COOKIEGRAPH: Measuring and Countering First-Party Tracking Cookies
share
Recent privacy protections by browser vendors aim to limit the abuse of third-party cookies for cross-site tracking. While these countermeasures against third-party cookies are widely welcome, there are concerns that they will result in advertisers and trackers abusing first-party cookies instead. We provide the first empirical evidence of how first-party cookies are abused by advertisers and trackers by conducting a differential measurement study on 10K websites with third-party cookies allowed and blocked. We find that advertisers and trackers implement cross-site tracking despite third-party cookie blocking by storing identifiers, based on probabilistic and deterministic attributes, in first-party cookies. As opposed to third-party cookies, outright first-party cookie blocking is not practical because it would result in major breakage of legitimate website functionality. We propose CookieGraph, a machine learning approach that can accurately and robustly detect first-party tracking cookies. CookieGraph detects first-party tracking cookies with 91.06 CookieBlock approach by 10.28 against cookie name manipulation while CookieBlock's accuracy drops by 15.68 We also show that CookieGraph does not cause any major breakage while CookieBlock causes major breakage on 8 deployment of CookieGraph shows that first-party tracking cookies are used on 93.43 tracking cookies are set by major advertising entities such as Google as well as many specialized entities such as Criteo.
READ FULL TEXT