Web tracking

Authors: Hunter Dorwart and Rob van Eijk

To track and to get tracked: new innovative methods and advancements

• On September 30, 2020, the Future of Privacy Forum participated in a panel at the Annual Privacy Forum 2020 (APF-2020).
• The event is organized annually by the European Union Agency for Cybersecurity (ENISA), the Directorate-General for Communications Networks, Content and Technology (DG CONNECT), and the Catlica University of Portugal, Lisbon School of Law.
• FPFs Rob van Eijk contributed to a panel on tracking and tracing, To track and to get tracked: new innovative methods and advancements, alongside Marit Hansen (State Data Protection Commissioner of Land Schleswig-Holstein), Fernando Silva (Banco de Portugal, DPO cabinet), and Prokopios Drogkaris (ENISA, moderator).

The Pros and Cons of Existing Legal Provisions Against Tracking 

• The process of online tracking has evolved with the advancement of technology and as a result has become more ubiquitous and connected.
• Today, tracking through applications or even IoT devices is augmenting user behavior.
• In some instances, users might request the provision of such tracking services or consider it as the default option.
• The proliferation of tracking tools across the technological ecosystem raises the question: how to define the process of tracking?
• These choices create confusion and make it difficult to determine which cookies are strictly necessary for the website to function.

Recent Technological Changes in the Industry Can Complement Legal Instruments

•  
  1. Stricter browser security settings, e.g., SameSite cookies and Strict Site Isolation. We remark that the implementation of these settings differs by browsers.
  2. Google’s Federated Learning of Cohorts (FLoC), which aims to embed privacy by decentralizing the browser itself. FLoC uses machine learning in the browser to group people into audience segments.
  3. Apple’s IDFA and App Tracking Transparency Framework, which requires developers in iOS 14 to offer Privacy Nutrition Labels and obtain consent prior to tracking users across apps and websites.
  4. The Global Privacy Control (GPC), which allows users to request that their data not be sold or shared and has been included in US state legislation such as the CCPA.
  • In addition, any evaluation of existing legal provisions to mitigate harmful tracking must also take into account the way big industry players are addressing the concerns.
  • Rob van Eijk gave an overview of how tracking technologies work behind the scenes of an online advertisement in order to make sense of the latest technological advancements in the industry (Figure 1).
  • With respect to web browsing and cookies, there are a variety of tracking differences between the major browsers that illustrate how the industry is changing.
  • Such developments require policymakers and industry leaders to reevaluate their approach to traditional notice and choice frameworks because of the interconnected nature of technology and data sharing.
  • Such privacy by default should work in tandem with legal instruments.

Tracking Versus Tracing – Lessons Learned from Covid-19

• Questions around tracking and tracing of data have become increasingly important in the context of Covid-19.
• Hansen stressed that tracing does not automatically equal tracking as tracing tools are not always used to identify and track specific users.
• Governments around the world have utilized tracing techniques to mitigate and control the spread of the virus.
• Fernando Silva, pointed out that the debate about tracking and tracing is not new.
• While each of these technologies offered safer methods for tracing, companies quickly began configuring these tools for tracking purposes.

Building Trust Through Verification and Design

• As dependence on critical technologies grow, there is a real risk that users will lose even more control over how companies harvest their data.
• Indeed, without transparency and verification, new technologies can enable covert tracking and reinforce the imbalance of power by excluding individuals from services if they do not accept a more privacy-intrusive default setting.
• In closing, Silva suggested that independent verification of these technologies could help engender trust and credibility in how governments and companies use them to combat Covid-19.
• Overcoming this gap requires embedding privacy into the configuration and design of technologies themselves and not letting new degrees of surveillance become the norm.