How online tracking works Lorrie Faith Cranor Chief Technologist - - PowerPoint PPT Presentation

▶
how online tracking works
SMART_READER_LITE
LIVE PREVIEW

How online tracking works Lorrie Faith Cranor Chief Technologist - - PowerPoint PPT Presentation

Nov 10, 2023 232 likes •1.43k views

The Future of Advertising & Privacy How online tracking works Lorrie Faith Cranor Chief Technologist US Federal Trade Commission 1 Agenda Types of ads Web tracking with cookies Web tracking beyond cookies Tracking

slide-1
SLIDE 1

1

The Future of Advertising & Privacy


How online tracking works

Lorrie Faith Cranor


Chief Technologist
 US Federal Trade Commission

slide-2
SLIDE 2

2

Agenda

  • Types of ads
  • Web tracking with cookies
  • Web tracking beyond cookies
  • Tracking beyond the web
  • Opting-out

These views are my own and do not necessarily reflect the views of the Commission or any individual Commissioner

slide-3
SLIDE 3

3

Contextual ads

slide-4
SLIDE 4

4

Run-of-network ads

slide-5
SLIDE 5

5

Targeted ads

Require information about user, usually derived from web browsing history

slide-6
SLIDE 6

6

Retargeted ads

Require information about recent product views at a specific website

slide-7
SLIDE 7

7

slide-8
SLIDE 8

8

Technology for ad tracking

  • Cookies
  • Third-party cookies
  • Ad exchanges
  • Cookie syncing
  • Other identifiers used for tracking
  • Cross-device tracking
  • Probabilistic tracking
slide-9
SLIDE 9

9

Hypertext Transfer Protocol (HTTP)

Web browser Web server

slide-10
SLIDE 10

9

Hypertext Transfer Protocol (HTTP)

Web browser Web server Request for content Web page content

slide-11
SLIDE 11

10

Browser makes HTTP requests for every

  • bject embedded in page
slide-12
SLIDE 12

10

Browser makes HTTP requests for every

  • bject embedded in page
slide-13
SLIDE 13

10

Browser makes HTTP requests for every

  • bject embedded in page

Invisible pixel, web beacon, web bug

slide-14
SLIDE 14

11

Web servers respond

slide-15
SLIDE 15

11

Web servers respond

slide-16
SLIDE 16

11

Web servers respond

slide-17
SLIDE 17

12

What is in an HTTP request?

Request for content

slide-18
SLIDE 18

12

What is in an HTTP request?

  • Address of content being

requested

Request for content

slide-19
SLIDE 19

12

What is in an HTTP request?

  • Address of content being

requested

  • Text user typed into forms

Request for content

slide-20
SLIDE 20

12

What is in an HTTP request?

  • Address of content being

requested

  • Text user typed into forms
  • Referring website

Request for content

slide-21
SLIDE 21

12

What is in an HTTP request?

  • Address of content being

requested

  • Text user typed into forms
  • Referring website
  • Type and version of user

agent, platform

Request for content

slide-22
SLIDE 22

12

What is in an HTTP request?

  • Address of content being

requested

  • Text user typed into forms
  • Referring website
  • Type and version of user

agent, platform

  • Characteristics of user

agent and device

– language, fonts, plugins, etc. Request for content

slide-23
SLIDE 23

12

What is in an HTTP request?

  • Address of content being

requested

  • Text user typed into forms
  • Referring website
  • Type and version of user

agent, platform

  • Characteristics of user

agent and device

– language, fonts, plugins, etc.

  • Cookies

Request for content

slide-24
SLIDE 24

13

Content requested

  • Address of requested content

GET /section/sports HTTP/1.1 GET /2016/11/26/sports/ncaafootball/ohio- state-buckeyes-michigan-wolverines-overtime.html HTTP/1.1

  • Search queries or text typed into forms

GET /search?q=womens+soccer HTTP/1.1

slide-25
SLIDE 25

14

Referer

  • If you click on a link

– The page that contains the link you clicked

  • If a page is loading

embedded content or ads

– The page in which the content or ads are embedded

  • May include search terms

and form data

Referer: http://query.nytimes.com/ search/sitesearch? action=click&contentCollection&regio n=TopBar&WT.nav=searchWidget&m

  • dule=SearchSubmit&pgtype=Home

page#/womens+soccer/ Referer: http://www.nytimes.com/

slide-26
SLIDE 26

15

slide-27
SLIDE 27

16

Cookies

  • Maintain state as you move around a website

– Shopping carts – Multi-page forms – Saving preferences

  • Recognize return visitors
slide-28
SLIDE 28

17

Basic cookies

  • A cookie stores a small string of characters
  • A web site asks your browser to set a cookie
  • Browser sends cookie whenever you return to site

browser site Please store cookie xyzzy

First visit to site

browser site Here is cookie xyzzy

Later visits

slide-29
SLIDE 29

18

Cookie parameters

  • By default, cookies are sent

back to any host in a domain forever

  • Sites can set time limit for

cookies

– Session cookies only sent for duration of browsing session

  • Sites can restrict cookies to
  • nly certain hosts,

directories, or files

Send me with any request to x.com until 2018 Send me with requests for index.html on y.x.com for this session

  • nly
slide-30
SLIDE 30

19

Cookie content

  • Cookies can store user

info or a database key that is used to look up user info

  • User is just as linkable

either way

Database
 Users … Email … Visits … User=Joe Email=Joe@x.com Visits=13

User=4576904309

Cookie: user=joe; email=joe@x.com; visits=13 Cookie: user=457690439

slide-31
SLIDE 31

20

You can examine 
 cookies stored by
 your browser

slide-32
SLIDE 32

20

You can examine 
 cookies stored by
 your browser Settings

slide-33
SLIDE 33

20

You can examine 
 cookies stored by
 your browser Settings Show advacned settings…

slide-34
SLIDE 34

21

slide-35
SLIDE 35

21

slide-36
SLIDE 36

22

slide-37
SLIDE 37

22

slide-38
SLIDE 38

23

slide-39
SLIDE 39

23

slide-40
SLIDE 40

24

slide-41
SLIDE 41

24

Delete

slide-42
SLIDE 42

24

Delete Remove all

slide-43
SLIDE 43

25

Cookie deletion

  • If cookie is deleted by

user or expires, no cookie is sent to website until a new cookie is set

slide-44
SLIDE 44

25

Cookie deletion

  • If cookie is deleted by

user or expires, no cookie is sent to website until a new cookie is set

request 1st visit

slide-45
SLIDE 45

25

Cookie deletion

  • If cookie is deleted by

user or expires, no cookie is sent to website until a new cookie is set

content + new cookie request 1st visit

slide-46
SLIDE 46

25

Cookie deletion

  • If cookie is deleted by

user or expires, no cookie is sent to website until a new cookie is set

content + new cookie request + cookie request 1st visit 2nd visit

slide-47
SLIDE 47

25

Cookie deletion

  • If cookie is deleted by

user or expires, no cookie is sent to website until a new cookie is set

content content + new cookie request + cookie request 1st visit 2nd visit

slide-48
SLIDE 48

25

Cookie deletion

  • If cookie is deleted by

user or expires, no cookie is sent to website until a new cookie is set

content content + new cookie request + cookie request User deletes cookie 1st visit 2nd visit

slide-49
SLIDE 49

25

Cookie deletion

  • If cookie is deleted by

user or expires, no cookie is sent to website until a new cookie is set

content content + new cookie request + cookie request request User deletes cookie 1st visit 2nd visit 3rd visit

slide-50
SLIDE 50

25

Cookie deletion

  • If cookie is deleted by

user or expires, no cookie is sent to website until a new cookie is set

content content + new cookie request + cookie request content + new cookie request User deletes cookie 1st visit 2nd visit 3rd visit

slide-51
SLIDE 51

26

Same origin policy

slide-52
SLIDE 52

27

Same origin policy

  • Browsers can send

cookies back only to the domain that set them

  • Restriction designed to

prevent tracking across sites

– But, there are ways around this....

X.com X.com Y.com Y.com

Not allowed

slide-53
SLIDE 53

28

Third-party cookies

nytimes.com

slide-54
SLIDE 54

28

Third-party cookies

track.com ads.com nytimes.com

slide-55
SLIDE 55

29

nytimes.com parents.com

slide-56
SLIDE 56

29

ads.com nytimes.com parents.com

slide-57
SLIDE 57

29

track.com ads.com nytimes.com parents.com

slide-58
SLIDE 58

29

track.com ads.com nytimes.com parents.com

slide-59
SLIDE 59

29

track.com ads.com nytimes.com parents.com

slide-60
SLIDE 60

29

track.com ads.com nytimes.com parents.com

slide-61
SLIDE 61

29

track.com ads.com nytimes.com parents.com

slide-62
SLIDE 62

29

track.com ads.com nytimes.com parents.com

slide-63
SLIDE 63

30

Actually, it is more complicated

slide-64
SLIDE 64

30

Actually, it is more complicated

request + user ID Ad server

slide-65
SLIDE 65

30

Actually, it is more complicated

request + user ID Ad Exchange Ad server

slide-66
SLIDE 66

30

Actually, it is more complicated

request + user ID Ad Exchange DSP1 DSP2 DSP3 user ID + 
 site profile Ad server Demand-side platform

slide-67
SLIDE 67

31

Actually, it is more complicated

Ad Exchange DSP1 DSP2 DSP3 bid bid bid Ad server Real Time Bidding

slide-68
SLIDE 68

31

Actually, it is more complicated

Ad Exchange DSP1 DSP2 DSP3 bid bid bid Ad server price + ad ID Real Time Bidding

slide-69
SLIDE 69

31

Actually, it is more complicated

Ad Exchange DSP1 DSP2 DSP3 bid bid bid Ad server price + ad ID ad Real Time Bidding

slide-70
SLIDE 70

32

Actually, it is more complicated

Ad Exchange DSP1 DSP2 DSP3 bid bid bid Ad server price + ad ID ad

Elapsed time < 1/3 second

slide-71
SLIDE 71

33

slide-72
SLIDE 72

34

Cookie syncing

slide-73
SLIDE 73

34

Cookie syncing

slide-74
SLIDE 74

35

Cookie syncing

  • Every website sets its own cookie

– Knows user by a different ID – Can’t share cookies due to same-origin policy

  • In order to recognize user to bid at auction,

common IDs are needed

– Cookie syncing links IDs from different cookies – Can also be used to respawn deleted cookies

slide-75
SLIDE 75

36

A.com C.com B.com ID=A123 ID=B678 ID=C789

slide-76
SLIDE 76

36

A.com C.com request B.com ID=A123 ID=B678 ID=C789

slide-77
SLIDE 77

36

A.com C.com content + cookie request B.com ID=A123 ID=B678 ID=C789

slide-78
SLIDE 78

36

A.com C.com content + cookie request request B.com ID=A123 ID=B678 ID=C789

slide-79
SLIDE 79

36

A.com C.com content + cookie request content + cookie request B.com ID=A123 ID=B678 ID=C789

slide-80
SLIDE 80

36

A.com C.com content + cookie request request content + cookie request B.com ID=A123 ID=B678 ID=C789

slide-81
SLIDE 81

36

A.com C.com content + cookie request content + cookie request content + cookie request B.com ID=A123 ID=B678 ID=C789

slide-82
SLIDE 82

37

A.com C.com ID=A123 ID=B678 ID=C789 B.com

slide-83
SLIDE 83

37

A.com C.com request + cookie ID=A123 ID=B678 ID=C789 B.com

slide-84
SLIDE 84

37

A.com C.com redirect b.com?aid=A123 request + cookie ID=A123 ID=B678 ID=C789 B.com

slide-85
SLIDE 85

37

A.com C.com redirect b.com?aid=A123 request + cookie ID=A123 Request aid=A123 + cookie ID=B678 ID=C789 B.com

slide-86
SLIDE 86

37

A.com C.com redirect b.com?aid=A123 request + cookie ID=A123 Redirect c.com?aid=A123&bid=B678 Request aid=A123 + cookie ID=B678 ID=C789 B.com

slide-87
SLIDE 87

37

A.com C.com redirect b.com?aid=A123 request + cookie ID=A123 R e q u e s t a i d = 1 2 3 & b i d = B 6 7 8 + c

  • k

i e Redirect c.com?aid=A123&bid=B678 Request aid=A123 + cookie ID=B678 ID=C789 B.com

slide-88
SLIDE 88

37

A.com C.com redirect b.com?aid=A123 request + cookie ID=A123 R e q u e s t a i d = 1 2 3 & b i d = B 6 7 8 + c

  • k

i e Redirect c.com?aid=A123&bid=B678 Request aid=A123 + cookie ID=B678 ID=C789 B.com C.com now knows: A123 = B678 = C789

slide-89
SLIDE 89

38

Once cookies are synced

  • Companies can

exchange data about users behind the scenes, merge profiles

slide-90
SLIDE 90

38

Once cookies are synced

  • Companies can

exchange data about users behind the scenes, merge profiles

slide-91
SLIDE 91

39

Identifiers beyond cookies

  • IP address
  • Storage associated with

browser pluggins

– Local Shared Object (LSO) – Silverlight Isolated Storage

  • HTML5 DOM storage
  • Cache mechanisms

– ETags – Pixel hack (unique ID stored as a colored pixel)

  • Javascript mechanisms

– History sniffing – Browser fingerprinting

slide-92
SLIDE 92

40

Browser fingerprinting

  • Combination of device

and browser characteristics forms a fairly unique fingerprint

– Fonts – Timezone – Screen size and color depth – Browser plugins – …

slide-93
SLIDE 93

41

slide-94
SLIDE 94

42

Your browser fingerprint appears to be unique among the 186,338 tested so far

slide-95
SLIDE 95

43

Mobile device & location tracking

  • Mobile device

advertising IDs

– used to target, retarget, and frequency cap ads served through mobile apps – Can be reset by user – Limit ad tracking setting limits ad targeting – Apple: IDFA – Google: AAID

  • Apps may collect

location and send to advertisers

– Multiple ways to obtain location, sometimes without notifying user

  • Retail tracking based
  • n MAC addresses

when mobile devices search for wifi

slide-96
SLIDE 96

44

Cross-device tracking

  • Link a user’s activity across their devices

– Seamless user experience – Allow users to pickup where they left off on another device – Develop a user’s profile across devices – Target ads across devices – Measure success of ad campaigns across devices

  • Deterministic – user logs in or provides consistent identifier
  • Probabilistic – infer user identity from IP address, location,

browsing patterns, etc.

– Websites may share hashed email addresses with ad networks to enable linking without transmitting PII

slide-97
SLIDE 97

45

Audio beacons

  • Ultrasonic inaudible sounds played

by an ad

  • Software in app activates

microphone and listens for beacon sound played by another device in vicinity

  • Identifies devices likely owned by

same person

  • Allows advertisements on mobile

device to relate to programming user is watching on TV

slide-98
SLIDE 98

46

Data matching

  • Matching offline and
  • nline data
  • Allows marketers to see

whether online ad results in offline purchase

  • Hashed email address
  • r other identifiers

compared

slide-99
SLIDE 99

47

Opt-out cookies

  • Some third-party trackers allow you to opt-out
  • f tracking by setting an opt-out cookie
  • Opt-out cookie is used only to signal that you

don’t want to be tracked

  • Deleting the cookie removes the opt-out
  • Industry association websites let you set opt-
  • ut cookies for dozens of sites in one place

– Aboutads.info

slide-100
SLIDE 100

48

slide-101
SLIDE 101

49

slide-102
SLIDE 102

50

slide-103
SLIDE 103

51

Adchoices

  • Symbol to indicated ads are targeted
  • Click for more information and to opt-out
slide-104
SLIDE 104

52

slide-105
SLIDE 105

53

slide-106
SLIDE 106

54

slide-107
SLIDE 107

55

AdChoices icon study

  • 1,505 participants
  • Recruited through Amazon Mechanical Turk
  • Between subjects online survey

What Do Online Behavioral Advertising Disclosures Communicate to Users? P. Leon, J. Cranshaw, L. Cranor, J. Graves, M. Hastak, B. Ur, G. Xu. WPES 2012

slide-108
SLIDE 108

56

slide-109
SLIDE 109

57

Varied icon and taglines

slide-110
SLIDE 110

57

Varied icon and taglines

  • Why did I get this ad?
  • Interest based ads
  • AdChoices
  • Sponsor ads
  • Learn about your ad

choices

  • Configure ad preferences
  • ‘No tagline’
slide-111
SLIDE 111

58

What people think happens if they click

56% More ads will pop up 45% Will take you to a page where you can buy advertisements on this website 27% Will take you to a page where you can

  • pt out of tailored ads

AdChoices

slide-112
SLIDE 112

59

Some taglines have better results

42% More ads will pop up 15% Will take you to a page where you can buy advertisements on this website 50% Will take you to a page where you can

  • pt out of tailored ads

Configure Ad Preferences

slide-113
SLIDE 113

60

2015 online surveys

  • 2015 study of online adults by Kelly Scott Madison

agency

– 26% are familiar with AdChoices campaign – 9% know what icon means

  • 2015 Ipsos study of online adults on behalf of TRUSTe

– 68% of US smartphone users concerned about tracking for targeted ads – 37% aware of AdChoices icon

http://www.mediapost.com/publications/article/250688/most-people-dont-understand-adchoices-icon.html
 https://www.truste.com/about-truste/press-room/68-us-smartphone-users-concerned-activity-tracked-use-targeted-ads/

slide-114
SLIDE 114

61

Do Not Track

  • Proposed W3C standard
  • Allows web browsers to signal to websites that

users do not want to be tracked

  • Built into major web browsers but not widely

adopted by websites

slide-115
SLIDE 115

62

slide-116
SLIDE 116

63

Cookie blockers and ad blockers

  • Lots of tools for

blocking cookies, tracking, and ads

  • Some websites are

asking or requiring users to unblock

slide-117
SLIDE 117

64

The future of advertising?

slide-118
SLIDE 118

65

ftc.gov/tech
 
 lcranor @ ftc.gov