Tracing Information Flows Between Ad Exchanges Using Retargeted Ads

TL;DR

This paper introduces a novel method using retargeted ads to detect information sharing between ad exchanges, revealing complex data flows and privacy risks in online advertising ecosystems.

Contribution

It develops a new methodology that accurately detects client- and server-side data sharing between ad exchanges, surpassing previous heuristic-based approaches.

Findings

Successfully categorized four types of information sharing behaviors.

Detected sharing cases where existing heuristics fail.

Analyzed 35,448 ad impressions to validate the methodology.

Abstract

Numerous surveys have shown that Web users are concerned about the loss of privacy associated with online tracking. Alarmingly, these surveys also reveal that people are also unaware of the amount of data sharing that occurs between ad exchanges, and thus underestimate the privacy risks associated with online tracking. In reality, the modern ad ecosystem is fueled by a flow of user data between trackers and ad exchanges. Although recent work has shown that ad exchanges routinely perform cookie matching with other exchanges, these studies are based on brittle heuristics that cannot detect all forms of information sharing, especially under adversarial conditions. In this study, we develop a methodology that is able to detect client- and server-side flows of information between arbitrary ad exchanges. Our key insight is to leverage retargeted ads as a tool for identifying information flows. Intuitively, our methodology works because it relies on the semantics of how exchanges serve ads, rather than focusing on specific cookie matching mechanisms. Using crawled data on 35,448 ad impressions, we show that our methodology can successfully categorize four different kinds of information sharing behavior between ad exchanges, including cases where existing heuristic methods fail. We conclude with a discussion of how our findings and methodologies can be leveraged to give users more control over what kind of ads they see and how their information is shared between ad exchanges.