From Third-Party to First-Party: Measuring and Protecting Against Modern Web Tracking Mechanisms
This paper investigates the shift from third-party to first-party and server-side web tracking, revealing through large-scale measurement that over 54% of top sites now employ these opaque techniques, and proposes new detection rules that significantly outperform traditional filter lists in blocking such requests.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
The Big Picture: The Game of Hide-and-Seek
Imagine the internet is a giant city. For years, companies trying to track your movements (the "trackers") used a specific trick: they would follow you from store to store wearing a third-party disguise (like a uniform that clearly said "I work for AdCo").
Because you could see the uniform, you (or your security guard, the browser) could easily spot them and say, "No, you can't follow me into this store." This was the era of Third-Party Tracking.
But recently, the trackers got smarter. They realized that if they wear the store's own uniform (a "First-Party" disguise), the security guard won't stop them. They are now blending in with the store's own employees. This is the shift the paper investigates: First-Party Tracking (FPT) and Server-Side Tracking (SST).
The Problem: The Invisible Stalker
The authors (researchers from Germany and Stanford) wanted to know: How big is this new problem? Who is doing it? And can we stop it?
They treated the internet like a massive crime scene investigation. They didn't just look at one street; they visited 13,000 different websites and watched 750,000 pages load. They set up their "police cars" (web browsers) in two different cities (Germany and the US) to make sure they saw the whole picture.
What They Found
1. The Disguise is Everywhere
They found that over 54% of the websites they visited are now using these "First-Party" disguises.
- The Old Way: A tracker would send a request from
tracker.comto your browser. Easy to block. - The New Way: The website itself (e.g.,
news.com) collects your data and sends it to the tracker from behind the scenes. To your browser, it looks like the website is just talking to itself. It's like a spy wearing the President's suit; you can't arrest him without arresting the President.
2. The "Big Bosses" Are Still in Charge
Even though the trackers are wearing different uniforms, the researchers found that the same big companies are still running the show.
- Google is the biggest player, followed by Meta (Facebook), Amazon, and Adobe.
- They built a map (a network graph) showing that these trackers are all connected. It's a tightly knit club where the same scripts (code) are reused across thousands of different websites, just wearing different "store uniforms."
3. The Security Guard is Asleep
The researchers tested the current tools people use to block ads and trackers (like "EasyList").
- The Result: These tools are almost useless against the new disguises. They missed the vast majority of these tracking attempts because they were looking for the old "third-party uniforms" that no longer exist.
The Solution: A New Kind of Metal Detector
Since you can't just block the "store" (the website) because that would break the internet, the researchers had to get creative. They realized that even though the trackers are wearing disguises, they still carry specific tools in their pockets.
- The Analogy: Imagine a thief wearing a police uniform. You can't arrest him just for wearing the uniform. But, if you notice he always carries a specific type of lockpick and a flashlight in his pocket, you can set up a rule: "Anyone entering the bank with a lockpick and a flashlight gets stopped."
The researchers developed a method to find these "lockpicks."
- They looked at the URLs (the web addresses) where these trackers sent data.
- They noticed that tracking requests always had specific keywords in their address (like
cid=,r=, orv=) that normal website traffic didn't have. - They used a statistical tool to find combinations of these keywords that appeared together very often in tracking but rarely in normal browsing.
The Result: A Better Shield
Using this method, they created 181 new rules for ad blockers.
- The Test: They tried these new rules on the websites.
- The Success: These new rules blocked 63% more tracking requests than the old lists did.
- The Safety: Crucially, they checked if these rules broke the websites (like stopping a video from playing or a button from working). They found that the rules broke almost nothing (only 0.04% of pages had issues).
The Takeaway
The paper concludes that the game of "Cat and Mouse" has changed. The trackers have moved from the shadows (third-party) into the light (first-party), making them harder to see.
- The Threat: We are being tracked more than ever, but it's hidden inside the websites we visit.
- The Reality: The big tech companies (Google, Meta) are the ones doing most of this tracking, even when they pretend to be the website itself.
- The Hope: The researchers proved that we can build better shields. By looking for the specific "fingerprints" (URL patterns) these trackers leave behind, we can block them without breaking the internet.
In short: The trackers changed their clothes to blend in, but the researchers found a new way to spot them by the specific tools they carry in their pockets.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.