Online Tracking Persists with Link Decoration

Privacy Concerns with Link Decoration

The practice of link decoration, involving adding data to the end of web links, has become a more significant privacy concern than most people realize. This data exfiltration practice is widely used to send information associated with web users, including email addresses, to ad tracking firms.

Phasing Out Third-Party Cookies

Although the phased-out of third-party cookies in Chrome, planned for next year, aims to mitigate ad tech data gathering, data-focused operators have many other ways to track web users.

Widespread Use of Link Decoration

According to Shaoor Munir, a doctoral student in computer science at the University of California at Davis, about 73 percent of websites, based on a dataset of 20,000 sites, use at least one form of link decoration for tracking.

The Role of PURL

Munir presented a machine-learning tool called PURL at the Ad-Filtering Dev Summit in Amsterdam that may help privacy-conscious individuals avoid unwanted tracking.

Understanding Link Decoration

PURL, a Python-based tool, is designed to identify link decorations that need to be sanitized to prevent web tracking. Its creators claim it does so better than existing tracking countermeasures.

Beyond Query Parameters

Link decoration isn't limited to query parameters but also encompasses the resource path, query parameters, and fragments. However, query parameters are used much more frequently (~93 percent) for tracking.

Co-opting User Resources

These practices also tend to co-opt the user's computing resources, specifically local browser storage, to store data that gets transmitted. According to Munir, 69.4 percent of tested sites contained instances where tracking storage values, such as first-party cookies and local storage, are shared via link decorations.

PURL's Machine Learning

PURL uses machine learning to differentiate between link decorations used for tracking and those with a functional purpose. In an analysis of a sample of top websites, nearly 45 million link decorations were identified, of which approximately 45 percent were flagged as tracking and advertising services by PURL.

Advertisers' Interests

Munir noted that it's in advertisers' interest for the function of link decorations to be difficult to determine since around 50 percent of link decorations serve a functional purpose, and removing them can impact the functioning of websites.

Awareness and Data Collection

The general lack of awareness about the invasiveness of this tracking is one reason why Munir believes marketers don't feel pressured to limit data collection unless there's government intervention.

Conclusions

In summary, link decoration is a widespread technique used to track web users and collect data, including email addresses. While third-party cookies are being phased out, many other forms of online tracking persist, highlighting the need for tools like PURL to protect online privacy.