Browser tracking protections won't stop tracking, warns DuckDuckGo
(2021/03/30)
- Reference: 1617137587
- News link: https://www.theregister.co.uk/2021/03/30/duckduckgo_tracking_protection_claims/
- Source link:
Eliminating third-party cookies will not stop companies from tracking web users, says DuckDuckGo, which claims it can help with its desktop browser extensions and mobile apps.
In a [1]blog post on Tuesday, the privacy-focused search biz explains that the much discussed plan by Google to [2]eliminate third-party cookies in Chrome by the end of 2022, and related restrictions already implemented in browsers like Brave, Firefox, and Safari, will have a limited effect on marketers' online tracking efforts.
[3]
"To really stop Google and Facebook from tracking you on other websites, you have to actually block their trackers from loading in your browser when visiting other sites," said Gabriel Weinberg, CEO of DuckDuckGo, [4]via Twitter . "Just restricting them after they load (like preventing them from using third-party cookies) isn’t enough."
Two of the most widely distributed trackers, Google Analytics tags and the [5]Facebook pixel , for example, can be implemented using first-party cookies, so they're not blocked by third-party cookie limitations.
[6]
Apple's app transparency rules: Google's privacy labels for Chrome and Search on iOS highlighted by DuckDuckGo [7]READ MORE
Weinberg argues that merely the act of loading a tracker – a webpage script, an asset like an image, or a cookie file – is itself a major tracking event. "The tracker can get a lot up front including your device info (IP address, user agent, HTTP headers, etc.) as well as your info the site chooses to send with it (e.g., from first-party cookies)."
Essentially, there are a lot of ways to track web users that don't rely on third-party cookies, like IP addresses in combination with other network data that can be used to calculate a browser fingerprint or identifier.
As we [8]recently reported , third-party marketing firms have increased in the use of CNAME DNS records to borrow subdomains from publishers so their cookies appear to originate from a first-party domain and don't get blocked.
And app developers in China have been [9]testing an identifier called the China Anonymization ID, or CAID, as a way to recover the tracking capabilities that will be lost once Apple finally implements the App Tracking Transparency framework that has [10]so alarmed Facebook, Google, and other marketers.
Weinberg notes that the technology Google has in mind to replace the third-party cookie, like its Federated Learning of Cohorts ( [11]FLoC ) scheme and related supposedly privacy-preserving ad delivery techniques, may still be useful for tracking. He argues that FLoC – which aims to assign interest group identifiers to users – can be combined with an IP address to become a unique identifier.
"So any tracker that gets both [a FLoC cohort identifier and an IP address] can easily uniquely track and behaviorally target exceptionally well without third-party cookies or anything else," he [12]said .
The [13]DuckDuckGo tracker blocking app for mobile devices and desktop browser extensions can prevent trackers from loading, which not only serves to improve privacy but also speeds up page load times considerably.
In a page load time test of WebMD.com, the DuckDuckGo extension cut page load times for Chrome, Firefox, and Safari (with default settings) from 20.2, 15.3, and 13.1 seconds to 9.9, 9.1, and 7.5 respectively, or 46 per cent on average.
The extension reduced browsing data transferred by an average of 34 per cent and cut the number of browser requests for files per page load in Chrome, Firefox, and Safari respectively from 567, 602, and 411 to 164, 198, and 181, an average file count reduction of 66 per cent.
Enhanced web performance has long been a selling point for content blocking, ad blocking, and privacy extensions, many of which like uBlock Origin also prevent trackers from loading. But Weinberg points out that DuckDuckGo's software only blocks trackers and doesn't interfere with "non-creepy ads."
[14]
"DuckDuckGo is highly profitable based just on serving non-creepy contextual ads," he [15]said . "We believe in a future where these types of ads are normal again, and think this future can be similarly profitable for publishers." ®
Get our [16]Tech Resources
[1] https://spreadprivacy.com/browser-privacy-protection/
[2] https://www.theregister.com/2020/01/14/google_third_party_cookies_user_agent/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YGOfgDtbqjPkiclm8t6UvwAAAFQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://twitter.com/yegg/status/1376887280678342664?s=20
[5] https://www.facebook.com/business/learn/facebook-ads-pixel
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YGOfgDtbqjPkiclm8t6UvwAAAFQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2021/03/16/keep_scrolling_googles_privacy_labels/
[8] https://www.theregister.com/2021/02/24/dns_cname_tracking/
[9] https://www.theregister.com/2021/03/17/apple_china_tracking/
[10] https://www.theregister.com/2020/12/16/facebook_apple_privacy/
[11] https://www.theregister.com/2021/03/05/eff_google_floc/
[12] https://twitter.com/yegg/status/1376891226964828173?s=20
[13] https://duckduckgo.com/app
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YGOfgDtbqjPkiclm8t6UvwAAAFQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[15] https://twitter.com/yegg/status/1376893299437535234?s=20
[16] https://whitepapers.theregister.com/
In a [1]blog post on Tuesday, the privacy-focused search biz explains that the much discussed plan by Google to [2]eliminate third-party cookies in Chrome by the end of 2022, and related restrictions already implemented in browsers like Brave, Firefox, and Safari, will have a limited effect on marketers' online tracking efforts.
[3]
"To really stop Google and Facebook from tracking you on other websites, you have to actually block their trackers from loading in your browser when visiting other sites," said Gabriel Weinberg, CEO of DuckDuckGo, [4]via Twitter . "Just restricting them after they load (like preventing them from using third-party cookies) isn’t enough."
Two of the most widely distributed trackers, Google Analytics tags and the [5]Facebook pixel , for example, can be implemented using first-party cookies, so they're not blocked by third-party cookie limitations.
[6]
Apple's app transparency rules: Google's privacy labels for Chrome and Search on iOS highlighted by DuckDuckGo [7]READ MORE
Weinberg argues that merely the act of loading a tracker – a webpage script, an asset like an image, or a cookie file – is itself a major tracking event. "The tracker can get a lot up front including your device info (IP address, user agent, HTTP headers, etc.) as well as your info the site chooses to send with it (e.g., from first-party cookies)."
Essentially, there are a lot of ways to track web users that don't rely on third-party cookies, like IP addresses in combination with other network data that can be used to calculate a browser fingerprint or identifier.
As we [8]recently reported , third-party marketing firms have increased in the use of CNAME DNS records to borrow subdomains from publishers so their cookies appear to originate from a first-party domain and don't get blocked.
And app developers in China have been [9]testing an identifier called the China Anonymization ID, or CAID, as a way to recover the tracking capabilities that will be lost once Apple finally implements the App Tracking Transparency framework that has [10]so alarmed Facebook, Google, and other marketers.
Weinberg notes that the technology Google has in mind to replace the third-party cookie, like its Federated Learning of Cohorts ( [11]FLoC ) scheme and related supposedly privacy-preserving ad delivery techniques, may still be useful for tracking. He argues that FLoC – which aims to assign interest group identifiers to users – can be combined with an IP address to become a unique identifier.
"So any tracker that gets both [a FLoC cohort identifier and an IP address] can easily uniquely track and behaviorally target exceptionally well without third-party cookies or anything else," he [12]said .
The [13]DuckDuckGo tracker blocking app for mobile devices and desktop browser extensions can prevent trackers from loading, which not only serves to improve privacy but also speeds up page load times considerably.
In a page load time test of WebMD.com, the DuckDuckGo extension cut page load times for Chrome, Firefox, and Safari (with default settings) from 20.2, 15.3, and 13.1 seconds to 9.9, 9.1, and 7.5 respectively, or 46 per cent on average.
The extension reduced browsing data transferred by an average of 34 per cent and cut the number of browser requests for files per page load in Chrome, Firefox, and Safari respectively from 567, 602, and 411 to 164, 198, and 181, an average file count reduction of 66 per cent.
Enhanced web performance has long been a selling point for content blocking, ad blocking, and privacy extensions, many of which like uBlock Origin also prevent trackers from loading. But Weinberg points out that DuckDuckGo's software only blocks trackers and doesn't interfere with "non-creepy ads."
[14]
"DuckDuckGo is highly profitable based just on serving non-creepy contextual ads," he [15]said . "We believe in a future where these types of ads are normal again, and think this future can be similarly profitable for publishers." ®
Get our [16]Tech Resources
[1] https://spreadprivacy.com/browser-privacy-protection/
[2] https://www.theregister.com/2020/01/14/google_third_party_cookies_user_agent/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YGOfgDtbqjPkiclm8t6UvwAAAFQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://twitter.com/yegg/status/1376887280678342664?s=20
[5] https://www.facebook.com/business/learn/facebook-ads-pixel
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YGOfgDtbqjPkiclm8t6UvwAAAFQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2021/03/16/keep_scrolling_googles_privacy_labels/
[8] https://www.theregister.com/2021/02/24/dns_cname_tracking/
[9] https://www.theregister.com/2021/03/17/apple_china_tracking/
[10] https://www.theregister.com/2020/12/16/facebook_apple_privacy/
[11] https://www.theregister.com/2021/03/05/eff_google_floc/
[12] https://twitter.com/yegg/status/1376891226964828173?s=20
[13] https://duckduckgo.com/app
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YGOfgDtbqjPkiclm8t6UvwAAAFQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[15] https://twitter.com/yegg/status/1376893299437535234?s=20
[16] https://whitepapers.theregister.com/
DS999
Making it harder for everyone else to track is in their own interest now that their browser is a near monopoly across all non-Apple markets. And they still have the Google Analytics tracking for any website that uses Google Ads even when browsed by Safari or Firefox.
RegGuy1
Adblock Plus and No Script. Not perfect, but infinitely better than fuck-all protection.
Consultation over.
... oh, and NO CHROME.
Sin2x
It changed default search engine to DDG after installation without warning. Not a good practice.
JDPower
Nice ad, how much did they pay Reg to run it?
So, going by DuckDuckGo's claims, Google is not moving forward so much as stepping sideways on privacy. Continuing to slurp as much as before while limiting the benefits to third parties, something of course that leaves Google with something to sell.