The First Early Evidence of the Use of Browser Fingerprinting for Online Tracking

TL;DR

This study presents FPTrace, a framework that detects browser fingerprinting used for online ad tracking, revealing widespread employment and privacy concerns despite existing privacy regulations.

Contribution

Introduces FPTrace, a novel framework for assessing browser fingerprinting in online tracking, and provides large-scale evidence of its extensive use in targeted advertising.

Findings

Strong evidence of fingerprinting for ad tracking and targeting

Fingerprinting can bypass GDPR/CCPA opt-outs

Fingerprinting usage is widespread in online advertising

Abstract

While advertising has become commonplace in today's online interactions, there is a notable dearth of research investigating the extent to which browser fingerprinting is harnessed for user tracking and targeted advertising. Prior studies only measured whether fingerprinting-related scripts are being run on the websites but that in itself does not necessarily mean that fingerprinting is being used for the privacy-invasive purpose of online tracking because fingerprinting might be deployed for the defensive purposes of bot/fraud detection and user authentication. It is imperative to address the mounting concerns regarding the utilization of browser fingerprinting in the realm of online advertising. This paper introduces ``FPTrace'' (fingerprinting-based tracking assessment and comprehensive evaluation framework), a framework to assess fingerprinting-based user tracking by analyzing ad changes from browser fingerprinting adjustments. Using FPTrace, we emulate user interactions, capture ad bid data, and monitor HTTP traffic. Our large-scale study reveals strong evidence of browser fingerprinting for ad tracking and targeting, shown by bid value disparities and reduced HTTP records after fingerprinting changes. We also show fingerprinting can bypass GDPR/CCPA opt-outs, enabling privacy-invasive tracking. In conclusion, our research unveils the widespread employment of browser fingerprinting in online advertising, prompting critical considerations regarding user privacy and data security within the digital advertising landscape.