Invisible Pixels Are Dead, Long Live Invisible Pixels!

Abstract

Privacy has deteriorated in the world wide web ever since the 1990s. The tracking of browsing habits by different third-parties has been at the center of this deterioration. Web cookies and so-called web beacons have been the classical ways to implement third-party tracking. Due to the introduction of more sophisticated technical tracking solutions and other fundamental transformations, the use of classical image-based web beacons might be expected to have lost their appeal. According to a sample of over thirty thousand images collected from popular websites, this paper shows that such an assumption is a fallacy: classical 1×1 images are still commonly used for third-party tracking in the contemporary world wide web. While it seems that ad-blockers are unable to fully block these classical image-based tracking beacons, the paper further demonstrates that even limited information can be used to accurately classify the thirdparty 1 × 1 images from other images. An average classification accuracy of 0.956 is reached in the empirical experiment. With these results the paper contributes to the ongoing attempts to better understand the lack of privacy in the world wide web, and the means by which the situation might be eventually improved. CCS CONCEPTS• Security and privacy → Web protocol security;

Missed by Filter Lists: Detecting Unknown Third-Party Trackers with Invisible Pixels

“…Invisible pixels are extensively studied starting from 2001 [6,18,34,36,44]. Invisible pixels, called "web bugs" in previous works, were primarily used to set and send third-party cookies attached to the request or response when the browser fetches such image.…”

“…Ruohonen and Leppänen [44] studied the presence of invisible pixels in Alexa's top 500 websites. They showed that invisible pixels are still widely used.…”

Oh, the Places You've Been! User Reactions to Longitudinal Transparency About Third-Party Web Tracking and Inferencing

“…Web tracking is an "arms race" between trackers and tracker-blockers [8,37,41,57,63,67,77,102]. A number of methods can be used for third-party tracking: cookies [28]; fingerprinting [1]; tracking pixels [78]; and more [27].…”

Website Data Transparency in the Browser

“…Our work is based on foundational techniques for analyzing web messages for various data tracking practices, such as browser fingerprinting [3,24,57], the use of tracking pixels [38,66], and the collection of location data [6]. Email addresses typed into forms can be collected by third party scripts even when people leave the site without submitting the form, which is especially concerning as email addresses are commonly used as identifiers for constructing profiles over time [69].…”