Abstract |
Over the past years, advertisement companies have used a variety of tracking methods to persistently track users across the web. Such tracking methods
usually include first and third-party cookies, cookie synchronization, as well as a
variety of fingerprinting mechanisms. To complement these tracking approaches,
Facebook (FB) (now Meta) recently introduced a new tagging mechanism that
attaches a one-time tag as a URL parameter (namely FBCLID) on outgoing links
to other websites. Although such a tag does not seem to have enough information to persistently track users, we demonstrate that despite its ephemeral nature,
when combined with FB Pixel, it can aid in persistently monitoring user browsing
behavior across i) di↵erent websites, ii) di↵erent actions on each website, iii) time,
i.e., both in the past as well as in the future.We refer to this online monitoring of
users as FB web tracking.
We find that FB Pixel tracks a wide range of user activities on websites
with alarming detail, especially on websites classified as sensitive categories under GDPR. Also, we show how the FBCLID tag can be used to match, and thus
de-anonymize, activities of online users performed in the distant past (even before
those users had a FB account) tracked by FB Pixel. In fact, by combining this tag
with cookies that have rolling expiration dates, FB can also keep track of users’
browsing activities in the future as well. Our experimental results suggest that
23% of the 10k most popular websites have adopted this technology, and can contribute to this activity tracking on the web. Furthermore, our longitudinal study
shows that this type of user activity tracking can go as far back as 2015 or even
as 2013 (when the precursor of this technology was first introduced by FB). To
put it simply, if a user creates for the first time a FB account today, the platform
could match their past web browsing activity, collected in anonymous form, to
their newly created FB profile, from as far back as at least 2015 and continue
tracking their activity in the future.
|