Source-linked AI summary
Beyond Cookie Monster Amnesia: Real World Persistent Online Tracking
Nasser Mohammed Al-Fannah, Wanpeng Li, Chris J Mitchell
TL;DR
Browser fingerprinting can track users with little user control, but its real-world prevalence and collected attributes were poorly documented. The paper crawled 10,000 popular websites, finding potential fingerprinting on 68.8% and predominantly through third parties, while introducing FingerprintAlert to detect and block attempts.
Problem
Real-world evidence was limited on browser fingerprinting’s prevalence, deployers, and collected attributes, despite its limited user control and privacy implications.
Method
The study crawled the 10,000 most visited websites, analyzed browser data using automated parsing and manual inspection, and developed FingerprintAlert.
Results
68.8% of 6,876 crawled websites collected potentially fingerprintable browser data, with 84.5% sending it only to third parties.
Takeaways & Limitations
Fingerprinting prevalence and privacy implications support making tracking more user-controllable; FingerprintAlert informs users and can block fingerprinting attempts.
Takeaways & Limitations
The study could not fully identify all fingerprinting attributes or parse all transmitted data because attributes evolve, transmissions lack standards, and some data may be obfuscated.
Abstract
from arXiv · showhide
Browser fingerprinting is a relatively new method of uniquely identifying browsers that can be used to track web users. In some ways it is more privacy-threatening than tracking via cookies, as users have no direct control over it. A number of authors have considered the wide variety of techniques that can be used to fingerprint browsers; however, relatively little information is available on how widespread browser fingerprinting is, and what information is collected to create these fingerprints in the real world. To help address this gap, we crawled the 10,000 most popular websites; this gave insights into the number of websites that are using the technique, which websites are collecting fingerprinting information, and exactly what information is being retrieved. We found that approximately 69\% of websites are, potentially, involved in first-party or third-party browser fingerprinting. We further found that third-party browser fingerprinting, which is potentially more privacy-damaging, appears to be predominant in practice. We also describe \textit{FingerprintAlert}, a freely available browser extension we developed that detects and, optionally, blocks fingerprinting attempts by visited websites.
1 Introduction
Browser fingerprinting can uniquely identify and potentially track browsers, but its real-world prevalence, deployers, and collected attributes remain underdocumented. This study addresses that gap by measuring fingerprinting across 10,000 popular websites and developing a user-facing detection and blocking extension.
- Browser fingerprinting uses browser attributes to uniquely identify browsers and potentially track users.
- Fingerprinting is difficult for users to control because it is virtually invisible and browsers provide little mitigation.
- The study crawled 10,000 popular websites to measure fingerprinting prevalence, identify collecting parties, and determine which attributes were collected.
- The authors also developed FingerprintAlert to alert users to fingerprinting attempts and optionally block them.
2 Background
Browser fingerprinting is a form of stateless online tracking that derives identifying information from browser and platform properties without storing files on the device. The paper motivates a large-scale empirical study because prior work documented techniques extensively but provided limited evidence about real-world prevalence and collected attributes.
- Online tracking monitors users’ online activities, and recipients of fingerprintable browser data are termed trackers in this study.
- Browser fingerprinting collects browser and host-platform properties through HTTP headers or JavaScript and can combine them into identifying information.
- Unlike cookies, fingerprinting requires no stored device files and is difficult for users to control or remove.
- Third-party fingerprinting can track browsers across multiple websites, making it more privacy-damaging than first-party fingerprinting.
- Prior research extensively studied fingerprinting techniques, but relatively little work measured its prevalence and the attributes collected in practice.
- This study examines the fingerprinting behaviour of the 10,000 most popular websites by monitoring transferred browser data rather than website JavaScript.
- FingerprintAlert was developed to inform users when websites collect information usable for fingerprinting and to support user control.
3 Data Collection Methodology
The study crawled the homepages of 10,000 widely used websites, recorded browser-to-server data, and identified fingerprinting through predefined attributes supplemented by manual analysis. Its methodology also includes explicit scope assumptions and practical limitations involving detection coverage, parsing, and crawler reliability.
- The researchers selected 10,000 websites from the Majestic list and crawled their homepages before user interaction to test data-gathering behaviour.
- 3.4 Challenges Addressed: The method could miss interaction-triggered fingerprinting and could not fully interpret data that was nonstandard or deliberately obfuscated.
- A three-second post-load delay was used because some websites transmitted information only after the page finished loading.
- The crawl recorded data sent from browsers to servers through GET, POST, or HEAD requests, including whether transmissions used HTTPS.
- 3.3 Data Processing: Fingerprinting was detected by checking for one or more of 17 predefined browser-attribute types in returned data.
- 3.3 Data Processing: Manual inspection supplemented automated processing because complex attributes, unparsed data, and nonstandard formats were difficult to identify automatically.
- 3.4 Challenges Addressed: The study deemed a website a tracker when it caused a browser to send at least one of the 17 selected attributes.
- 3.4 Challenges Addressed: Selenium crashed on average once every 155 visited websites during crawling.
4 Results
The crawl found widespread collection of browser attributes suitable for fingerprinting, predominantly through third parties, and identified the main collectors, attributes, and data volumes involved.
- 6,876 websites (68.8%) collected browser data that could be used for fingerprinting, although collection alone does not establish that tracking occurred.The study also detected 284 attribute types and 1,914 distinct fingerprinters; 70 websites timed out and were partly or fully excluded.
- 84.5% of fingerprinting websites sent collected data only to third parties, while 2.4% used only first-party collection and 13.1% used both.Data was sent to an average of 3.42 domains per fingerprinting website, with a maximum of 42 domains for one visited website.
- Screen/browser resolution, language, and charset were the three most frequently collected automatically detectable attributes.Fingerprinters collected an average of 5 of the 17 pre-populated attributes, and Figure 3 summarizes the ten most frequent types.
5 Analysis
The analysis finds widespread potential fingerprinting, a large and diverse set of collected attributes, and substantial plaintext transmission. Third-party collection is concentrated among relatively few entities, with Google-owned domains prominent.
- Prevalence: Third-party fingerprinting was commonplace, yet relatively few entities collected and processed attributes; the top five domains belonged to Google.This pattern is consistent with prior findings about Google-owned domains receiving data from widely used websites.
- Prevalence: 68.8% of the top 10,000 websites were potentially engaged in fingerprinting.The study compares this prevalence with much lower estimates from earlier studies.
- Collected attributes: 284 fingerprinting attributes were identified, exceeding counts in previous studies partly because HTTP messages were monitored directly rather than only pre-identified scripts.Earlier studies searched for 10 or 53 attributes, whereas this study identified attributes transmitted to visited websites and potential trackers.
- Deployment of HTTPS: 50% of the 1,914 detected fingerprinters used HTTP at least sometimes to transmit attributes that could be personally identifiable.683 used only HTTP, 274 used both HTTP and HTTPS, and 957 used only HTTPS.
- Fingerprint IDs: Fingerprinting sites sometimes transmitted explicit fingerprint or fp identifiers alongside attributes, enabling trackers to share identifiers and compile extensive user profiles.Such sharing can provide user- or platform-related information without prior interaction.
6 Relationship to the Prior Art
The paper positions its study as a current, large-scale examination of browser fingerprinting based on transmitted data rather than predefined scripts. It emphasizes repeated measurement because the field changes rapidly.
- Scope: The study examined both first-party and third-party fingerprinting, unlike work focused only on third-party tracking.It also focused on browser fingerprinting rather than cookie-based tracking.
- Approach: The authors do not claim their approach is better than alternatives, but emphasize that it relies directly on observed data rather than varied fingerprinting scripts.This provides an up-to-date, large-scale list of attributes used in practice.
- Contribution: Because browser fingerprinting is rapidly evolving, the authors argue that studies should be repeated frequently to reveal the current state of the art.The paper presents this repeated-update need as one contribution of the work.
7 Browser Extension
FingerprintAlert detects selected fingerprinting attributes in HTTP messages and can block messages containing them. The extension raises awareness but has coverage limits and may interfere with websites.
- Detection and blocking: FingerprintAlert detects whether HTTP messages contain any of 17 pre-specified fingerprinting attributes when pages load.It alerts users and offers an optional blocking feature.
- Detection and blocking: Blocking one message containing a detected attribute can also block other fingerprinting attributes transmitted in that same message.Websites commonly send collected data in series of HTTP messages.
- Evaluation: Tests on the 50 most visited websites found no unexpected behaviour or errors during common interactions with blocking enabled.Testing included signing up, logging in, and clicking links for around two minutes per website.
- Challenges: The extension cannot reliably detect newer, obscure, encrypted, or previously unknown fingerprinting attributes.It therefore monitors HTTP messages for a selected set of 17 attributes instead of attempting to detect every possible value or script.
- Future improvements: FingerprintAlert complements rather than replaces extensions that monitor and block fingerprinting scripts.Its main purpose is to increase user awareness of fingerprinting attempts and collecting domains.
8 Discussion and Conclusions
Browser fingerprinting poses substantial privacy concerns because it is more permanent and less user-controllable than cookies. The paper reports widespread collection of browser and device data, while noting ethical constraints on its real-world crawl.
- Browser fingerprinting is more permanent and less controllable than cookies, which users can disable, selectively delete, or allow to expire.This makes fingerprinting particularly significant for user privacy.
- Previously proposed browser extensions can hide or fabricate attributes, but unrealistic values may themselves be fingerprintable and can harm browsing experience.
- The paper reports fingerprinting on a larger scale than previously reported, involving large volumes of browser- and device-specific data and many collected attributes.
- The crawl accessed websites as intended, collected no individual data, exploited no vulnerabilities, and generally visited each site only once.An additional visit occurred only after a crawler crash.
A.1 Prepopulated List of Attributes
The prepopulated attribute list spans browser, operating-system, graphics, plugin, language, location, and web-platform capabilities. It also includes extensive WebGL, CSS, API, and feature-detection attributes.
- The list includes resolution, operating-system details, user-agent and browser versions, WebGL and GPU information, plugins, language, geolocation, IP addresses, and charset.
- WebGL attributes cover rendering capabilities such as color and depth bits, texture limits, shader precision, and framebuffer-related limits.
- Web-platform attributes include ad blocking, canvas, fonts, plugins, media devices, permissions, service workers, storage, SVG, and WebRTC-related features.
B.3 Media
The media-related attribute list combines audio, video, display, input, connectivity, and browser-state signals. Together, these fields capture hardware capabilities, media support, viewport conditions, network properties, and runtime state.
- Media capability attributes include audio-channel properties, sample rates, codecs, and support for formats such as H.264, MP3, MP4, Ogg, Opus, and WebM.
- Display and input attributes include window dimensions, color depth, orientation, scrolling, touch points, touch events, and installed speakers, webcams, and microphones.
- Connectivity attributes include downlink, effective connection type, proxy and Tor indicators, public IP versions, and round-trip time.
- Browser-state attributes include battery status, cookies, CPU cores, geolocation, storage, platform, referrer, time zone, user agent, and JavaScript heap measurements.