SoK: Privacy and Tracking on the Web

Users’ concerns about protecting their private information on the web and preventing the tracking of their web browsing has led to a number of privacy protecting advancements like ad blockers, cookie blockers, and ad domain blocklists. Indeed, many modern browsers block third party cookies by default and Google has begun beta testing their total removal on Chrome. The incentive differences between trackers and users has led to a “cat and mouse game” in the field of web tracking and analytics, leading to increasingly complex and obfuscated tracking techniques. These more advanced tracking methods—like first party tracking cookies, browser fingerprinting, and cookie respawning—make it harder for users to tell when, where, and by whom they are being tracked, as well what potentially sensitive information advertisers are gathering about them in the process. This paper unifies the literature on web tracking, emphasizing the mechanisms by which advertisers track users on the web and what privacy protecting countermeasures users can employ to protect themselves. We categorize existing studies and emphasize similarities in methodology and experimental design. We also highlight gaps in the existing literature on the subject of backend web tracking, and design an experiment to measure its prevalence on the web.