Flash Cookies and Privacy II: Now with HTML5 and ETag Respawning

Ayenson, Mika; Wambach, Dietrich; Soltani, Ashkan; Good, Nathan; Hoofnagle, Chris

Abstract

One-Click Download | Share | Email | Add to Briefcase

| Purchase Bound Hard Copy

Flash Cookies and Privacy II: Now with HTML5 and ETag Respawning

Ashkan Soltani

University of California, Berkeley - School of Information

University of California, Berkeley - School of Law, Berkeley Center for Law & Technology

July 29, 2011

Abstract:
In August 2009, we demonstrated that popular websites were using “Flash cookies” to track users. Some advertisers had adopted this technology because it allowed persistent tracking even where users had taken steps to avoid web profiling. We also demonstrated “respawning” on top sites with Flash technology. This allowed sites to reinstantiate HTTP cookies deleted by a user, making tracking more resistant to users’ privacy-seeking behaviors.

In this followup study, we reassess the Flash cookies landscape and examine a new tracking vector, HTML5 local storage and Cache-Cookies via ETags.

We found over 5,600 standard HTTP cookies on popular sites, over 4,900 were from third parties. Google-controlled cookies were present on 97 of the top 100 sites, including popular government websites. Seventeen sites were using HTML5, and seven of those sites had HTML5 local storage and HTTP cookies with matching values. Flash cookies were present on 37 of the top 100 sites.

We found two sites that were respawning cookies, including one site – hulu.com – where both Flash and cache cookies were employed to make identifiers more persistent. The cache cookie method used ETags, and is capable of unique tracking even where all cookies are blocked by the user and “Private Browsing Mode” is enabled.

Our 2009 study is also available at SSRN: http://ssrn.com/abstract=1446862.

Number of Pages in PDF File: 21

Keywords: privacy, tracking, flash, cookies, local shared object, local stored object, online advertising, behavioral targeting, self-help, persistent identification element

JEL Classifications: D18

Working Paper Series

Date posted: July 30, 2011

Suggested Citation

Ayenson, Mika, Wambach, Dietrich James, Soltani, Ashkan, Good, Nathan and Hoofnagle, Chris Jay, Flash Cookies and Privacy II: Now with HTML5 and ETag Respawning (July 29, 2011). Available at SSRN: http://ssrn.com/abstract=1898390

Export to: Export Citation What's this?

Contact Information

Mika Ayenson Worcester Polytechnic Institute (WPI) ( email ) Worcester, MA 01609 United States HOME PAGE: http://www.wpi.edu/
Dietrich James Wambach University of Wyoming ( email ) Box 3434 University Station Laramie, WY 82070 United States
Ashkan Soltani University of California, Berkeley - School of Information ( email ) 102 South Hall Berkeley, CA 94720-4600 United States
Nathan Good Good Research ( email ) 828 San Pablo Ave Suite 120D ALBANY, CA 94706 United States
Chris Jay Hoofnagle (Contact Author) University of California, Berkeley - School of Law, Berkeley Center for Law & Technology ( email ) 396 Simon Hall Berkeley, CA 94720-7200 United States 510-644-4327 (Phone) HOME PAGE: http://bclt.berkeley.edu

Abstract

Flash Cookies and Privacy II: Now with HTML5 and ETag Respawning

Mika Ayenson

Dietrich James Wambach

Ashkan Soltani

Nathan Good

Chris Jay Hoofnagle

Date posted: July 30, 2011

Suggested Citation

Contact Information

Mika Ayenson

Dietrich James Wambach

Ashkan Soltani

Nathan Good

Chris Jay Hoofnagle (Contact Author)