[Paper Review] Tracking on the Web, Mobile and the Internet-of-Things

Reuben Binns|arXiv (Cornell University)|Jan 26, 2022

Privacy, Security, and Data Protection19 citations

TL;DR

This paper provides a comprehensive, interdisciplinary overview of tracking across the web, mobile platforms, and the Internet of Things (IoT), analyzing its technical mechanisms, legal and policy dimensions, and user implications. It examines tracking evolution from early web cookies to modern fingerprinting and behavioral advertising, evaluates countermeasures like tracker blocking and privacy-preserving alternatives such as FLoC, and highlights systemic challenges in privacy, regulation, and power distribution in digital surveillance.

ABSTRACT

`Tracking' is the collection of data about an individual's activity across multiple distinct contexts and the retention, use, or sharing of data derived from that activity outside the context in which it occurred. This paper aims to introduce tracking on the web, smartphones, and the Internet of Things, to an audience with little or no previous knowledge. It covers these topics primarily from the perspective of computer science and human-computer interaction, but also includes relevant law and policy aspects. Rather than a systematic literature review, it aims to provide an over-arching narrative spanning this large research space. Section 1 introduces the concept of tracking. Section 2 provides a short history of the major developments of tracking on the web. Section 3 presents research covering the detection, measurement and analysis of web tracking technologies. Section 4 delves into the countermeasures against web tracking and mechanisms that have been proposed to allow users to control and limit tracking, as well as studies into end-user perspectives on tracking. Section 5 focuses on tracking on `smart' devices including smartphones and the internet of things. Section 6 covers emerging issues affecting the future of tracking across these different platforms.

Motivation & Objective

• To provide a cohesive, accessible overview of tracking technologies across the web, mobile devices, and IoT for researchers with limited prior exposure.
• To examine the technical, legal, and social dimensions of tracking, including its historical development and current regulatory landscape.
• To evaluate existing and emerging countermeasures, such as tracker blocking and privacy-preserving alternatives like FLoC.
• To explore the political and ethical implications of large-scale behavioral tracking and data profiling in digital ecosystems.
• To identify critical research gaps and emerging challenges in tracking infrastructure, particularly in cross-device and cross-platform contexts.

Proposed method

• Uses a narrative, thematic structure to synthesize findings from diverse research areas, including computer science, human-computer interaction, and law.
• Analyzes tracking mechanisms through technical lenses such as network traffic analysis, cookie syncing, and fingerprinting techniques.
• Evaluates countermeasures via case studies of privacy standards (P3P, DNT), tracker blockers, and privacy-preserving systems like FLoC.
• Compares tracking practices across platforms—web, mobile apps, and IoT devices—using empirical detection methodologies and cross-border compliance analysis.
• Assesses emerging technologies and policy responses through critical evaluation of proposed systems like FLoC and their implications for user privacy.
• Integrates insights from end-user studies, regulatory frameworks, and market dynamics to assess the broader societal impact of tracking.

Experimental results

Research questions

• RQ1 How has tracking evolved from early web practices to modern, cross-platform behavioral advertising systems?
• RQ2 What are the technical mechanisms enabling tracking on the web, mobile apps, and IoT devices, and how do they differ in implementation and impact?
• RQ3 To what extent do current countermeasures such as tracker blocking and privacy-preserving alternatives like FLoC effectively protect user privacy?
• RQ4 How do legal and regulatory frameworks influence tracking practices and compliance across different jurisdictions?
• RQ5 What are the political and ethical implications of large-scale data profiling and targeted persuasion in digital environments?

Key findings

• Third-party tracking on the web relies heavily on cookies, fingerprinting, and programmatic advertising ecosystems, with extensive data sharing across domains.
• Fingerprinting techniques, including device and browser fingerprinting, enable persistent tracking even when cookies are blocked, posing significant privacy risks.
• FLoC, a privacy-preserving alternative proposed by Google, groups users into cohorts based on browsing behavior to enable indirect targeting, but has faced strong criticism from privacy advocates.
• Despite technical countermeasures like tracker blockers and privacy standards (e.g., DNT, P3P), widespread tracking persists due to ecosystem complexity and lack of enforcement.
• Mobile and IoT devices expand tracking surfaces through mobile SDKs, GPS, and always-on sensors, enabling continuous, context-aware surveillance.
• The integration of tracking across devices via de-anonymized identifiers enables highly detailed user profiling, raising concerns about discrimination and manipulation.