Cookie Blocking and Privacy: First Parties Remain a RiskGerman Gomez
Florida International UniversityChris Hoofnagle, JD
UC BerkeleyMario Garcia PhD
Texas A&M University-Corpus Christi
This work was supported by the TRUST Center (NSF award number CCF-0424422)
Figure 1. Method Flowchart
Chart 1. General Analysis Top Web Browsers
CONCLUSIONIn fact 33% of the sites that issue the most number of cookies, in our visit to the top 100 with cookies unblocked, were actually from different domains. These cookies were still set when we blocked third party cookies. Thus, users who wish to avoid web tracking through cookies must also block some first party cookies.
INTRODUCTIONThe HTTP cookie was created to store textual information that a web application can use to identify clients and provide a state of information. A cookie is a small text file stored on a user’s computer. Cookies are employed for a variety of reasons including enhancing user’s online experience by helping sites recognize users when they return.Cookies can be used to track users on the internet. Our colleagues found in 2009 that over 70% of a large sample of websites contained tracking cookies for Google Analytics.
RESEARCH GOALTraditionally, advertising networks tracked consumers using third party cookies. In recent years, some internet browsers have given users better tools to block these cookies, and two block them by default. We are investigating whether blocking third party cookies is effective in avoiding tracking by third parties.
METHODSWe select two foundations for this project: we used the top five web browsers on the market to visit the top 100 websites, ranked according to Quantcast in July 2010.
We focused on two browser scenarios: first, we visited the top 100 websites with the default cookie settings in the browser. Firefox, Chrome, and Opera accept all cookies by default, while Safari blocks third party cookies, and Internet Explorer blocks third party cookies on sites lacking a compact privacy policy. Second, we took a standard privacy intervention: we blocked third party cookies in the browsers and then visited the same sites.
A top level view flowchart (Figure 1) outlines the entire procedure.
RESULTS
0
275
550
825
1100
197264
437
585545
876
171
303330
652586
974
173
320331
684594
1027
172
307309
654586
986
Safari Firefox Chrome IE Opera*
total number of cookies total unique cookie name total unique cookie domain
Cookie Name Analysis Top 15 Cookie Domain Analysis Top 15
Chart 2. Data Analysis from Safari 5.
I II I II I II
QuancastTop 100
url list Cookies Script data.csv
5%
5%
5%
5%
2%
2%
1%1%1%1%1%1%0%0%0%
70%
4%4%
4%
4%
3%
2%
1%1%1%1%1%1%1%1%1%
73%
0 7.5 15.0 22.5 30.0
7
7
7
8
8
9
9
9
9
10
10
10
10
10
11
9
9
9
9
9
10
10
10
10
10
11
13
16
22
23
Cookies unblockedThird-party cookies blocked
.insightexpressai.com.whitepages.com
.pubmatic.com.ask.com
.rubiconproject.com.people.com
.revsci.net.photobucket.com
.whitepages.com.rad.msn.com
.ask.com. yellowpages.com
.casalemedia.com.bestbuy.com
.people.com.metacafe.com
.photobucket.com.microsoft.com
.rad.msn.com
.netflix.com
.bestbuy.com.att.com
.fetchback.com.cnet.com
.metacafe.com.candystand.com.microsoft.com
.evite.com
.netflix.com.examiner.com
Cookies unblocked Total = 986
Third-party cookies blocked Total = 586
Google analytics cookies
ACKNOWLEDGEMENTSI will like to thank Dr. Kristen Gates, the TRUST REU program, my research partner Julian Yalaju and my mentors Chris Hoofnagle and Mario Garcia. This work was supported in part by TRUST (Team for Research in Ubiquitous Secure Technology), which receives support from the National Science Foundation (NSF award number CCF-0424422).
__utma = 40__utmb = 40__utmz = 40__qca = 38TRUE = 19s_vi = 19s_pers = 10rsi_segs = 9__qseg = 7WT_FPC = 6ACOOKIE = 5mbox = 5NGUserID = 4s_nr = 4v1st = 4other = 586
__qca = 40__utma = 39__utmb = 39__utmz = 39s_vi = 25TRUE = 23s_pers = 10rsi_segs = 9uid = 8ACOOKIE = 7__qseg = 7GUID = 6OAX = 6WT_FPC = 6akmbldtct = 6other = 716
FUTURE WORKPolicymakers and web browser developer should take a closer look to resolve third party tracking. Advancement on technology has only lead us to find ways to bypass the idea of blocking third party cookies will be enough. Engineerser hand has developed a fingerprinting technique that uses cookies as a subset tool to track individuals. Research should concentrate on providing users, developers, advertisers a safe Internet experience where privacy goes first, developer have their tools to keep innovating and advertising helping the economy not at the expense of others privacy.
I Cookies unblockedII Third-party cookies blocked
Blocking third-party Cookies does reduce on average 40% the number of cookies on the browser as seen on Chart 1. From that same chart, one can see a 2:1 relationship between the number of unique cookie name and the unique cookie domain. However, despite blocking third party cookies, we find that tracking cookies are still present in the form of first party cookies. The Results in Chart 2 represent a detail view from Apples’ Safari 5.0 web broswer. In our domain analysis we found in some cases double the number of cookies set on the browser versus the top 100 websites. Among the top cookie name we found strings such as __umt* , __qca and s_vi among others belong to companies like Google, Quancast and Omniture. In spite of the fat that when third-party cookies are blocked 40% cookie reduction tracking cookies make up more than 25% on average from the total number of cookies on this test.
Quancast cookiesOmniture cookies
