Online Tracking: A 1-Million-Site Measurement and Analysis

Online Tracking: A 1-Million-Site Measurement and Analysis. Steven Englehardt and Arvind Narayanan published this work in 2016 at ACM’s Conference on Computer and Communications Security. They built a full-browser census to observe network traffic, cookies, JavaScript behavior and browser state across the web. The practical questions are which tracking techniques a visiting browser can see, which organizations have broad reach, and how privacy tools change that exposure.

When you deliberately open a site, that site is the first party. A different origin loaded inside it is a third party. Stateful tracking stores and later retrieves an identifier, such as a cookie. Stateless tracking instead derives an identifying signal from browser or device properties. Cookie syncing adds another connection: multiple parties share the same cookie identifier, allowing observations associated with it to be linked. These terms describe technical behavior, not necessarily purpose. A signal may support commercial measurement, account security or abuse prevention, so intent needs separate evidence.

The measurement challenge is visibility. Browser choice can affect which scripts and resources an automated crawl loads. In tests on the top 100 sites, the lighter automation tool PhantomJS loaded about 30% fewer HTML resources and about 50% fewer resources in two other tested classes than full Firefox. Browser choice could therefore change the apparent tracking ecosystem before analysis even began. The researchers used a full browser to examine tracking, identifier sharing, fingerprinting and the effects of privacy tools.

OpenWPM drove a full Firefox browser through Selenium automation. A proxy, an instrumented extension and access to browser files recorded network requests, cookies, JavaScript calls and browser state. Data collection took place in January 2016 and targeted the Alexa top 1 million sites. Alongside the stateless census, a stateful crawl used a browser profile seeded on the top 10,000 sites. To classify a cookie as identifying, the researchers used a heuristic: it had to be long-lived, stable during one measurement and sufficiently different across synchronized machines. This provided a reproducible classification rule.

The census found more than 81,000 third parties across the sites it visited, yet only 123 appeared on more than 1% of sites. Tracking infrastructure therefore had a very long tail: many parties appeared rarely, while a small group reached broadly. Mapping domains to owners revealed that several large platform and advertising organizations, including Google and Oracle, had broad reach. Cookie syncing was also common among the most prevalent third parties, most of which shared identifiers with another party.

The defense comparison produced one clear takeaway. In this setting, blocking third-party cookies reduced the mean number of third parties per site, while Ghostery reduced it much more sharply. Fingerprinting exposed a separate coverage gap. Canvas fingerprinting appeared on 1.6% of sites, and detections came overwhelmingly from third-party scripts. A fingerprinting block list covered more than 78% of affected sites but only a small share of detected scripts, leaving much of the script-level long tail unlisted.

The crawl loaded only homepages. It did not click, scroll or log in, and it ran from a single US East cloud location. Known tracking techniques were also omitted, so Englehardt and Narayanan treated their estimates as a lower bound. The EasyList and EasyPrivacy labels were context-sensitive, with false positives and especially false negatives: treating every third party as tracking would overcount, while relying on the lists would undercount. A modern OpenWPM crawl cannot independently reproduce opaque clean-room data matching or server-to-server identity resolution. These limits prevent the counts from being treated as complete tracking totals or as proof of a party’s purpose.

The practical inference for current measurement programs is to record the conditions around every result. Freeze the site-list identifier and OpenWPM release, then vary broad testing conditions: browser and region, consent and page context, and whether visits are logged in or repeated. Classify technical behavior separately from purpose by recording who receives the data, how it is retained or reused, and what happens to users. When that evidence is missing, label the purpose unknown or dual-use. Cookie blocking and partitioning can reduce the browser-state channels they cover, but the evidence does not justify one universal reduction because tracking can also use fingerprints; first-party, link or login identifiers; and app or backend exchanges.

The reusable full-browser method behind OpenWPM and the released census was later used by the FTC and in classifier research. Privacy measurement teams, browser defenders and identity teams can use that approach to build repeatable, condition-aware observations. They should not infer that blocking third-party cookies eliminates tracking, that a technical signal proves its purpose, or that an absence of client-visible traffic rules out backend exchange. Used cautiously, the work is a foundation for measurement design, not a timeless estimate of everything trackers can observe.