A First Look at Related Website Sets

TL;DR

This paper investigates the privacy implications of the Related Website Sets proposal, revealing that users poorly identify related sites, leading to significant privacy risks due to incorrect assumptions about site relatedness.

Contribution

It provides the first measurement and user study assessing the accuracy of user perceptions of related websites, highlighting potential privacy harms of the proposal.

Findings

42% of user judgments are privacy-harming incorrect assumptions

73.3% of participants made at least one incorrect evaluation

The study characterizes the composition and governance of Related Website Sets

Abstract

We present the first measurement of the user-effect and privacy impact of "Related Website Sets," a recent proposal to reduce browser privacy protections between two sites if those sites are related to each other. An assumption (both explicitly and implicitly) underpinning the Related Website Sets proposal is that users can accurately determine if two sites are related via the same entity. In this work, we probe this assumption via measurements and a user study of 30 participants, to assess the ability of Web users to determine if two sites are (according to the Related Website Sets feature) related to each other. We find that this is largely not the case. Our findings indicate that 42 (36.8%) of the user determinations in our study are incorrect in privacy-harming ways, where users think that sites are not related, but would be treated as related (and so due less privacy protections) by the Related Website Sets feature. Additionally, 22 (73.3%) of participants made at least one incorrect evaluation during the study. We also characterise the Related Website Sets list, its composition over time, and its governance.