The Web Never Forgets: Persistent Tracking Mechanisms in the Wild

The Web Never Forgets: Persistent Tracking Mechanisms in the Wild. Gunes Acar and colleagues presented this work at the ACM Conference on Computer and Communications Security in 2014. They investigate three mechanisms that can preserve or extend tracking: a fingerprint derived from browser rendering, restoration of deleted identifiers from redundant storage, and identifier sharing between domains. By the end, you should understand how those mechanisms combine, what the measurements established, and why the evidence supports layered defenses without proving suspected server-side identity merges.

Canvas fingerprinting makes a browser draw hidden content, reads the rendered result, and combines it with other browser properties to derive an identifier. It is called stateless because it does not depend on leaving an ordinary cookie behind. Evercookie respawning takes a different route: if an identifier is deleted from one location, a surviving copy in another browser or plugin store can restore it. Cookie synchronization passes tracking identifiers between domains so their records can potentially be related. The paper treats persistence as the combined effect of these mechanisms, not just the lifetime of any single identifier.

The practical question is how often these mechanisms appeared in the measured web population, how they behaved under privacy settings, and how combining them could expand what a tracker might associate with one user. This is useful because clearing one cookie is not a clean reset if another storage location can recreate it. The analysis also draws an important boundary: traffic captured in the browser can reveal identifiers moving between domains, but it cannot confirm that the receiving companies actually merged their server-side records.

Acar’s team used an instrumented Firefox crawler to visit 100,000 homepages. They manually reviewed scripts, developed detection rules based on browser activity and rendered-image properties, and then checked the results by hand. For evercookies, they repeated crawls while selectively retaining or clearing browser state to see whether identifiers returned. For cookie synchronization, they crawled the top 3,000 sites with all cookies accepted. Other runs tested Do Not Track and third-party-cookie blocking. This design let them compare identifier flows and restoration behavior under controlled changes to browser state.

The large crawl detected canvas fingerprinting on more than 5.5 percent of the measured homepages. About 95 percent of the detected scripts were associated with AddThis, so deployment was heavily concentrated in one provider within this dataset. Commercial scripts also exercised more rendering behavior than earlier research demonstrations, including fonts, Unicode characters, and how layers of drawing are combined. In the persistence experiments, the researchers also observed a browser database called IndexedDB being used as an evercookie storage vector.

One measured path illustrates the potential reach of combining restoration and synchronization. The domain that restored the identifier appeared on a small share of first-party sites, while the domain receiving the synchronized identifier appeared on about 11 percent. That comparison suggests how passing a restored identifier could connect it with activity across a broader set of sites. It does not establish that the organizations actually combined those records behind the scenes; that operation was outside what the crawler could observe.

The limitations fall into coverage and visibility. For coverage, the study used a rank-based set of mainly homepages in desktop Firefox. Its detection rules favored fewer false alarms, increasing the chance of missing fingerprinting, including evasive implementations. For visibility, browser traffic revealed identifier flows but not how often remote databases were merged. The work also left out mobile applications and logged-in or cross-device identity settings, along with consent and regulatory outcomes. These limits constrain how far its prevalence estimates and modeled combinations can be generalized.

In the evaluated setting, enabling Do Not Track produced only negligible reductions in syncing domains and synchronized identifiers. Blocking third-party cookies roughly halved the identifiers and parties involved, but synchronization continued. For browser security and privacy teams, the operational implication is to coordinate clearing across relevant storage mechanisms, because one missed store may recreate an identifier. Blocking remains useful but incomplete: restricting browser features can disrupt legitimate functions, while tracking can move to another identifier or another layer of the system.

The paper contributes direct measurements of fingerprinting, identifier restoration, and cross-domain synchronization, along with the useful idea that tracking persistence is a composition problem. Browser security, privacy engineering, and tracking-detection teams should test whether clearing works across storage mechanisms and evaluate blocking against observed identifier flows between domains. They should not interpret these results as proof of server-side database mergers or assume the measured rates carry beyond the desktop, homepage-focused environment that was studied.