View all newsletters
Receive our newsletter - data, insights and analysis delivered to you
  1. Technology
  2. Cybersecurity
October 10, 2013

Top websites are secretly tracking users

Users' device fingerprints are being tracked by some of the internet's top websites

By Kate Heslop

A new study has found that many of the internet’s top websites are tracking users without their permission or knowledge.

KU Leuven-iMinds researchers have released a study that has found 145 of the internet’s 10,000 top websites tracks users without their knowledge or consent. The websites use hidden scripts to extract a device fingerprint from users’ browsers. Device fingerprinting circumvents legal restrictions imposed on the use of cookies and ignores the Do Not Track HTTP header.

The researchers discovered that the websites used Flash-based fingerprinting. Some Flash objects included questionable techniques such as revealing a user’s original IP address when visiting a website through a third party.

Device fingerprinting, also known as browser fingerprinting, is the practice of collecting properties of PCs and mobile devices to identify and track users. This includes the screen size, the versions of installed software and plug-ins, and the list of installed fonts.

The Electronic Frontier Foundation (EFF) conducted a study showing that, for the vast majority of browsers, the combination of these properties is unique, therefore functioning as a ‘fingerprint’ that can be used to track users without relying on cookies. Device fingerprinting targets either Flash or JavaScript.

The study also found that 404 of the top 1 million sites use JavaScript-based fingerprinting, which allows sites to track non-Flash mobile devices.

It was also found that users are tracked by these device fingerprinting technologies even if they explicitly request not to be tracked by enabling the Do Not Track (DNT) HTTP header.

Content from our partners
Scan and deliver
GenAI cybersecurity: "A super-human analyst, with a brain the size of a planet."
Cloud, AI, and cyber security – highlights from DTX Manchester

Device fingerprinting can be used for various security-related tasks, including fraud detection and protection against account hijacking. But it is also being used for analytics and marketing purposes via fingerprinting scripts hidden in advertising banners.

Websites in our network
Select and enter your corporate email address Tech Monitor's research, insight and analysis examines the frontiers of digital transformation to help tech leaders navigate the future. Our Changelog newsletter delivers our best work to your inbox every week.
  • CIO
  • CTO
  • CISO
  • CSO
  • CFO
  • CDO
  • CEO
  • Architect Founder
  • MD
  • Director
  • Manager
  • Other
Visit our privacy policy for more information about our services, how Progressive Media Investments may use, process and share your personal data, including information on your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.