Tracking the Trackers A Digital Methods Summer School 2013 Workshop

Anne Helmond (UvA) & Alexei Miagkov (Ghostery)

One action, many data points

“For every explicit action of a user, there are probably 100+ implicit data points from usage; whether that is a page visit, a scroll etc.” (Berry 2011: 152)

Hitting & tracking

Every time a web user requests a website, a series of tracking features are enabled.

Hitting & tracking

Every time a web user requests a website, a series of tracking features are enabled.

Workshop objective: Tracking the trackers.

Cookies

• (HTML) Cookies are a string of text or a unique identifier downloaded to your browser after requesting a website.

• Cookies do not share data about the user, but recognise returning visits/requests.

• Every time the associated website is visited, information is send to the cookie owner.

Cookies

• Can be issued by requested website.

• But can also come from third party providers: ad companies, analytics services, social media platforms.

Multiple purposes

• Remember site preferences.

• Collect information to enhance usability of site.

• Part of secure logins.

• User profiling across sites (ad services).

• Behavioural targeting.

• Additional user data for platform.

Cookies & dataflows

• Tracking devices enable behavioural targeting.

• Not only happen in the back-end, return to users through personalised ads & recommendations.

Tracking ecologies

• Tracking data is used & re-used by multiple actors.

• Profiling, reselling, personalisation, recommendation, behaviour targeting, re-combination...

• Profiling machines (Elmer 2004), qualculation (Thrift 2008), de- & recomposition of relations (Mackenzie 2012).

• Part of multiple relational databases: Not individual datasets or datapoints matter, but relations created between them (Mackenzie 2012).

Cookie auctions & piggybacking

• Cookies are not only being used by the services that issues them.

• Real-time reselling & cookie auctions for personalised advertising (Borgesius 2012).

• Cookies trigger further tracking devices & let them piggyback - websites do not exactly know which services collect data about their visitors.

Social media platform cookies

• Platform features (Facebook Connect, Twitter Buttons, etc) can place cookies.

• Data can be connected to existing user profiles or collected and used upon sign-up.

• Facebook: Cookies not used for ads. Twitter: used for ads & recommendations.

• All web users are potential platform users & contribute to its data mining practices.

Beyond cookies

• Flash cookies: Used on Flash websites.

• Server logs: Saving requests to the website’s server usually include: IP, date/time, referral page, time spend and pages visited.

• Beacons: Small, mostly invisible objects (pixels, bugs) embedded in websites or emails. Enables third parties to identify website requests. Do not place a file on the browser.

• Widgets: Small applications that can be implemented and executed on websites, i.e. social media or blog widgets.

Tracking blockers

Ghostery: Detects and allows to block the invisible web.

• Allows to selectively enable/disable cookies, advertising, beacons etc.

• Users can opt to contribute to Ghostrank: analytics on the most dominant tracking devices online.

• Detecting over 1000 trackers.

Visualising trackers

Mozilla Collusion: Creates a network of browsed sites and associated tracking services for users in real time while browsing.

• Visualises which services are tracking users and how they are connected to other websites visited.

Tracking blockers

Disconnect.me: Blocks and visualises trackers. Especially disables social widgets and personalised advertising.

• Disables Facebook Social Plugins/recommendation features.

Tracking blockers

Mozilla Do Not Track: Firefox feature which allows users to tell websites that they want to opt out of third-party tracking services.

• Transmits a Do Not Track HTTP whenever data is requested.

• Requires tracking services to offer opt out: Works for Twitter, but not for Facebook.

Tracking projects & research

Tracking the trackers (Guardian): User generated tracking map based on Mozilla Collusion data.

• Covers 7000 websites and features insights into the data shared by most prominent tracking services.

• Limitations: user generated, random set of URLs.

Tracking projects & research

Cookie Search Engine (German): Detects first and third party cookies on URLs.

• Provides list of cookies, their domain, security options and expiry date.

Tracking projects & research

Visipisi: Deploys cookies to detect which websites have recently been visited.

DMI: Tracker Tracker

• Objective: detecting interfaces to the cloud and data-mining features operating in the back-end.

• Repurpose analytical capacities of Ghostery to detect presence of tracking devices on websites.

• Input list of URL, output: list of trackers & network formatted data.

DMI: Tracker Tracker

Allows to detect alternative fabric of the web - not organised by mutual linking practices between webmasters, but through the presence of tracking devices.

DMI: Tracker Tracker

Websites using Facebook Social Plugins and Facebook Connect in the top 1000 global websites according to Alexa, February 2012

DMI: Tracker Tracker

Websites using Google Analytics in the top 1000 global websites according to Alexa, February 2012

DMI: Tracker Tracker

Presence of Trackers on websites of Dutch political parties, June 2012.

Tracking exercise

1. Collect a set of URLs, for instance via www.alexa.com.

Use the Link Ripper to extract them.

2. Enter the list into the Tracker Tracker tool (max 100).

Settings: Only look at specific pages.

3. Save .gefx file.

4. Open in Gephi, use colour settings to visually distinguish different tracking services.

Questions?