Invisible Pixels. In *PETS 2020 - 20th Privacy Enhancing Technologies Symposium (PETs (Privacy Enhancing Technologies Symposium)).* Montréal, Canada. https://hal.inria.fr/hal-01943496

[49] Imane Fouda, Nataliia Bielova, Arnaud Legout, and Natasa Sarafijanovic-Djukic. 2020. Missed by Filter Lists: Detecting Unknown Third-Party Trackers with Invisible Pixels. *Proc. Priv. Enhancing Technol.* 2020. https://doi.org/10.2478/popets-2020-0038

[50] Imane Fouda, Cristiana Santos, Feras Al Kassar, Nataliia Bielova, and Stefano Calzavara. 2020. On Compliance of Cookie Purposes with the Purpose Specification Principle. In *IWPE 2020 - International Workshop on Privacy Engineering*. Genova, Italy, 1-8. https://hal.inria.fr/hal-02567022

[51] Imane Fouda, Cristiana Santos, Feras Al Kassar, Nataliia Bielova, and Stefano Calzavara. 2020. On Compliance of Cookie Purposes with the Purpose Specification Principle. In *2020 International Workshop on Privacy Engineering, IWPE*. https://hal.inria.fr/hal-02567022.

[52] Imane Fouda, Cristiana Santos, Arnaud Legout, and Nataliia Bielova. 2022. My Cookie is a phoenix: detection, measurement, and lawfulness of cookie respawning with browser fingerprinting. In *PETS 2022 - 22nd Privacy Enhancing Technologies Symposium*. Sydney, Australia. https://hal.archives-ouvertes.fr/hal-03218403 Accepted at the 22nd Privacy Enhancing Technologies Symposium (PETS 2022).

[53] GDPR 2016. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32016R0679.

[54] Alejandro Gómez-Boix, Pierre Laperdix, and Benoit Baudry. 2018. Hiding in the Crowd: an Analysis of the Effectiveness of Browser Fingerprinting at Large Scale. In *WWW2018 - TheWebConf 2018: 27th International World Wide Web Conference*. Lyon, France, 1-10. https://doi.org/10.1145/3178876.3186097

[55] Google3PCookiesDeath 2024. Update on the plan for phase-out of third-party cookies on Chrome - The Privacy Sandbox blog. https://privacysandbox.com/intl/en_us/news/update-on-the-plan-for-phase-out-of-third-party-cookies-on-chrome/.

[56] GoogleHealth 2024. Healthcare and medicines - Google Advertising Policies Help. https://support.google.com/adspolicy/answer/176031.

[57] GoogleSST 2023. Google Server-side tagging. https://developers.google.com/tag-platform/tag-manager/server-side.

[58] IABSDA 2024. Seller Defined Audiences - IAB Tech Lab. https://iabtechlab.com/sda/.

[59] IABSDA 2024. Audient Taxonomy 1.1 - IAB Tech Lab. https://github.com/InteractiveAdvertisingBureau/Taxonomies/blob/main/Audience%20Taxonomies/Audience%20Taxonomy%201.1.tsv.

[60] IdentityGraphsAWS 2022. Identity Graphs on AWS - AWS. https://aws.amazon.com/neptune/identity-graphs-on-aws/.

[61] IdentityGraphsLiveRamp 2022. Identity Resolution - LiveRamp. https://liveramp.com/identity-resolution/.

[62] ItalianDPA-cookiewall-2021 2021. Guidelines on the use of cookies and other tracking tools. Technical Report. Guidelines on the use of cookies and other tracking tools.

[63] John Wilander. 2021. Introducing Private Click Measurement, PCM - WebKit Blog. https://webkit.org/blog/11529/introducing-private-click-measurement-pcm/.

[64] Justin Schuh. 2020. Building a more private web: A path towards making third party cookies obsolete - Chromium Blog. https://blog.chromium.org/2020/01/building-more-private-web-path-towards.html.

[65] Pierre Laperdix, Nataliia Bielova, Benoit Baudry, and Gildas Avoine. 2020. Browser Fingerprinting: A Survey. *ACM Trans. Web* 14, 2, Article 8 (apr 2020), 33 pages. https://doi.org/10.1145/3386040

[66] Pierre Laperdix, Walter Rudametkin, and Benoit Baudry. 2016. Beauty and the Beast: Diverting modern web browsers to build unique browser fingerprints. In *37th IEEE Symposium on Security and Privacy (S&P 2016)*. https://hal.inria.fr/hal-01285470

[67] Adam Lerner, Anna Kornfeld Simpson, Tadayoshi Kohno, and Franziska Roesner. 2016. Internet Jones and the Raiders of the Lost Trackers: An Archaeological Study of Web Tracking from 1996 to 2016. In *25th USENIX Security Symposium (USENIX Security 16)*. USENIX Association.

[68] manifestv3AdGuard 2022. AdGuard publishes the world's first ad blocker built on Manifest V3 - AdGuard. https://adguard.com/en/blog/adguard-mv3.html.

[69] Martin Thomson. 2022. Privacy Preserving Attribution for Advertising - Mozilla Blog. https://blog.mozilla.org/en/mozilla/privacy-preserving-attribution-for-advertising/.

[70] mcafee 2023. McAfee categorization service. https://sitelookup.mcafee.com/.

[71] Vikas Mishra, Pierre Laperdix, Antoine Vastel, Walter Rudametkin, Romain Rouvoy, and Martin Lopatka. 2020. Don't Count Me Out: On the Relevance of IP Address in the Tracking Ecosystem. In *Proceedings of The Web Conference 2020 (Taipei, Taiwan) (WWW '20)*. Association for Computing Machinery, New York, NY, USA, 808-815. https://doi.org/10.1145/3366423.3380161

[72] Keaton Mowery and Hovav Shacham. 2012. Pixel Perfect: Fingerprinting Canvas in HTML5. In *Proceedings of W2SP 2012*, Matt Fredrikson (Ed.). IEEE Computer Society.

[73] Nick Nikiforakis, Alexandros Kapravelos, Wouter Joosen, Christopher Kruegel, Frank Piessens, and Giovanni Vigna. 2013. Cookieles Monster: Exploring the Ecosystem of Web-Based Device Fingerprinting. In *IEEE Symposium on Security and Privacy, SP 2013*. 541-555. https://doi.org/10.1109/SP.2013.43

[74] Lukasz Olejnik, Minh-Dung Tran, and Claude Castelluccia. 2014. Selling off User Privacy at Auction. In *21st Annual Network and Distributed System Security Symposium, NDSS 2014*, San Diego, California, USA, February 23-26, 2014.

[75] OpenWPM 2022. Information stored by OpenWPM. https://github.com/mozilla/OpenWPM.

[76] Panagiotis Papadopoulos, Nicolas Kourtellis, and Evangelos Markatos. 2019. Cookie Synchronization: Everything You Always Wanted to Know But Were Afraid to Ask. In *The World Wide Web Conference (San Francisco, CA, USA) (WWW '19)*. Association for Computing Machinery, New York, NY, USA, 1432-1442. https://doi.org/10.1145/3308558.3313542

[77] Ratcliff-Obershelp 2024. Ratcliff-Obershelp algorithm. https://xlinux.nist.gov/dads/HTML/ratcliffObershelp.html.

[78] Abbas Razaghpanah, Rishab Nithyanand, Narseo Vallina-Rodriguez, Srikanth Sundaresan, Mark Allman, Christian Kreibich, and Phillipa Gill. 2018. Apps, Trackers, Privacy, and Regulators: A Global Study of the Mobile Tracking Ecosystem. In *Network and Distributed System Security Symposium, NDSS*.

[79] Tongwei Ren, Alexander Wittman, Lorenzo De Carli, and Drew Davidson. 2021. An analysis of first-party cookie exfiltration due to name redirections. *Workshop on Measurements, Attacks, and Defenses for the Web (MADWeb)* (2021).

[80] Franziska Roesner, Tadayoshi Kohno, and David Wetherall. 2012. Detecting and Defending Against Third-Party Tracking on the Web. In *Proceedings of the 9th USENIX Symposium on Networked Systems Design and Implementation, NSDI 2012*. 155-168.

[81] SameOriginPolicy 2010. Same Origin Policy. https://www.w3.org/Security/wiki/Same_Origin_Policy.

[82] Iskander Sanchez-Rola, Matteo Dell'Amico, Davide Balzarotti, Pierre-Antoine Vervier, and Leyla Bilge. 2021. Journey to the Center of the Cookie Ecosystem: Unraveling Actors' Roles and Relationships. In *2021 IEEE Symposium on Security and Privacy (SP)*. 1990-2004. https://doi.org/10.1109/SP40001.2021.9796062

[83] Cristiana Santos, Nataliia Bielova, and Célestin Matte. 2020. Are cookie banners indeed compliant with the law? Deciphering EU legal requirements on consent and technical means to verify compliance of cookie banners, journal=Technology and Regulation. (2020), 91-135. https://doi.org/10.26116/techreg.2020.009

[84] Ashkan Soltani, Shannon Canty, Quentin Mayo, Lauren Thomas, and Chris Jay Hoofnagle. 2010. Flash Cookies and Privacy. In *AAAI Spring Symposium: Intelligent Information Privacy Management*.

[85] SST1stParty 2023. Map a custom domain to your service - Server-side tagging fundamentals from Google. https://developers.google.com/tag-platform/learn/sst-fundamentals/8-upgrade-infrastructure#map-a-custom-domain-to-your-service.

[86] t-mobile 2023. T-mobile Manage cookies page. https://www.t-mobile.com/dns.

[87] t-mobile 2023. T-mobile website. https://www.t-mobile.com/.

[88] t-mobile-policy 2023. T-mobile privacy policy. https://www.t-mobile.com/privacy-center/privacy-notices/t-mobile-privacy-notice.

[89] Transparency20WP 2018. "Guidelines on transparency under Regulation 2016/679, WP260 rev.01. https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=622227.

[90] ublockSST 2022. Static filter syntax - uBlock Origin. https://github.com/gorhill/uBlock/wiki/Static-filter-syntax.

[91] UK DPA. 2020. Guidance on the rules on use of cookies and similar technologies', 2020.

[92] Vinay Goel. 2021. An updated timeline for Privacy Sandbox milestones - Google Blog. https://blog.google/products/chrome/updated-timeline-privacy-sandbox-milestones/.

[93] Vinay Goel. 2022. Get to know the new Topics API for Privacy Sandbox - Google Blog. https://blog.google/products/chrome/get-know-new-topics-api-privacy-sandbox/.

[94] Vera Wesselkamp, Imane Fouda, Cristiana Santos, Yanis Boussad, Nataliia Bielova, and Arnaud Legout. 2021. In-Depth Technical and Legal Analysis of Tracking on Health Related Websites with ERNIE Extension. In *Proceedings of the 20th Workshop on Workshop on Privacy in the Electronic Society (Virtual Event, Republic of Korea) (WPE'S '21)*. Association for Computing Machinery, New York, NY, USA, 151-166. https://doi.org/10.1145/3463676.3485603

[95] whois 2023. Whois library. https://pypi.org/project/whois/.

[96] David Zeber, Sarah Bird, Camila Oliveira, Walter Rudametkin, Ilana Segall, Fredrik Wollésén, and Martin Lopatka. 2020. The Representativeness of Automated Web Crawls as a Surrogate for Human Browsing. In *Proceedings of The Web Conference 2020*. 167-178.
# 11 APPENDIX

## A Cookies lifetime

We analyze the lifetime of the cookies used by cloaked trackers and SST domains. Figure 5 presents the results of our analysis. For each domain, we consider the maximum lifetime of cookies set or received by the domain. Our findings reveal that 401(84.60%) out of 474 cloaked trackers utilize cookies with an expiration date exceeding 30 days, a threshold commonly employed by related works as a filter for the expiration date [40]. Additionally, we observed that 31 (96.87%) out of 32 detected SST domains have cookies with expiration dates higher than 30 days.

<figure><img src="image_8.png" /><figcaption>Figure 5: Cookies lifetime.</figcaption></figure>

## B SST websites categorization

Table 5 presents the top 5 categories of websites including SST. We analyzed the category of the visited 7,367 websites, and found that Internet services, Finance/banking, and Online shopping rank among the top 10 visited categories, indicating high user usage of these categories. Motor Vehicles and Online shopping are the categories that present the highest inclusion of SST within their category.

## C Machine characteristics

Table 6 presents the characteristics of *Pre-SST crawl* and *Post-SST crawl* used in our study.

<table><caption>Table 5: Top 5 category of websites including SST. *SST Prevalence*: refers to the percentage of websites employing SST out of the total 28 detected SST websites instances. *Category prevalence*: represents the category prevalence out of the studied 7,367 websites. *Inclusion*: indicates the percentage of SST websites within the same category.</caption><thead><tr><td>Website category</td><td>SST Prevalence</td><td>Category prevalence</td><td>Inclusion</td></tr></thead><tbody><tr><td>Online Shopping</td><td>17.86%</td><td>4.88%</td><td>1.38%</td></tr><tr><td>Finance/Banking</td><td>14.29%</td><td>5.7%</td><td>0.95%</td></tr><tr><td>Business</td><td>10.71%</td><td>7.07%</td><td>0.58%</td></tr><tr><td>Motor Vehicles</td><td>10.71%</td><td>0.55%</td><td>6.82%</td></tr><tr><td>Internet Services</td><td>7.14%</td><td>5.90%</td><td>0.46%</td></tr></tbody></table>

<table><caption>Table 6: Crawls Characteristics.</caption><thead><tr><td>Characteristics</td><td>Pre-SST crawl</td><td>Post-SST crawl</td></tr></thead><tbody><tr><td>Visited websites</td><td>Alexa top 10,000 [13]</td><td>Alexa top 10,000 [13]</td></tr><tr><td>Visited webpages</td><td>Landing pages</td><td>Landing pages</td></tr><tr><td>Date of the crawl</td><td>March 2020</td><td>May 2022</td></tr><tr><td>Crawl state</td><td>Stateless</td><td>Stateless</td></tr><tr><td>OpenWPM version</td><td>OWPM 0.14.0</td><td>OWPM 0.19.1</td></tr><tr><td>Browser</td><td>FF86.0.1</td><td>FF95</td></tr><tr><td>Location</td><td>EU</td><td>EU</td></tr></tbody></table>
# 11 APPENDIX

## A Cookies lifetime

We analyze the lifetime of the cookies used by cloaked trackers and SST domains. Figure 5 presents the results of our analysis. For each domain, we consider the maximum lifetime of cookies set or received by the domain. Our findings reveal that 401(84.60%) out of 474 cloaked trackers utilize cookies with an expiration date exceeding 30 days, a threshold commonly employed by related works as a filter for the expiration date [40]. Additionally, we observed that 31 (96.87%) out of 32 detected SST domains have cookies with expiration dates higher than 30 days.

<figure><img src="image_8.png" /><figcaption>Figure 5: Cookies lifetime.</figcaption></figure>

## B SST websites categorization

Table 5 presents the top 5 categories of websites including SST. We analyzed the category of the visited 7,367 websites, and found that Internet services, Finance/banking, and Online shopping rank among the top 10 visited categories, indicating high user usage of these categories. Motor Vehicles and Online shopping are the categories that present the highest inclusion of SST within their category.

## C Machine characteristics

Table 6 presents the characteristics of *Pre-SST crawl* and *Post-SST crawl* used in our study.

<table><caption>**Table 5: Top 5 category of websites including SST.** *SST Prevalence:* refers to the percentage of websites employing SST out of the total 28 detected SST websites instances. *Category prevalence:* represents the category prevalence out of the studied 7,367 websites. *Inclusion:* indicates the percentage of SST websites within the same category.</caption><thead><tr><th>Website category</th><th>SST Prevalence</th><th>Category prevalence</th><th>Inclusion</th></tr></thead><tbody><tr><td>Online Shopping</td><td>17.86%</td><td>4.88%</td><td>1.38%</td></tr><tr><td>Finance/Banking</td><td>14.29%</td><td>5.7%</td><td>0.95%</td></tr><tr><td>Business</td><td>10.71%</td><td>7.07%</td><td>0.58%</td></tr><tr><td>Motor Vehicles</td><td>10.71%</td><td>0.55%</td><td>6.82%</td></tr><tr><td>Internet Services</td><td>7.14%</td><td>5.90%</td><td>0.46%</td></tr></tbody></table>

<table><caption>**Table 6: Crawls Characteristics.**</caption><thead><tr><th>Characteristics</th><th>Pre-SST crawl</th><th>Post-SST crawl</th></tr></thead><tbody><tr><td>Visited websites</td><td>Alexa top 10,000 [13]</td><td>Alexa top 10,000 [13]</td></tr><tr><td>Visited webpages</td><td>Landing pages</td><td>Landing pages</td></tr><tr><td>Date of the crawl</td><td>March 2020</td><td>May 2022</td></tr><tr><td>Crawl state</td><td>Stateless</td><td>Stateless</td></tr><tr><td>OpenWPM version</td><td>OWPM 0.14.0</td><td>OWPM 0.19.1</td></tr><tr><td>Browser</td><td>FF86.0.1</td><td>FF95</td></tr><tr><td>Location</td><td>EU</td><td>EU</td></tr></tbody></table>