains in § 6.1.2.Source: §A.1 · p. 16
- Mythings, Amazon, and Tellapart are also represented as clusters of related domain names.The listed aliases include mythingsmedia, amazon-adsystem, and tellaparts.Source: §A.1 · p. 16