How companies track surfers without using cookies

Nestor E. Arellano

11 years ago

It’s common knowledge that Internet advertisers use cookies to track people’s online activities for marketing purposes.

Some users are able to circumvent this by setting their browsers to reject cookies. However, digital rights group Electronic Frontier Foundation said some Web sites knowingly or unknowingly still relay to third-party companies information through a tracking method called fingerprinting.

“When you visit these Web sites, your personal information is broadcast to dozens of companies, many of which have the ability to track your surfing habits, and many of which are subject to government data request,” wrote Micah Lee, staff technologist with EFF, in his recent blog.

How does fingerprinting work?

When users load a Web site in their browser, the page typically contains elements such as images, fonts, CSS files and JavaScript files that load separately.

For instance, if the Web site visited has a Facebook Like button, the browser will load JavaScript and images from Facebook’s server in order to display the Like button, “even if the Web site being visited has nothing to do with Facebook,” said Lee.

Each time the browser makes a request, the browser sends out data such as:

• Users Internet protocol (IP) address
• User-agent string which contains the Web browser being used, browser version, user operating system, processor information, language settings and other data
• Referrer data such as URL of Web site being used
• Other HTTP headers, which contain potential identifying information
• Sometimes tracking cookies

Lee identified several news sites that that load third-party resources from servers controlled by companies like Facebook and Google.

“These sites are for the most part not actively attempting to diminish the privacy of their users,” Lee said. “There are several factors that make it commonplace for companies to include third-party resources in their sites.”

Among the factors are:

Services like Google Analytics provide an easy way to do analytics
It is considered good practice for Web sites to include JQuery and load Web fonts from servers run by Google, since these load fast and reduce the burden on a company’s servers
Social media widgets such as Facebook Like buttons allow Web sites to achieve social media traction

To find out how to guard against fingerprinting read Lee blog here