International audience

Affiliate marketing is a growing performance-based marketing arrangement in which affiliates are rewarded for getting users to register, purchase, or visit a shopping website [ 16 , 38 ]. This marketing strategy is valued at $18.5 billion USD for 2025 [ 31 , 67 ]. Deal-sharing platforms take advantage of this marketing strategy by acting as storefronts for sellers that showcase promotions and deals. As the service is free to use, they earn commissions through affiliate links [ 36 ] when they lead to sales. We perform an in-depth, end-to-end study of the tracking techniques leveraged by Pepper [ 1 ] and its extended environment, a key player in deal-sharing platforms. Through a systematic 1-month crawl, we analyze the tracking ecosystem of 10 deal-sharing websites active in a diverse range of countries abiding by different privacy laws. Our analysis reveals that a significant part of the tracking occurs during redirect chains [ 40 ] between the deal-sharing platform and the shopping website. We quantify the tracking-specific use of cookies, CNAME cloaking [ 14 ], and link decorations [ 52 , 58 ] within redirect chains. We find that 67.9% of redirect chains leverage at least one of these additional tracking techniques. We show that redirect chains examined in prior work (limited to HTTP-based redirects) are significantly more constrained than those observed in our study (HTTP-, HTML-, and JS-based), which enable more aggressive behavior by dynamically loading additional tracking resources at runtime. Finally, by analyzing the ecosystem of third-party services and the privacy policies of deal-sharing websites, we reveal the omission of numerous actors involved in redirect chains.

Browser fingerprinting is a tracking technique that collects attributes and calls functions from the browser's APIs.Unlike cookies, browser fingerprints are difficult to evade or delete, raising significant privacy concerns for users as they can be used to re-identify individuals over browsing sessions without their consent.Yet, there has been limited research on the impact of browser configuration settings on these fingerprints.This paper introduces FP-Rainbow, a novel approach to systematically explore and map the configuration space of Chromiumbased web browsers aiming to identify the impact of configuration parameters on browser fingerprints and their changes over time.We explore 1, 748 configuration parameters (switches) and identify their impact on the browser's BOM (Browser Object Model).By collecting and analyzing over 61, 000 fingerprints from 18 versions of Chromium, our study reveals that 32 to 56 of these configuration parameters (depending on versions), such as disable-3d-apis or disable-notifications, influence the fingerprint of a web browser.FP-Rainbow also proves efficient in identifying browser configuration parameters from unknown fingerprints, achieving an average successful identification rate of 84% when considering a single configuration parameter and 78% when multiple parameters are involved, across all evaluated browser versions.These findings emphasize the importance of measuring the impact of configuration parameters on browsers to develop safer and more privacy-friendly web browsers. CCS Concepts•

With an ever growing number of smartphone users, the mobile gaming industry is booming and reached more than 2.6 billion players worldwide in 2020. While some mobile games charge a relatively modest fee to be played, the vast majority are free and rely exclusively on ads or tracking for their revenue streams. Over the years, Google and Apple have tightened their privacy requirements for apps. They perform thorough app scanning to detect abusive behaviours and require developers to provide a privacy policy on how they collect and handle user data. Yet, little is known about the data collection that fuels the advertising and tracking industry behind mobile games. Players can see the ads that are presented to them but they may not be aware of the invisible trackers that collect valuable data in the background.

Targeted online advertising has become an inextricable part of the way Web content and applications are monetized. At the beginning, online advertising consisted of simple ad-banners broadly shown to website visitors. Over time, it evolved into a complex ecosystem that tracks and collects a wealth of data to learn user habits and show targeted and personalized ads. To protect users against tracking, several countermeasures have been proposed, ranging from browser extensions that leverage filter lists, to features natively integrated into popular browsers like Firefox and Brave to combat more modern techniques like browser fingerprinting. Nevertheless, few browsers offer protections against IP address-based tracking techniques. Notably, the most popular browsers, Chrome, Firefox, Safari and Edge do not offer any.

Large-scale Web crawls have emerged as the state of the art for studying characteristics of the Web. In particular, they are a core tool for online tracking research. Web crawling is an attractive approach to data collection, as crawls can be run at relatively low infrastructure cost and don’t require handling sensitive user data such as browsing histories. However, the biases introduced by using crawls as a proxy for human browsing data have not been well studied. Crawls may fail to capture the diversity of user environments, and the snapshot view of the Web presented by one-time crawls does not reflect its constantly evolving nature, which hinders reproducibility of crawl-based studies. In this paper, we quantify the repeatability and representativeness of Web crawls in terms of common tracking and fingerprinting metrics, considering both variation across crawls and divergence from human browser usage. We quantify baseline variation of simultaneous crawls, then isolate the effects of time, cloud IP address vs. residential, and operating system. This provides a foundation to assess the agreement between crawls visiting a standard list of high-traffic websites and actual browsing behaviour measured from an opt-in sample of over 50,000 users of the Firefox Web browser. Our analysis reveals differences between the treatment of stateless crawling infrastructure and generally stateful human browsing, showing, for example, that crawlers tend to experience higher rates of third-party activity than human browser users on loading pages from the same domains.