TrackerSift: Untangling Mixed Tracking and Functional Web Resources

TL;DR

TrackerSift is a novel approach that classifies and untangles mixed web resources combining tracking and legitimate functions at multiple granularities, enabling more precise content blocking without breaking website functionality.

Contribution

It introduces TrackerSift, a method for fine-grained analysis of mixed web resources, and provides a large-scale measurement study revealing their prevalence and characteristics.

Findings

Over 17% domains and 48% hostnames contain mixed resources.

TrackerSift attributes 98% of script network requests accurately.

Blocking mixed resources can break legitimate website functionality.

Abstract

Trackers have recently started to mix tracking and functional resources to circumvent privacy-enhancing content blocking tools. Such mixed web resources put content blockers in a bind: risk breaking legitimate functionality if they act and risk missing privacy-invasive advertising and tracking if they do not. In this paper, we propose TrackerSift to progressively classify and untangle mixed web resources (that combine tracking and legitimate functionality) at multiple granularities of analysis (domain, hostname, script, and method). Using TrackerSift, we conduct a large-scale measurement study of such mixed resources on 100K websites. We find that more than 17% domains, 48% hostnames, 6% scripts, and 9% methods observed in our crawls combine tracking and legitimate functionality. While mixed web resources are prevalent across all granularities, TrackerSift is able to attribute 98% of the script-initiated network requests to either tracking or functional resources at the finest method-level granularity. Our analysis shows that mixed resources at different granularities are typically served from CDNs or as inlined and bundled scripts, and that blocking them indeed results in breakage of legitimate functionality. Our results highlight opportunities for finer-grained content blocking to remove mixed resources without breaking legitimate functionality.