Missed by Filter Lists: Detecting Unknown Third-Party Trackers with Invisible Pixels

TL;DR

This paper introduces a behavior-based method for detecting third-party web trackers using invisible pixels, revealing that existing filter lists miss a significant portion of trackers and that combining multiple detection methods still leaves many undetected.

Contribution

The study proposes a novel detection approach based on invisible pixel behavior, uncovering new trackers and demonstrating the limitations of existing filter lists.

Findings

Invisible pixels are present on over 94.51% of domains.

Existing filter lists miss 25-30% of trackers.

Combining filter lists still leaves 68.70% of websites tracked.

Abstract

Web tracking has been extensively studied over the last decade. To detect tracking, previous studies and user tools rely on filter lists. However, it has been shown that filter lists miss trackers. In this paper, we propose an alternative method to detect trackers inspired by analyzing behavior of invisible pixels. By crawling 84,658 webpages from 8,744 domains, we detect that third-party invisible pixels are widely deployed: they are present on more than 94.51% of domains and constitute 35.66% of all third-party images. We propose a fine-grained behavioral classification of tracking based on the analysis of invisible pixels. We use this classification to detect new categories of tracking and uncover new collaborations between domains on the full dataset of 4,216,454 third-party requests. We demonstrate that two popular methods to detect tracking, based on EasyList&EasyPrivacy and on Disconnect lists respectively miss 25.22% and 30.34% of the trackers that we detect. Moreover, we find that if we combine all three lists 379,245 requests originated from 8,744 domains still track users on 68.70% of websites.