Blocking JavaScript without Breaking the Web: An Empirical Investigation

TL;DR

This study evaluates the feasibility of blocking JavaScript to prevent tracking without breaking website functionality, revealing tradeoffs and proposing fine-grained blocking methods through large-scale analysis.

Contribution

It provides an empirical analysis of JS blocking strategies on 100K websites, highlighting the effectiveness and limitations of various approaches for privacy and functionality balance.

Findings

Blocking all scripts reduces tracking but breaks two-thirds of websites.

Selective blocking improves the tradeoff between privacy and functionality.

Fine-grained JS method blocking significantly reduces breakage while maintaining tracking prevention.

Abstract

Modern websites heavily rely on JavaScript (JS) to implement legitimate functionality as well as privacy-invasive advertising and tracking. Browser extensions such as NoScript block any script not loaded by a trusted list of endpoints, thus hoping to block privacy-invasive scripts while avoiding breaking legitimate website functionality. In this paper, we investigate whether blocking JS on the web is feasible without breaking legitimate functionality. To this end, we conduct a large-scale measurement study of JS blocking on 100K websites. We evaluate the effectiveness of different JS blocking strategies in tracking prevention and functionality breakage. Our evaluation relies on quantitative analysis of network requests and resource loads as well as manual qualitative analysis of visual breakage. First, we show that while blocking all scripts is quite effective at reducing tracking, it significantly degrades functionality on approximately two-thirds of the tested websites. Second, we show that selective blocking of a subset of scripts based on a curated list achieves a better tradeoff. However, there remain approximately 15% `mixed` scripts, which essentially merge tracking and legitimate functionality and thus cannot be blocked without causing website breakage. Finally, we show that fine-grained blocking of a subset of JS methods, instead of scripts, reduces major breakage by 3.8$\times$ while providing the same level of tracking prevention. Our work highlights the promise and open challenges in fine-grained JS blocking for tracking prevention without breaking the web.