[Paper Review] Towards Understanding First-Party Cookie Tracking in the Field

Nurullah Demir, Daniel Theis+2 more|arXiv (Cornell University)|Feb 3, 2022

Privacy, Security, and Data Protection4 citations

TL;DR

This paper presents a large-scale measurement study of first-party cookie tracking in the wild, revealing that 76% of the top 15,000 websites use first-party cookies to track users on behalf of third parties, often via DNS CNAME cloaking. The study shows a 50% increase in such tracking from 2020 to 2021, with major players like Google and Facebook dominating the ecosystem, undermining third-party cookie bans and exposing a critical privacy gap in current anti-tracking defenses.

ABSTRACT

Third-party web tracking is a common, and broadly used technique on the Web. Almost every step of users' is tracked, analyzed, and later used in different use cases (e.g., online advertisement). Different defense mechanisms have emerged to counter these practices (e.g., the recent step of browser vendors to ban all third-party cookies). However, all of these countermeasures only target third-party trackers, and ignore the first party because the narrative is that such monitoring is mostly used to improve the utilized service (e.g., analytical services). In this paper, we present a large-scale measurement study that analyzes tracking performed by the first party but utilized by a third party to circumvent standard tracking preventing techniques (i.e., the first party performs the tracking in the name of the third party). We visit the top 15,000 websites to analyze first-party cookies used to track users and a technique called "DNS CNAME cloaking", which can be used by a third party to place first-party cookies. Using this data, we show that 76% sites in our dataset effectively utilize such tracking techniques, and in a long-running analysis, we show that the usage of such cookies increased by more than 50% over 2021. Furthermore, we shed light on the ecosystem utilizing first-party trackers, and find that the established trackers already use such tracking, presumably to avoid tracking blocking.

Motivation & Objective

• To investigate the prevalence and mechanisms of first-party cookie tracking in real-world websites, particularly as a bypass for third-party tracker blocking.
• To analyze the role of DNS CNAME cloaking in enabling first-party tracking that evades standard privacy protections.
• To assess the scale and growth of first-party tracking over time using longitudinal data from the HTTP Archive.
• To identify key players in the tracking ecosystem and evaluate the implications for privacy-preserving technologies.
• To challenge the assumption that first-party tracking is benign and necessary for service functionality, by demonstrating its use for cross-site tracking.

Proposed method

• Collected and analyzed HTTP and DNS traffic from the top 15,000 websites using a custom measurement pipeline.
• Tracked the presence and propagation of first-party cookies that contain user identifiers and are sent to third-party domains.
• Identified CNAME cloaking by detecting DNS-level redirections that mask third-party tracker origins in first-party contexts.
• Utilized the HTTP Archive dataset to perform longitudinal analysis of tracking trends from 2020 to 2021.
• Classified tracking ecosystems by identifying dominant third-party trackers and their deployment patterns across first-party sites.
• Evaluated the privacy implications of first-party tracking by analyzing the leakage of identifiers to external domains.

Experimental results

Research questions

• RQ1 To what extent are first-party cookies used to track users on behalf of third parties in real-world websites?
• RQ2 How prevalent is DNS CNAME cloaking as a technique to hide third-party tracking within first-party contexts?
• RQ3 What is the temporal trend in the deployment of first-party tracking mechanisms between 2020 and 2021?
• RQ4 Which major tracking companies are most active in deploying first-party tracking via CNAME cloaking or similar methods?
• RQ5 How does first-party tracking undermine existing privacy-preserving mechanisms, such as third-party cookie blocking?

Key findings

• 76% of the 15,000 analyzed websites use first-party cookies to track users on behalf of third parties, indicating widespread adoption of this technique.
• Over 69% of the analyzed sites use DNS CNAME cloaking to hide the presence of third-party trackers in first-party contexts.
• The leakage of first-party tracking identifiers to third parties increased by over 50% between 2020 and 2021, based on HTTP Archive data.
• Major tracking platforms such as Google and Facebook are dominant players in the first-party tracking ecosystem, leveraging these techniques to circumvent privacy protections.
• First-party tracking via cookies and CNAME cloaking is largely invisible to users and existing privacy tools, as it operates under the guise of first-party functionality.
• The study reveals that first-party tracking is not limited to service functionality but is actively used for cross-site tracking, challenging the assumption that such tracking is benign.