PURL: Safe and Effective Sanitization of Link Decoration

TL;DR

PURL is a machine-learning-based method that detects and sanitizes tracking information in decorated links, effectively countering emerging tracking techniques while minimizing website breakage.

Contribution

This paper introduces PURL, a novel cross-layer graph approach for safe link sanitization that outperforms existing methods in accuracy and robustness.

Findings

Link decoration is used for tracking on nearly 75% of top websites.

PURL significantly reduces tracking while maintaining website functionality.

It is robust against common evasion techniques.

Abstract

While privacy-focused browsers have taken steps to block third-party cookies and mitigate browser fingerprinting, novel tracking techniques that can bypass existing countermeasures continue to emerge. Since trackers need to share information from the client-side to the server-side through link decoration regardless of the tracking technique they employ, a promising orthogonal approach is to detect and sanitize tracking information in decorated links. To this end, we present PURL (pronounced purel-l), a machine-learning approach that leverages a cross-layer graph representation of webpage execution to safely and effectively sanitize link decoration. Our evaluation shows that PURL significantly outperforms existing countermeasures in terms of accuracy and reducing website breakage while being robust to common evasion techniques. PURL's deployment on a sample of top-million websites shows that link decoration is abused for tracking on nearly three-quarters of the websites, often to share cookies, email addresses, and fingerprinting information.