Beyond the Crawl: Unmasking Browser Fingerprinting in Real User Interactions

TL;DR

This study reveals that automated web crawls significantly underestimate real-world browser fingerprinting prevalence by missing nearly half of fingerprinting sites, emphasizing the importance of real user data for accurate detection and understanding.

Contribution

The paper introduces a large-scale user study capturing real browsing behavior, highlighting discrepancies with automated crawl data, and evaluates federated learning for improved fingerprinting detection.

Findings

Automated crawls miss 45% of fingerprinting websites encountered by real users.

Real user data uncovers new fingerprinting vectors absent in automated crawls.

Federated learning improves fingerprinting detection accuracy on real user data.

Abstract

Browser fingerprinting is a pervasive online tracking technique used increasingly often for profiling and targeted advertising. Prior research on the prevalence of fingerprinting heavily relied on automated web crawls, which inherently struggle to replicate the nuances of human-computer interactions. This raises concerns about the accuracy of current understandings of real-world fingerprinting deployments. As a result, this paper presents a user study involving 30 participants over 10 weeks, capturing telemetry data from real browsing sessions across 3,000 top-ranked websites. Our evaluation reveals that automated crawls miss almost half (45%) of the fingerprinting websites encountered by real users. This discrepancy mainly stems from the crawlers' inability to access authentication-protected pages, circumvent bot detection, and trigger fingerprinting scripts activated by specific user interactions. We also identify potential new fingerprinting vectors present in real user data but absent from automated crawls. Finally, we evaluate the effectiveness of federated learning for training browser fingerprinting detection models on real user data, yielding improved performance than models trained solely on automated crawl data.