Towards a Global Perspective on Web Tracking
Nayanamana Samarasinghe˚, Mohammad Mannan
Concordia Institute for Information Systems Engineering, Concordia University, Montreal, Canada

Abstract
Several past measurement studies uncovered various aspects of web-based tracking and its serious impact on user privacy. Most studies used institutional resources, e.g., computers hosted at well-known universities, or cloud-computing
infrastructures such as Amazon EC2, confining the study to a particular geolocation or a few locations. Would there
be any difference if web tracking is measured from actual user-owned residential machines? Does a user’s geolocation affect web tracking? Past studies do not adequately answer these important questions, although web users comefrom across the globe, and tracking primarily targets home users. As a step forward, we leverage the Luminati proxyservice to run a measurement study using residential machines from 56 countries. We rely on the OpenWPM web
privacy measurement framework to analyze third-party scripts and cookies in 2050 distinct URLs (Alexa Top-1000
home pages and Alexa Top-50 country-specific home pages for all 56 countries, and shared URLs via Twitter from
Alexa Top-1000 domains for 10 countries). Our findings reveal that the prevalence of web tracking varies across theglobe. In addition to location, tracking also seems to depend on factors such as data privacy policies, Internet speed
and censorship. We also observe that despite legal efforts for strengthening privacy, such as the EU cookie law, violations are common and very blatant in some cases, highlighting the need for more effective tools and frameworks forcompliance monitoring and enforcement.
Keywords: geolocation, internet, privacy, tracking, web

1. Introduction

Several past studies explore the extent of tracking, evolving techniques used for tracking, and privacy/business implications of tracking. The literature on
Third-party web tracking based on user-behavioral protracking is rich and becoming very useful to researchers
filing has become a major enabling technique for online
and regulatory bodies. Englehardt and Narayanan [3]targeted ads (for business impacts see e.g., [1]; see also
recently measured the extent of third-party trackers on
Mayer and Mitchell [2] for a discussion on economics andAlexa Top-1M websites using the OpenWPM frametracking). Tracking is generally performed using cookies,
work [3]. They run their crawler from an Amazon EC2 inscripts and browser/traffic fingerprinting (see e.g., [3, 2]).
stance. Fruchter et al. [7] performed another study, albeit
Beyond ads/analytics, tracking can also be effectively exat a much smaller scale (Alexa Top-250 country-specificploited by government surveillance programs [4]. Indeed,websites), to uncover variations in tracking in four geothe US NSA has reportedly used Google cookies for targraphical locations (US, Germany, Australia and Japan)
geted hacking/surveillance [5, 6].
of varying policies/laws/cultures. They also used Amazon EC2 machines from different locations. Falahrastegar et al. [8] studied web tracking using Alexa Top-500
˚ Corresponding author
country-specific websites for seven countries (USA, UK,
Email address: n_samara@ciise.concordia.ca (Nayanamana
Samarasinghe)

Preprint submitted to Elsevier

July 30, 2019

Australia, China and Egypt, Iran, and Syria) from a single
location in the UK. To evaluate the possibility of surveillance via (third-party) cookies and (first-party) plaintext
user-identifiers, Englehardt et al. [4] used Amazon EC2
instances from three geolocations: US (Northern Virginia), Ireland (Dublin), Japan (Tokyo).
Although the study by Fruchter et al. [7] indicates that
there are significant differences between countries (fourin the study), all past studies lack a global perspective, interms of the number of locations used to measure tracking(1 to 4 countries). Also, all studies were conducted frominstitutional machines and known IP ranges (university/Amazon), although tracking primarily targets homeusers (residential machines). Institutional/data center
proxies are also prone to be blocked or challenged withCAPTCHAs, to mitigate potential abuse (see e.g., [9]).
Therefore, for tracking measurements, the use of residential machines appear to be more appropriate. In someother security-related studies, such as censorship [10],end-to-end connectivity violation [11], and DNSSEC
infrastructure management [12], geolocation and/or theuse of residential machines have been taken into more
serious consideration.
We focus on exploring the effects of geographical variations in tracking as experienced by residential users invarious parts of the world. Considering differences in political, social, and cultural factors, we choose 56 countries
from across the world for crawling a selected set of web
sites, using the Luminati HTTP/S proxy service [13].1
Using OpenWPM, we automatically crawl different
types of website URLs (first parties) including the Alexa
Top-1000 global sites (home pages), 1000 URLs hostedon the selected Alexa web domains that were shared
via Twitter, and Alexa Top-50 country-specific sites(home pages). Subsequently, we extract third-party
information of scripts and cookies from the OpenWPM
database, and process them using EasyList rules [15] with
BlockListParser [16] to perform privacy-related tracking
measurements.

Our results show that the prominence of trackers varies
significantly between countries – not only in the countryspecific sites, but also for global sites. Furthermore,
tracker prominence of inner links of a website appears
to be higher than its home page. A significant number of third parties place cookies on websites with longvalidity periods (e.g., >20 years), egregiously violating
any reasonable use scenario, and in some cases existinglaws/regulations (e.g., the EU cookie law). Although mosttrackers are global in nature (mostly owned by US companies), top trackers from countries such as China and Russia appear to operate only within the same country.
Contributions.
1. We extend existing tracking measurement studies
in three important directions: (1) crawling websites from 56 countries around the world, representing different political, cultural, regulatory, and Internet speed and freedom situations (cf. four countries used in [7]); (2) the use of residential computers
via the Luminati proxy service as opposed to institutional/data center machines; and (3) analyzing web
content from home pages and inner links of selected
Alexa domains (also studied in [3] for a single location). Our methodology provides a more bona fide,
global perspective on tracking.
2. We find that for most cases, a tracker’s prominencechanges significantly with the geographic location,
beyond the dynamic nature of current advertisement/tracking ecosystems (which we also measureseparately from Montreal, Canada).
3. We also confirm the findings from existing studies
and extend them; e.g., similar to Trevisan et al. [17],we also found that the EU cookie law [18] is violated by most tracking companies/sites. Forwarding
web requests to local IP addresses through DNS hijacking was reported for Iran [19]; we also observe
similar behavior in Saudi Arabia and Uzbekistan insignificant numbers.
2. Related Work

1 Luminati is a commercial network proxy service, providing resi-

dential exit nodes in many countries. Recent work by Mi et al. [14]raises serious doubts about how these machines are recruited (e.g., possibility of compromised machines). However, their methodology forcharacterizing Luminati nodes appears to be unclear—discussed morein Section 2.

Our work provides a more inclusive, global perspective on tracking, by leveraging existing tools and methodologies from several past studies. Here we summarize
a few such efforts. Fruchter et al. [7] measure tracking
2variations in four countries with different privacy models(as categorized in [20]): (1) comprehensive, protecting
all digital data (Germany); (2) sectoral, protecting certain types of data such as health-care (USA, Japan); (3)co-regulatory, similar to (1), but enforcement is done byindustry (Australia); and (4) mixed/no-policy, no protection for digital privacy (China/Russia, not studied in [7]due to the non-availability of AWS EC2 instances in thosecountries). They use Alexa Top-250 country-specificsites, and report significant differences in tracking activities between the countries. For example, the number ofthird-party cookies in news sites are considerably morein the USA, Japan and Australia, compared to Germany.
They further conclude that tracking differences in countries may not solely depend on their privacy models, butalso on factors such as policy, regulations and culture.
Tracking primarily leverages third-party scripts andcookies, but other advanced/subtle techniques are also
used, e.g., evercookies, cookie syncing, and fingerprintingof browser type, canvas/font, web traffic, and WebRTC,
AudioContext and battery-level APIs; cf. [21, 2, 22].
In a comprehensive measurement study, Englehardt andNarayanan [3] recently measured the extent of third-partyon Alexa Top-1M websites using the OpenWPM framework [3]. They make 15 types of measurements of stateless and stateful tracking techniques. Their results include many important findings: only few third-parties arepresent in most sites, news sites hosting the most numberof trackers, the use of advanced stateless fingerprinting
techniques in the wild, and effectiveness of anti-tracking
measures (addons and browser features). They also crawl
four internal pages of Alexa Top-10K domains; top 20
trackers are found more prominently on the internal pages
compared to the home pages.
Tyson et al. [23] analyze the degree of HTTP header
manipulation by middleboxes across ASes in different
networks and regions around the world, using Hola [24](a peer-to-peer VPN service operated by Luminati). They
report that 25% of the ASes modify HTTP headers, andthe level of manipulation depends on the region and AS
type: well-connected regions have fewer caching headersthan less-connected regions with costly transit. However,the frequent use of cached data from legacy middleboxes
can be exploited.
Using Luminati, Chung et al. [11] propose a novel
approach to identify end-to-end violations in HTTP,HTTPS and DNS protocols. They observe that web
content sent over HTTP is compressed inflight by some
ISPs. They identify a vulnerability where HTTP requests
from users are recorded at ISP middleboxes, and the samecontent is fetched later by third party servers. This allows
adversaries to monitor HTTP responses, raising privacy
implications.
Pearce et al. [10] designed a measurement platform
to assess DNS manipulation attempts for imposing Internet censorship, by leveraging OpenDNS resolvers hosted
by ISPs and cloud service providers from 151 countries.
They reported that DNS manipulation is heterogeneous
across countries, domains and DNS resolvers. Several
countries such as Iran, Pakistan, China are found to use
DNS manipulation for censorship.
Merzdovnik et al. [25] analyze the effectiveness of current anti-tracking privacy tools on more than 100,000
websites from Alexa Top-200K domains; some of thesetools are very effective (over 90% success rates) against
stateful trackers, and less successful against stateless fingerprinting trackers. They also report that over 60% of
the third-party requests didn’t use TLS, which makes it
possible for adversaries to passively analyze the unencrypted traffic (i.e., third-party requests and responses).
They also highlight the danger of over-reliance of a specific third-party tracker being used in a large number offirst-party sites (cf. NSA’s alleged exploitation of Google
cookies [5, 6]).
According to the EU Internet Handbook [18], the useof profiling/tracking cookies require explicit user-consent;
session cookies and cookies that are required for essential functionality are exempted. Trevisan et al. [17] use
35,862 popular sites from 25 countries (21 EU and 4 nonEU) to measure the compliance of the EU ePrivacy Directive (also known as the EU cookie law). They also
use proxy services from eight EU countries to check variations of tracking cookies based on browsing locations(the EU cookie law’s enforcement varies across member
states). The authors identify cookies in trackable context
by comparing them with a public list of web tracker domains.2 They find 65% of the web sites fail to comply
with the cookie law (i.e., a cookie is set before a cookie
accept bar is even displayed to the user). They also ob2 https://better.fyi/trackers/alexa-top-500-news/

3

serve that 80% of the third-party cookies last more thana month, and approximately half of those cookies remain
valid for more than a year. We find 22% of the cookies
remain valid over a year across EU countries (vs. 23%
across all 56 countries).
Mayer et al. [2] observe that third-party web tracking
is transitioning from a regulatory vacuum to regulatory
frameworks, implemented by government organizations(e.g., US FTC, EU ePrivacy Directive, and self-regulatory
programs such as Network Advertising Initiative, Interactive Advertising Bureau).
Degeling et al. [26] analyzed GDPR’s impact on Top500 country specific sites in 28 member states in the EU.
They found that GDPR made the majority of companies
to make adjustments to accommodate the new regulations.
Despite, the authors claim, we find that tracking activities
have not changed and most cookie consenting libraries are
not meeting the requirements of the GDPR.
Schelter et al. [27] performed a large scale analysisof third-party trackers using the Common Crawl 2012
corpus. The corpus may contain tracking informationof residential as well as institutional users. Since third
parties are extracted from static embedding of web
pages, transient trackers having dynamic content are
not considered. In contrast, our study includes mostly
residential computers, and the content we collected is not
limited to static trackers.
Web services may be divided into categories e.g., culture, religion, news, sports, etc. To measure tracking variation across different categories, Falahrastegar et al. [8]study seven countries from all continents with different
languages using 500 most popular country-specific web
sites (crawled from a UK location). Their findings showthat some of the top trackers are local to the hosting country of the corresponding first-party website (e.g., websites
from China and Iran).
Mi et al. [14] use five residential proxy services including Luminati, for illegal/unwanted/malicious nodes inthese ecosystems. They claim that Luminati runs many
IoT devices although most exit nodes are indeed residential. However, their methodology for detecting IoT
devices inside a NAT requires scanning the internal network (local subnet), which is disallowed by Luminati;
thus, such device characterization for Luminati seems to
be flawed (also confirmed by Luminati). Luminati also
informed us that their proxy software is not supported on

any IoT devices (available only for desktop and mobile
OSes). Also, Luminati software is installed with explicit
user consent, in contrast to the claim by Mi et al. [14]—see Section 4.4 for more issues related to ethics.

3. Background on Luminati and OpenWPM
Luminati. Luminati [13] is a commercial HTTP/S proxyservice provider that routes traffic through 35 million
residential IPs worldwide. The service operates over
Hola [24] and applications built using the Luminati Monetization SDK [28]—residential users without a paid subscription. Luminati is gradually transitioning from Holato the SDK model. However, at the time we ran our experiments, Hola was used comprehensively for Luminati’s
exit node infrastructure. Routing in Luminati goes as follows: a Luminati client makes a proxy connection to a
Luminati proxy server (super proxy); the server forwards
the request to an exit node (peer proxy); and the exit node
forwards the response to the super proxy, which in turn issent back to the Luminati client. Luminati enables selecting exit nodes by country (or city/ASN at a higher cost),
and allows the same exit node to be used in subsequent
requests by using the “sequential session (IP) pool” option. Switching the IP address of an exit node in the poolcan be configured based on the number of maximum requests and session duration parameters, or at random. Luminati also allows controlling DNS resolution to happen
at the super proxy (Google Public DNS), or the exit node.
We choose a sequential pool of pre-established sessions to
run a group of requests to target sites. Also, we configure
DNS resolution to happen at a super proxy (US), to prevent DNS localization of web site domains at exit nodes
so that trackers of the same first-party site are comparable between countries; e.g., when crawling amazon.com,
we do not want the exit node to retrieve content froma regional first party site e.g., amazon.com.mx due to
DNS localization. This is unlikely to influence the comparison of regional trackers as their DNS resolution remains unaffected. We verified from our dataset that thedomains of regional third parties (e.g., ebay.de, ebay.it,
ebay.fr) remained unchanged. Luminati supports superproxy IP caching where three super proxy IPs in the cache
are available to service requests, eliminating unnecessary
timeouts due to distant super proxies.
4

The IP address of a user, connecting to a websites
through a proxy can be identified using the X-ForwardedFor [29] request header. Adding the IP address of theuser to X-Forwarded-For request header by a proxy defeats the purpose of being anonymous [30] with the connecting server. Luminati has been adding this header torequests in the past [31]. However, we did not find any
X-Forwarded-For headers that contain the IP address ofusers in the requests initiated through the Luminati proxymanager.
OpenWPM. OpenWPM [3] is a web privacy measurement framework that automates the crawling of a large
number of URLs and reduces engineering efforts for
tracking studies. A built-in proxy is available, which wereplace with Luminati. We configure OpenWPM (ver:0.7.0) for stateless crawling (each new page-visit uses a
separate browser profile), as we are primarily interested in
the location-related aspects of tracking. Instrumentation
results are stored in a local SQLite database; we modify
the database schemas to record additional information,e.g., the exit node’s IP address, AS details, and location(country). We launch three browser sessions simultaneously through OpenWPM; we could not further increase
the number of parallel sessions due to performanceissues which would crash the crawling sessions (system
configuration: AMD FX8350, 8GB RAM, Ubuntu 16.04,
Gigabit Internet).

Through Luminati, we process a total of 68,800 URLs.
These sites include, Alexa Top-1000 (global) and Top50 (country specific) URLs from 56 countries, and 1000
URLs shared via Twitter for 10 selected countries. EachURL request takes 1.16MB of bandwidth on average (including repeated attempts for failed/timed-out requests).
We run the experiments between June 1 and July 8, 2017.
Using Luminati is expensive. 3
We only considered successful third party requests forour analysis. Those URL responses with client errors(4xx status code) and server errors (5xx status code) areeliminated from the analysis. Such failures are attributed
to many reasons (e.g., authentication issues, timeouts,
censorship).
4.1. Country and first-party site selection
The use of residential machines from all countries/regions/cities would be ideal for our goal. However,using Luminati is costly, and it also lacks exit nodes incertain countries (e.g., North Korea). Covering several
regions with various political and socio-economic situations, we select 56 countries. We list in Table 1 thecountries in various regions used in our experiments.
Our selection is influenced by Freedom House [32], andSwire and Ahmad [20].
The 2050 distinct URLs that we use for crawling include: (1) home pages of Alexa Top-1000 global domains; (2) 1000 popular URLs that are shared via Twitter from the Alexa Top-1000 domains, excluding home
pages, and links to media (e.g., images, audio and video)
and text files (which may not host any tracker); and (3)home pages of Alexa Top-50 country-specific domains.
We extract Twitter URLs using Tweepy [33] that internally uses the Twitter streaming APIs to access theglobal stream of Twitter data. Twitter mandates thata client filter the streamed data according to a specificcriterion. To not omit streams from any parts of theworld, we use: twitterStream.filter(locations =[-180,-90,180,90]). Assuming geotagging is turned

4. Methodology
We use the Luminati proxy manager [13] to run experiments from 56 countries, and the OpenWPM privacy
measurement framework [3] for automating browser datacollection and tracker analysis on a selected list of URLs.
In this section, we expand on our country/URL selection,and define trackers and their prominence (largely basedon [3]); see Fig. 1 for an overview of our experimental setup (for our Luminati, OpenWPM configuration, see
Section 3).
The requests from OpenWPM crawls are proxied via
Luminati, so that they go through exit nodes in the country of our choice. Luminati passes the response from exit
nodes back to OpenWPM, which processes the response
data, extracts privacy related measurements, and storesthem in a database. We then query the database to analyze the measurement data and compute various metrics.

3 With the cheapest Luminati Starter residential package, it costs
USD 12.50/1GB (for 40GB, with a minimum monthly commitment of
USD 500). Hence, we incurred USD 14.50 for 1000 URLs. Therefore,
for 56 countries, it will cost USD 812 to process 1000 URLs. For 1
million URLs (cf. [3]) from 56 countries, the cost will be USD 812,000.
We thus had to limit the number of crawled URLs.

5

(1)proxy traffic
for crawling
web sites(5)
store web privacy
measurements

OpenWPM

OpenWPM SQLite database(4)
response(6)
query data forfurther analysis(3)
response

Analyzer

……..
……..
……..

Luminati(2)
request web sites
from pre-configured
locationweb

Figure 1: Our system setup.

Asia-Pacific

Americas

EuropeEurasia
Middle East and North Africa

Sub-Saharan Africa

Australia (AU), Bangladesh (BD), China (CN), India (IN), Japan(JP), Malaysia (MY), Myanmar (MM), Pakistan (PK), Philippines (PH), Singapore (SG), South Korea (KR), Sri Lanka (LK),
Vietnam (VN)
Argentina (AR), Brazil (BR), Canada (CA), Colombia (CO),Cuba (CU), Ecuador (EC), Mexico (MX), United Sates (US),Venezuela (VE)
Estonia (EE), France (FR), Germany (DE), Great Britain (GB),
Hungary (HU), Iceland (IS), Italy (IT), Turkey (TR), Switzerland(CH)
Armenia (AM), Georgia (GE), Kazakhstan (KZ), Russia (RU),
Ukraine (UA), Uzbekistan (UZ)
Bahrain (BH), Egypt (EG), Iran (IR), Israel (IL), Jordon (JO),
Lebanon (LB), Libya (LY), Morocco (MA), Saudi Arabia (SA),Tunisia (TN), United Arab Emirates (AE)
Ethiopia (ET), Kenya (KE), Nigeria (NG), Rwanda (RW), South
Africa (ZA), Sudan (SD), Uganda (UG), Zimbabwe (ZW)
Table 1: List of regions and countries.

on, this filter selects tweets from all around the world using the locations filter. We select the most shared URLs
from the Alexa Top-1000 domains.

Cookies: the cookie’s domain is different from the domainof the first-party site.
Not all identified third parties may necessarily be trackers. Third party domains can be trackers, advertisers, or
simply content embedded on a first-party site. We use
BlockListParser [16] to filter third parties in a tracking
context with the aid of a set of ad-blocking filtering lists
as used by the AdBlock browser extension: EasyList and
EasyPrivacy [15]. EasyList tracking protection lists con-

4.2. Tracker identification and prominence
We define the third parties as follows. (1) Third-party
scripts: the domain on which the third-party script runs
is different from the domain of the first-party site. (2)6tain rules to identify trackers which are also advertisers,
while EasyPrivacy identifies non-advertising trackers [3].
This filtering is in line with previous studies; cf. [3, 7].
For analysis, we keep trackers that exist on at least two
first-party sites (similar to [3]). Since advertisers in certain circumstances can play a dual role as trackers, weemphasize that the identified trackers in our analysis may
fall into a lower bound of trackers in reality; more sophisticated filtering is difficult (e.g., some third parties directly, or through their parent organizations, may act as
genuine content providers [34]). For example, Google receives a large proportion of content related third-party requests that do not fall into the categories of tracking or
advertisements.
To identify tracker domains based on third-party scripts
or cookies, we use public suffix + 1 (PS+1) of thescript URL or the cookie domain (along with Mozilla’s
Public Suffix List4 as in [3]). For example, if thescript URL is http://tpc.googlesyndication.com/
sodar/d5qAyLYU.js, then PS+1 of the domain isgooglesyndication.com; if the script is included as a dependency in http://oneindia.com, then googlesyndication.com is a third-party tracker.
Tracker prominence. A possible limitation of measuring a tracker’s activity using the number of first parties on which the tracker is present is that the tracker
may have a low first-party count, when a limited number of first-party sites are used. To properly rank trackers’
prominence, we use the following metricř from Englehardt
1;and Narayanan [3]: Prominenceptq “ edgeps,tq“1 rankpsq
edgeps, tq indicates third-party t’s presence on site s. This
metric mitigates the distortion of a tracker’s importancedue to the selection of a small set of first-party sites (as inour case, 1050- 2050 URLs per country). Such a small set
of first-party sites may not include all first parties where aparticular third-party is highly prevalent.
Comparing countries. To compare the extent of tracking
between countries, we treat the prominence values oftrackers of each country as a group, and we compute nonparametric Kruskal-Wallis (KW) rank averages (assuminggroups are independent). Countries with a higher rank

average should have a higher level of tracking and viceversa. Furthermore, the rank averages of all the countries
can be used to perform the KW test to determine if thelevel of tracking between countries is independent of eachother or not. In a KW test, a null hypothesis is initiallyassumed where all samples (i.e., groups) come from identical populations. If the KW test value is greater than thecritical chi-square value, the null hypothesis is rejected,
proving at least one group comes from a different population. A similar approach was adopted by Fruchter et al. [7]for comparing tracking activities between four countries.
4.3. Dynamicity of trackers
Since ad exchanges leverage a Real-time Bidding(RTB) auction based model where only winning bidders
are allowed to serve content to users [35, 36], web trackers are also expected to be dynamic in nature. However,dynamicity of trackers have not been discussed in previous large scale measurement studies (e.g., [3, 7, 8]). To
establish ground-truth on the limits of dynamic behaviorsof trackers, we conducted several experiments with Alexa
Top-1000 sites. We calculated the difference of the number of first parties for each tracker as observed from two
different ISPs within Montreal, Canada; we performed 12
tests simultaneously from both ISPs, and at different timesof the day, over a period of two months, where each test
took approximately 4 hours to complete.
We use z-score5 to assess the variation of trackers;
z-score measures the number of standard deviations of
the signed distance between a data point and the mean ofa distribution.6 If the data point is greater than the mean,
the z-score is positive, otherwise it is negative. Overall,z-scores for our observations lie between -0.4 and +0.4.
For simultaneous runs from both ISPs, the differencesand z-score values of the number of first parties for theTop-5 trackers are: advertising.com (223, 0.36), pubmatic.com (192, 0.27), adsafeprotected.com (140, 0.11),
moatads.com (75, -0.09), scorecardresearch.com (68,-0.11). Similarly, when measured from a particular ISP at
different times, the differences and z-score values for the
5 https://en.wikipedia.org/wiki/Standard_score

4 Hosted at:

6 Unlike standard deviation, z-score is used to compare scores fromdifferent distributions [37]. Also, z-score determines whether a given
value is typical in a data set.

https://publicsuffix.org; a public suffix is defined as “one under which Internet users can (or historically could) directly register names.”7

Top-5 trackers are: openx.net (217, 0.39), googlesyndication.com (114, 0.05), adnxs.com (109, 0.03), gstatic.com(73, -0.09), yandex.ru (73, 0.09). These values change
when measured at different times, although the z-scoresalways remain within -0.4 and +0.4. We also computed
the Pearson correlation coefficient for the number of firstparties that trackers are found in different runs (different
ISPs, and at different times of the day); our Pearson coefficient turned out to have a highly positive linear correlation(0.9), implying that the trackers identified in independentruns follow a strong linear relationship. Therefore,
for the overall tracking ecosystem, the dynamicity of
trackers does not appear to have adversely impacted theinterpretation of results of our measurement study.

object to our methodology and did not require us to go
through a full ethics evaluation.
4.5. Limitations
We use Luminati’s residential exit nodes for measuring web tracking from a home user’s perspective. However, we have no control over such nodes (compared tousing more reliable university/EC2 infrastructures). Here
we list some issues that may affect our results. (1) Web
tracking may depend on the browsing history of a specific client as identified by its IP address. Thus our results may be influenced by the browsing history of the
Luminati exit nodes, which is beyond our control. This is
an inherent limitation of using residential IPs as opposed
to university/Amazon IPs. However, our connections are
not effected by local cookies or other browsing data (onlyshare the same IP address). (2) We crawl websites via
OpenWPM in a sequential order over the period of five
weeks. Hence, time dependent trackers (if any) may affect our results. Furthermore, the number of trackers on
first party sites may grow or shrink with time. This is due
to many reasons, including technological advancementsof tracking techniques [39], outages, performance issues
with tracking services, and ISP filtering [40, 41]. A comprehensive study of such dynamic behaviors and uncertainties of tracking at a global scale is beyond our scope as
it requires repeated tests, which is not pragmatic due to thehigh cost of using Luminati. However, we measured dynamicity of trackers via two ISPs from two locations, andfound the impact to be limited to our measurement criteria (see Section 4.3). (3) Tracking context of some Google
trackers (e.g., google.com, gstatic.com, youtube.com) areomitted from our work as they are not proxied by Luminati. We realized this limitation during our experiments.8
However, most Google-owned tracking domains remain
unaffected, i.e., proxied through Luminati. We manually
verified this for all top tracker domains in our list. (4) The
EasyList [15] filter that we use to identify third party domains participating in a tracking context may not haveadequate coverage in all countries, although it can filter
most trackers from international web pages. Therefore,
our results may not include trackers that are not identified

4.4. Ethical issues
We access residential users’ Internet connection
through Luminati, which is a paid service. We do notcompromise the security or privacy of users (of exit
nodes) beyond using their internet connection, which they
have agreed to when signing up with Luminati. Theseusers include those using Hola [24] clients and applications built leveraging the Luminati monetizing SDK [28]without a subscription. Hola and Luminati explicitly mention the sharing of internet connection to their users. Furthermore, we do not store the response content returnedby the websites, except the measurements for trackers.
Some websites that we crawl (Alexa top sites andTwitter-shared URLs) may be censored in a few countries.
Other than Egypt,7 we are unaware of any place where
attempts to access blocked/censored content will trigger
legal problems for a user. During our tests, the new law
in Egypt that threatens imprisoning those browsing censored web sites did not exist. Besides, the sites crawledfrom Egypt are not subjected to censorship according to
the Citizen Lab dataset [38]. We are unable to get the consent from targeted users owning Luminati exit nodes, as
we do not have their contact information. However, wereached out to the internal Research Ethics Unit of ourUniversity, and explained our experiments; they did not
7 News article (Aug. 19, 2018):
https://www.telegraph.
co.uk/news/2018/08/19/egyptians-face-jail-accessingbanned-websites/

8 Luminati prohibits “Any form of outbound automated Google
search queries”, but mentions no other Google related restrictions.

8

by EasyList rules. However EasyList offers several supplementary filter lists [42] to support several non-English
domains (e.g., German, Italian, Dutch, French, Chinese,
Bulgarian, Arabic, Czech, Slovak, Lithuanian and Hebrew). The coverage of these supplementary lists are still
unknown. (5) If a first party website intentionally uses athird party for tracking the site visitors, we do not distinguish such trackers from other third parties participating
in a tracking context.

domination across the world. Note that despite Google
services, e.g., Google Search, Maps, Docs, Mail being
censored in China [45], Google trackers remain active in
China on uncensored websites.
6. Overall tracker prominence
In this section, we analyze the differences in tracking,using prominence and KW rank metrics (Section 4.2), andcompare 56 countries; see Fig. 4. UK and Armenia havethe highest prominence values, while Iran and Ethiopia
have the least. The latter countries are known to haveless media/Internet freedom [19, 32]. But countries suchas Morocco, Singapore, Venezuela, Mexico and Rwanda
have relatively higher prominence values although theyrank low in media/Internet freedom, showing the presenceof other factors influencing tracking. We discuss the impact of few of those factors such as Internet speed, censorship and browser user agents in Section 8.
We summarize prevalence of top trackers (in terms of
the average of raw count in countries) in different regionsin Fig. 5. In general, Europe has the highest count compared to others, despite the EU cookie law. Degeling etal. [26] claims, GDPR didn’t have a noticeable change
in tracking although it made the web more transparent by
having the website owners updating their privacy policies.
Our results from the KW test show that the tracker
prominence among different countries are independent ofeach other (x2 “ 83.64, d f “ 55, p “ 0.05). This isbecause the null hypothesis of the KW test is rejected as
the KW test value (x2 “ 83.64) is greater than the criticalchi-square value (73.311) [46] with 55 degrees of freedom(d f ), where p-value (used to accept/reject the null hypothesis) is 0.05. Therefore, the prominence of trackers varies
with different browsing locations that are independent ofeach other.
Comparing prominence between home pages andTwitter URLs. We also compare countries based on
tracker prominence in Alexa Top-1000 home pages andTwitter-shared URLs. For this experiment, we consider
10 countries across all regions. We calculate the prominence values of trackers in each country for the home
pages and Twitter URLs; see Fig. 6.
It is apparent that the prominence values of trackers inTwitter URLs are significantly higher compared to home

5. Trackers vs. geolocation
In this section, we explain the analysis process followed by the results. Unless otherwise stated, the tracking
context is measured using third-party scripts on the Alexa
Top-1000 global domains.
We first check the presence of top-10 trackers in Alexa
Top-1000 domains in all countries. For brevity, we highlight the results from 15 countries with most significant
differences across regions; see Fig. 2. The top-10 trackers
are determined based on the average percentage of firstparty sites across 15 countries. If multiple instances ofthe same tracker are found on a particular first-party site
(e.g., several scripts from a single tracker domain), we
count them separately.
In Fig. 2, darker-shade trackers have more presence infirst-party sites compared to lighter shade ones. We calculate the tracker percentages for each country based on thefirst party count for the specific tracker over the total firstparty count of the specific country. Highest percentages
for googlesyndication (25.6%) and doubleclick (23.2%)
trackers are observed in Russia and Ethiopia respectively;
the percentages are relative to other trackers observed
from the same country. These two trackers are also prominent in all other countries. In contrast, some trackers are
not seen in certain countries (blank cells in Fig. 2).
China and Iran have a relatively low percentageof trackers. Google advertisements are sanctioned in
Iran by United States Office of Foreign Assets Control(OFAC) [43]. Schelter et al. [27] observed a similar pattern in their study, and they justify this behavior due topolitical factors including lack of democracy and freedomof the press.
We also identify the top-10 tracking organizations;
we use pywhois [44] to locate organizations from corresponding domains; see Fig. 3. Google has a clear
9doubleclick

11.6 19.1 19.0 19.1 17.8 21.6 17.6 22.6 16.9 19.4 19.4 19.7 17.4 23.2 17.4 18.6 18.2

adnxs

9.3

google-analytics

6.3

openx

3.8

5.5 11.3 5.5

4.8

5.5

5.0

5.0 10.1 16.1 4.8 13.0 3.9

4.8

4.6

2.3

4.7

2.7

4.2

3.6

4.9

3.2

4.0

3.7

3.9

3.6

4.1

4.0

3.1

6.2

4.2

3.8

2.9

3.3

3.5

4.4

4.4

2.1

5.0

3.0

3.6

3.5

3.1

3.6

3.6

2.5

3.8

1.9

3.0

3.0

4.0

3.9

US

4.7 19.8 20.4 18.7 16.3 20.1 19.0 25.6 20.5 19.6 19.1 1.7 18.8 13.0 18.0 18.6 19.8

AMgooglesyndication

6.2

7.6

7.5

6.4

4.5

4.3

4.6

3.7

4.6

5.2

3.4

6.3

5.0

5.0

4.2

4.8

4.4

4.5

5.8

3.7

5.0

2.3

6.5

5.0

6.5

5.4

5.3

4.8

7.0

7.6

24

20

16

4.6

demdex

4.7

2.9

2.7

2.7

krxd

6.1

1.5

4.0

3.8

SG

3.4

3.1

2.9

2.4

3.0

2.7

10.2 4.3

6.8

3.7

2.6

3.0

Avg56

3.0

3.6

Avg15

rubiconproject

2.6

ET

4.5

3.0

UG

mathtagAUadsafeprotected

2.3

5.5

12

8

IR

LB

CU

UZ

CO

RU

DE

GB

CN

4
3.2

Figure 2: First-party percentages for script-based trackers across 15 countries; Avg15 and Avg56 represent average percentages for the selected 15
countries and all 56 countries, respectively.
60

9.3

OpenX Technologies

3.8

7.6

7.5

6.4

5.0

5.0

4.2

4.9

4.4

4.5

3.7

5.0

2.3

6.5

5.0

6.5

5.4

5.3

4.8

4.5

2.3

4.7

4.9

3.2

4.0

4.2

4.0

3.1

6.2

3.3

3.5

4.4

4.4

2.1

5.0

3.0

7.6

5.5 11.3 5.5

4.8

5.5

2.3

3.0

2.7

4.2

3.6

3.7

3.9

3.6

4.2

3.8

2.9

3.6

3.5

3.1

2.7

3.4

3.4

3.7

3.1

3.4

3.8

2.6

2.9

1.6

2.3

1.9

2.6

Contact Privacy

4.5

The Rubicon Project

3.0

4.6

Adobe Systems

5.6

2.9

4.5

2.9

4.0

3.6

2.5

3.8

2.2

3.4

4.1

Domains By Proxy

6.8

5.9

2.7

1.6

1.9

1.8

3.1

3.0

4.6

2.4

2.5

Salesforce.com

6.1

1.5

4.0

3.8

4.0

3.9

3.2

0.0

Index Exchange

2.3

3.3

1.7

2.8

2.8

2.7

2.7

1.9

1.0

2.5

1.0

2.0

AU

DE

GB

US

AM

RU

UZ

CO

CU

LB

3.6

SG

5.8

7.0

CN

Integral Ad Science

6.2

Avg56

AppNexus

UG

25.5 43.8 45.2 43.2 42.1 48.9 40.9 56.5 44.0 44.7 51.6 39.6 41.9 51.4 41.2 43.7 44.1

Avg15

Google

50

40

30
3.4

5.5

3.5

2.9

4.6

6.8

ET

IR

10.2 4.3

20

10

Figure 3: First-party percentages for tracking org.

pages in all selected countries. Englehardt et al. [3] noticed a 6%–57% increase of third-party presence on firstparties (for top 20 third parties) with inner URLs as opposed to their home pages. In our experiments, the increase of prominence in Twitter URLs is between 7%–28%. However, we take into account the prominence of
all third parties available. Therefore, it appears that increase of third party presence in inner URLs is relatively
higher for the top trackers.

10Kruskal-Wallis rank of tracker prominence

1650
1550

1450
1350
1250
1150
1050
950
850

Iran

Cuba

Lybia

Ethiopia

Sudan

Saudi Arabia

Kenya

Sri Lanka

China

Uzbekistan

Nigeria

Zimbabwe

RussiaEcuadorSouth Africa

Italy

Tunisia

UkrainJordonIndia

Philippines

Egypt

Bangaladesh

MyanmarJapan

Georgia

Australia

UAE

IsraelUgandaPakistan

LebanonUSA

TurkeyEstonia

FranceMalasia

Germany

IcelandVenezuela

Baharain

SwitzelandSouth Korea

MexicoRwandaColombia

CanadaVietnam

MoroccoSingapore

BrazilHungary

Argentina

Armenia

Great Britain

750

Figure 4: Prominence of tracker scripts across 56 countries.
30000

EuropeAsia-Pacific

25000

Americastracker countMiddle East and North Africa
20000

Sub-Saharan Africa
Eurasia

15000
10000
5000
0

Figure 5: Average of top trackers in different regions.

310

Global Alexa sites

try. In China, baidu.com tops the first-party count in bothtracking scripts (93) and cookies (5). Similarly, in Russia, yandex.ru is a leading tracker having the highest firstparty count for tracking scripts (427) and cookies (25).
The difference in approaches between Falahrastegar et al.
and ours is that in the former, 500 country-specific firstparty sites are used (from the same location), while we use
Top-50 country specific sites (from 56 countries); they report more baidu.com count (approx. 2000), although they
do not clarify the tracking context.

Twitter URLs

Prominence of trackers

300

290
280
270

260
250
240

230
220
210

GB

AM

BR

HU

SG

CO

MX

IS

US

AU

Figure 6: Prominence of tracker scripts: Alexa global sites vs. Twitter
URLs.

7. Cookie validity durations
Trackers in country-specific sites. Most trackers acrossthe world are hosted from US domains. However, similar
to the observations in Falahrastegar et al. [8], we note an
exception from Top-50 country-specific first-party sites in
China and Russia, where the top trackers for both thirdparty scripts and cookies originate from the same coun-

Similar to Trevisan et al. [17], we also found that the
EU cookie law is not complied by most tracking companies in the EU and non-EU countries; see Fig. 7. Many
cookies have a validity period over 20 years, and someup to 7988 years (e.g., rubiconproject.com, rfihub.com).
Overall, UK and US have the highest counts of thesecookies, while Iran, Cuba, Ethiopia and Libya have the11least. We did not use the data collected from Kazakhstan
for our analysis, as it is impacted due to slow connections
at the respective exit nodes.
Access country
Great Britain
Germany
Hungary
Italy
FranceEstonia

ą1year10,516
5047
5071
5000
4250
2692

ą20 years
3618
1956
1866
1853
1801
1267

the third-party domain is registered (most registered in
France and Germany).
8. Factors other than geolocation
8.1. Internet speed

Tracking appears to vary proportionally with Internet
speed in a country; see Fig. 8 (we use Akamai’s report [50] on global Internet speed as of June 1, 2017). The
countries right to the vertical dotted line in Fig. 8 have ahigher tracker prominence (marked red İ). Tracker prominence values are high for Armenia, Colombia, Lebanon
Table 2: Number of tracking cookies with validity periods (EU).
and Uganda, although they have relatively low Internet
speed. Resource intensive tracking sources included in
Trevisan et al. [17] found 49% of the websites in 25 first-party sites may not completely load with a slow concountries (21 from EU) install tracking cookies. In com- nection, increasing the rate of request failures.9
parison, we found that, for the nine European countries,
The failure rates of OpenWPM requests (following its
60% of first-party sites set tracking cookies without con- re-connection attempts) vary between 11.21% – 19.04%.
sent, which is even higher than our global average (56.2% The highest failure rates are in United States (19.04%),
sites in the 56 countries; see Degeling et al. [26] for tech- Great Britain (18.26%) and Germany (18.13%). Thesenical issues in GDPR compliance and common cookie countries still rank high in tracking prominence. We also
consent implementations).
checked the connection failures more closely, and obIn addition to third party cookies, some first party cook- served that such failures are more common for trackers
ies (e.g., doubleclick.net, paypal.com) contain unique than the first-party sites.
pseudonymous identifiers, although they do not include
To understand the impact of HTTP/S errors on tracker
Personally Identifiable Information (PII) [47]. We did not prominence, we calculated the difference of KW ranks offind attributes in first party cookies containing any identi- all HTTP/S requests vs. requests without client/server erfiable PII
rors. Fig. 9 shows the KW rank of requests with errors.
The top-5 domains of tracking cookies with over a year Although the tracker prominence and the rate of failures
validity are as follows (the number of cookies, first-party are not proportional in all 56 countries, the KW rank of repercentages): scorecardresearch.com (23,171, 0.015%); quest errors are high in Great Britain (686), United Statesrubiconproject.com (12,680, 0.008%); rfihub.com (673) and Mexico (576), while they are lower in Uzbek(12,105, 0.008%); advertising.com (11,042, 0.007%); istan (186) and Ethiopia (141).
and adtechus.com (9940, 0.006%). We also checked theirprivacy policies (Sept. 2, 2018). They do not mention 8.2. Censorshiptheir cookie validity periods, but claim to be in comApparently, there is a direct relationship between Interpliance with EU privacy laws (including GDPR [48]). net/media freedom and tracking prominence—more open
The opt-out mechanism of scorecardresearch.com is also countries seem to attract more trackers; see Fig 10 (forcookie based [49], i.e., opt-out is not possible whencookies are blocked or deleted. Top-6 EU countries with
9 The average webpage size is growing significantly, every year; inthe most number of cookies with long validity periods
2017,
it is approximately 2.5MB, part of which is attributed to trackare listed in Table 2. Top-10 EU specific domains withers, see e.g., KeyCDN (https://www.keycdn.com/support/thethe highest number of tracking cookies are listed in growth-of-web-page-size/). For example, CNN’s home page size
Table 3; for each domain, we also list the countries from is 4.7MB and the page creates 349 HTTP requests (as of Sept. 25, 2018;
which the requests are originated, and the country where tested using tools.pingdom.com).
12

>1 - 5>5 - 20

> 20

<= 1

7000

5000

1500

4000
1000
3000

2000

500
1000

0

GB
HU
US
SG
RW
CA
DE
IT
FR
CH
EE
IS
VN
CO
KR
AU
RU
JO
VE
AR
AM
PK
TN
MM
MX
BH
KE
MY
JP
MA
BR
GE
UG
EC
AE
ZA
UA
PH
LK
IL
NG
TR
BD
IN
ZW
SA
SD
EG
UZ
LB
CN
LY
CU
IR
ET

0

Counts of cookie validity durations (> 1 year)

Counts of cookie validity durations (<= 1 year)

2000
6000

Figure 7: The number of cookies vs. validity period: counts of cookie validity periods ď 1 year are shown by the line (left y-axis), and the rest (ą1 year) are shown with bars (right y-axis). All these cookies are set without user consent.

Access country
DE, EE, FR, GB, HU, IT
DE, FR, GB, HU, IT
EE, FR, GB, HU, IT
DE, EE, FR, GB, HU
DE, EE, GB, IT
DE, GE, HU
DE, GB, IT
DE, GBEE, FR, GB, HU, IT
HU

Tracker domain
smartadserver.com
angsrvr.com
criteo.com
ml314.com
theadex.com
yieldlab.net
visualdna.com
semasio.net
switchadhub.com
ligadx.com

Reg.
FR
DE
FR
FR
FR
DE
GB
DE
GB
DE

Count
4005
1570
1461
920
665
420
417
392
303
280

Table 3: Domains of top-10 tracking cookies registered in EU countries.

SG

Average Internet speed (mbps)

20.0
17.5

US

15.0

DE

12.5

RU

GB

AU

10.0
7.5
5.0

UZ

IR
ET

2.5
800

CN

CO

AM

CU

UG LB
1000
1200
1400
Kruskal-Wallis average rank

1600

Figure 8: Internet speed vs. tracker prominence.

clarity, we show only 15 countries, but a similar trend isobserved for all 56 countries). We divide the countries

into three categories based on the 2017 Freedom of thePress rankings [32]; countries marked in red (İ) are considered to be free, amber (‚) ones partially-free, and green(Ĳ) ones not-free. All the not-free countries have a lower
tracker prominence. Note that, although Ethiopia showsa higher percentage of trackers in Fig 3, those values are
relative to the country.
We also analyzed HTTP response codes. While there
were many codes other than 200 (OK), those with 403(Forbidden Host) are interesting: majority of third parties
included in these first party sites appear to be hosted on
local IP addresses (e.g., 10.10.34.34, 192.168.1.1). Other
studies [19, 10] also reported similar behavior in Iran as
ours (87 occurrences), where DNS hijacking is used forcensorship; a blocked site is redirected to a web page running on a local IP address that is accessible within Iran. In
addition to Iran [19], we also observe the same behavior
13

700
600
500

400
300

200

ET

UZ

IR

EG

MA

BR

AR

VN

NG

PK

BD

TN

BH

CN

EC

CA

ZW

MM

JO

HU

IT

LY

RW

KE

MY

KR

AE

AM

DE

UG

FR

TR

PH

CH

IN

LK

SA

GE

LB

VE

IS

JP

CO

ZA

SG

IL

EE

CU

SD

UA

RU

AU

US

MX

GB

100

Figure 9: KW Ranks highlighting errors of HTTP/S requests.

Censorship rating

3 IR

ET CU

CN

UZ

RU UG

2

LB

1

AU
800

CO SG

US DE

1000
1200
1400
Kruskal-Wallis average rank

AM

GB
1600

Figure 10: Censorship rating vs. tracker prominence.

with SA (173), UZ (46), NG (28), GB (22), PK (19), TN(11), and US (9). Note that the 403 response code is also
returned when appropriate authorization is not provided(e.g., a non-public page).

dows, Mac OS X, and OpenBSD); a random user-agent ispicked for each crawl. This allows an unbiased approachin simulating requests made from different browsers (instead of sending a series of requests with the same useragent). We run the tests for each browser type at a time(i.e., each browser type is tested equally).
We summarize prevalence of top trackers (scripts vs.
cookies) for common browser user-agents; see Figs. 11
and 12. Some trackers appear significantly more than
the rest across all user agents for Chrome, Firefox,
IE and Safari—e.g., googlesyndication.com and doubleclick.net in tracking scripts, and adnxs.com and rubiconproject.com in tracking cookies. Surprisingly, sometrackers do not appear at all for certain browser types.
We validated such unusual cases with manual inspection using Chrome DevTools 11 , and similar tools in otherbrowsers (e.g., F12 Developer tools 12 ).
9. Data protection laws vs. tracking

We summarize below data protection laws in different
regions and explain their relevance to tracker prominence
A user-agent, as sent with an HTTP request, can help (see Section 6), based on DLA Piper [52]. Overall, counidentify a user’s device, browser/OS versions, and even tries with higher tracker prominence also have relatively
a specific user (although not very accurately) [51]. Cur- tougher data privacy regulations, implying whether such
rently, OpenWPM supports only Firefox. We modify regulations are properly enforced.
OpenWPM with a list of user agents10 supporting dif- Asia Pacific. No specific laws or regulations exist relating
ferent browser/platform types. Considering four popular to data privacy except in South Korea (prominence score:browsers—Chrome, Firefox, IE and Safari, we use a total of forty user agents with different desktop OSes (Win8.3. Browser user-agents vs. tracking

10 Extracted from: http://www.useragentstring.com/pages/
useragentstring.php

11 https://developers.google.com/web/tools/chromedevtools/
12 https://docs.microsoft.com/en-ca/microsoftedge/devtools-guide14criteo.com

829
560

828
337

515

340

advertising.com
doubleverify.com

315

IE

Firefox

Chromekrxd.netadnxs.com

5000

rubiconproject.com

4000
3000
2000

casalemedia.com
pubmatic.com
rlcdn.com
advertising.com
demdex.net
adsrvr.org
rfihub.com

1000

2607
2479
1672
1007
750
918
561
671

2475
2407
1627
999
798
961
603
641
609

2375
2826
1794
1127
842
1079
662
731
521

contextweb.com

Browser/UserAgent

Figure 11: Tracking scripts vs. user-agents.

2516
2325
2013
1026
805
576
574
568
510
377

2500
2000
1500
1000
500

Safarigoogle-analytics.com

5294
3962
1076
984
734
868
640
477
462
405

IE

openx.net

4448
3720
633
960

Firefoxadnxs.com

3831
3153
916

Chromeadsafeprotected.com

4658
3712
1213
1102
802
909

Third party cookie countThird party script countdoubleclick.net

Safarigooglesyndication.com

Browser/UserAgent

Figure 12: Tracking cookies vs. user-agents.

1466), with a fairly higher tracker prominence. In South
Korea, cookie, log and IP information usage is governedby IT Network Act, and requires to get opt-out consent
from users. Location information of users is regulatedby the LBS Act. Australia (1404) leverages its Privacy
Act, state and privacy laws to regulate e-privacy and thecollection of location data to some extent.

personal data (e.g., stored in cookies) is deemed to besensitive. France requires traffic data to be anonymized orerased, and not use location data without explicit consent.
In Italy (1352), traffic data is supposed to be removed
when no longer required, and cannot be held for morethan 6 months. According to UK’s (1645) Privacy andElectronic Communications (PEC) act, traffic data needs
to be erased when not required and can be used with
Americas. Canada (1531), United States (1446) andconsent for value added services; nevertheless, UK has
Mexico (1504) have a higher tracker prominence. On top
the highest tracker prominence.
of provincial laws, Canadian Personal Information Protection and Electronic Document Act (PIPEDA) applies Eurasia. Russia (1330) and Ukraine (1355) do not haveto consumer and employee personal information. In the specific privacy legislations, but their tracker prominence
US, Federal Trade Commission (FTC) ensures businesses values are lower than most countries.
take reasonable minimal data security measures to ensure
consumer privacy. In contrast, South American coun- Middle-East. Baharain’s (1463) tracker prominence istries (only Argentina and Uruguay are covered by DLA relatively high and it lacks any privacy laws. Saudi Arabia
Piper) lack privacy laws, which also have relatively higher (1196) also has no privacy rules. In UAE (1355), although
its penal code does not provision regulations for Intertracker prominence values.
net privacy, the general laws contained therein can be apEurope. EU’s General Data Protection Regulation plied for online privacy. Both Saudi Arabia and UAE have
(GDPR) [48] is in effect since May 2018, governing all lower tracker prominence values. Tracker prominence inits member states alike. While the existing e-privacy Egypt (1377) is also low; its 2014 constitution provides
directives in EU are complied by its member states, clear guidelines on Internet security, but not about prithere is no clear indication of any reduction in tracking vacy. In 2017, the Egyptian government cracked down on
activities due to these regulations. Although, France, encryption and circumvention tools [53].
Switzerland and Italy are more strict in applying e-privacy
laws compared to Germany, our results indicate France Sub-Saharan Africa. Most countries in this region(1453) and Switzerland (1460) have comparable tracker have a lower tracker prominence. South Africa (1330)
prominence as Germany (1450). Switzerland requires doesn’t appear to have laws to regulate privacy. However,
explicit consent from users before data is collected, and Nigeria (1317) has regulations for electronic communi15

cation/privacy rights with respect to cookies and locationdata.

10. Conclusions and Future Direction

Acknowledgment
This work is partly supported by NSERC, and a grantfrom CIRA.ca’s Community Investment Program. We
also thank Luminati.io for letting us using their residential proxy service at a discounted rate.

We observe a significant variation of trackers on first- References
party sites between countries. Some Google trackers (e.g.,[1] Recode.net, Google leads the world in digital
doubleclick and googlesyndication) on average have an
and mobile ad revenue, News article (July 24,
extensive presence compared to other trackers (cf. [54]).
2017).
https://www.recode.net/2017/7/
The UK and Armenia have the highest tracking promi24/16020330/google-digital-mobile-adnence, while Ethiopia and Iran have the least. We obrevenue-world-leader-facebook-growth.
serve a significant number of cookies valid for many years(ą20) in EU countries and elsewhere.
[2] J. R. Mayer, J. C. Mitchel, Third-party web trackThis study can be extended to compare tracking being: Policy and technology, in: IEEE S&P’12, San
tween residential IPs and cloud IPs in multiple countries.
Francisco, CA, USA, 2012.
Several other factors also influence tracking beyond lo[3] S. Englehardt, A. Narayanan, Online tracking: A 1cation. The countries that enjoy a greater freedom of exmillion-site measurement and analysis, in: CCS’16,
pression and information flow show a stronger presence ofVienna, Austria, 2016.
trackers. We also noticed several third-party requests are
censored in Iran and few other countries. Also, in general,[4] S. Englehardt, D. Reisman, C. Eubank, P. Zimmerhaving stronger privacy regulations does not limit trackman, J. Mayer, A. Narayanan, E. W. Felten, Cookies
ing in any significant way.
that give you away: The surveillance implications ofTracking is not limited to a particular desktop or a deweb tracking, in: WWW’15, Florence, Italy, 2015.
vice, and can cross the boundary between multiple devices [55]. Effects of geolocation in cross device tracking [5] WashingtonPost.com, NSA uses Google cookies
could be an interesting future direction. As Luminati doesto pinpoint targets for hacking, News article (Dec
not proxy some Google domains, future work should also
10, 2013). https://www.washingtonpost.com/
consider similar alternative services, if available.
news/the-switch/wp/2013/12/10/nsa-usesThere are many other forms of tracking in addition togoogle-cookies-to-pinpoint-targets-forthird party scripts and cookies (e.g., browser fingerprinthacking/.
ing, Flash cookies) which are excluded in our work. The[6] E. Felten, J. Mayer, How the NSA piggy-backs
impact of such tracking techniques with geolocation canon third-party trackers, Blog article (Dec 13,
be studied as future work.
2013). http://www.slate.com/blogs/future_
Currently, OpenWPM supports only the Firefoxtense/2013/12/13/nsa_surveillance_and_browser. Instead of our user-agent manipulation, measurthird_party_trackers_how_cookies_help_
ing with other real browsers may provide a more comgovernment_spies.html.
prehensive view (but may require significant engineering effort). For example, we could then easily compare[7] N. Fruchter, H. Miao, S. Stevenson, R. Balebako,
tracking prevalence between the Tor and other browsers.
Variations in tracking in relation to geographic locaFuture work may also use the OpenWPM WebExtension
tion, in: WTSP’15, San Jose, CA, USA, 2015.
tool [56] for privacy measurements in a cross-browser environment using the WebExtension API (supported by all[8] M. Falahrastegar, H. Haddadi, S. Uhlig, R. Mortier,common browsers).
The rise of panopticons: Examining region-specific16third-party web tracking, in: TMA’14, London UK,
2014.

[19] S. Aryan, H. Aryan, A. J. Halderman, Internet censorship in Iran: A first look, in: USENIX Workshop
on Free and Open Communications on the Internet[9] Ghost Proxies, The difference between residen(FOCI’13), Washington DC, USA, 2013.
tial and datacenter proxies, Blog article (2019).
http://ghostproxies.com/blog/2016/06/[20] P. P. Swire, K. Ahmad, Foundations of information
residential-datacenter/.
privacy and data protection: A survey of global concepts, laws and practices, International Association[10] P. Pearce, B. Jones, F. Li, R. Ensafi, N. Feamof Privacy Professionals, 2012.
ster, N. Weaver, V. Paxson, Global measurementof DNS manipulation, in: USENIX Security Sym- [21] G. Acar, C. Eubank, S. Englehardt, M. Juarez,
posium’17, Vancouver, British Colombia, Canada,
A. Narayanan, C. Diaz, The web never forgets: Per2017.
sistent tracking mechanisms in the wild, in: CCS’14,
Scottsdale, Arizona, USA, 2014.
[11] T. Chung, D. Choffnes, A. Mislove, Tunneling fortransparency: A large-scale analysis of end-to-end [22] A. Panchenko, F. Lanze, J. Pennekamp, T. Engel,violations in the Internet, in: IMC’16, Santa MonA. Zinnen, M. Henze, K. Wehrle, Website fingerica, CA, USA, 2016.
printing at Internet scale, in: NDSS’16, San Diego,
CA, USA, 2016.
[12] T. Chung, R. van Rijswijk-Deij, B. Chandrasekaran,
D. Choffnes, D. Levin, B. M. Maggs, A. Mislove, [23] G. Tyson, S. Huang, F. Cuadrado, I. Castro, V. Perta,
C. Wilson, A longitudinal, end-to-end view of theA. Sathiaseelan, S. Uhlig, Exploring HTTP header
DNSSEC ecosystem, in: USENIX Security Symmanipulation in-the-wild, in: WWW’17, Perth,posium’17, Vancouver, British Colombia, Canada,
Australia, 2017.
2017.
[24] Hola, Hola VPN, http://hola.org/.
[13] Luminati, Luminati proxy network, http://[25] G. Merzdovnik, M. Huber, D. Buhov, N. Nikiluminati.io/.
forakis, S. Neuner, M. Schmiedecker, E. Weippl,[14] X. Mi, Y. Liu, X. Feng, X. Liao, B. Liu, X. Wang,
Block me if you can: A large-scale study ofF. Qian, Z. Li, S. Alrwais, L. Sun, Resident evil:
tracker-blocking tools, in: IEEE EuroS&P’17, Paris,
Understanding residential IP proxy as a dark service,France, 2017.
in: IEEE S&P’19, San Fansisco, CA, USA, 2019.
[26] M. Degeling, C. Utz, C. Lentzsch, H. Hosseini,[15] EasyList, EasyList, Online article 2016. https://F. Schaub, T. Holz, We value your privacy... Now
easylist.to/.
take some cookies: Measuring the GDPR’s impact
on web privacy, in: NDSS’19, San Diego, CA, USA,[16] Shivam Agarwal, BlockListParser, Online ar2019.
ticle (Jun 02, 2016). https://github.com/
shivamagarwal-iitb/BlockListParser.
[27] S. Schelter, J. Kunegis, Tracking the trackers: A
large-scale analysis of embedded web trackers, in:[17] M. Trevisan, S. Traverso, E. Bassi, M. Mellia,
ICWSM’16, Cologne, Germany, 2016.
4 years of EU cookie law: Results and lessons
learned, Proceedings on Privacy Enhancing Tech- [28] Luminati,
Monetization
SDK,
https:
nologies 2019 (2) (2019) 126–145.
//luminati.io/sdk.
[18] The EU Internet Handbook, Cookies, Online arti- [29] MDN web docs, X-Forwarded-For, Online articlecle (Dec 10, 2018). http://ec.europa.eu/ipg/(July 20, 2018). https://developer.mozilla.
basics/legal/cookies/index_en.htm.
org/en-US/docs/Web/HTTP/Headers/XForwarded-For.
17

[30] S. Huang, F. Cuadrado, S. Uhlig, Middleboxes in theInternet: a HTTP perspective, in: TMA’16, Paris,
France, 2017.

[41] Canadian Radio-television and Telecommunications Commission (CRTC), The CRTC
collaborates with international partners tofight illegitimate online marketing activi[31] Luminati, X-Forwarded-For # issue 70, Online
ties, News article (Mar 21, 2018). https:
article (Nov 17, 2017). https://github.com///www.canada.ca/en/radio-televisionluminati-io/luminati-proxy/issues/70.
telecommunications/news/2018/03/thecrtc-collaborates-with-international[32] Freedom House,
Freedom of the press
partners-to-fight-illegitimate-online2017, Online article (April 2017). https:
marketing-activities.html.
//freedomhouse.org/sites/default/files/
FOTP_2017_booklet_FINAL_April28.pdf.
[42] EasyList, Other supplementary filter lists andeasylist variants, https://easylist.to/pages/
other-supplementary-filter-lists-andeasylist-variants.html.

[33] Joshua Roesslein, Tweepy, Online article (Nov 30,2018). https://github.com/tweepy/tweepy.
[34] A. Gervais, A. Filios, V. Lenders, S. Capkun, Quantifying web adblocker privacy, in: European Symposium on Research in Computer Security’17, Oslo,
Norway, 2017.

[43] Google Ads, Understanding Google Ads and AdWords express country restrictions, Online article
2019. https://support.google.com/googleads/answer/6163740?hl=en.

[35] M. A. Bashir, S. Arshad, W. K. Robertson, C. Wilson, Tracing information flows between ad exchanges using retargeted ads, in: USENIX Security
Symposium’16, Austin, TX, USA, 2016.

[44] Michael Carter, pywhois, Online article (Oct18, 2010). https://pypi.python.org/pypi/
pywhois/0.1.

[36] Google Ad Manager, How exchange bidding works, [45] M. Jiang, The business and politics of search engines: A comparative study of Baidu and Google’s
Online article (2019). https://support.google.
search results of Internet events in China, New Mecom/admanager/answer/7128958?hl=en.
dia & Society 16 (2) (2014) 212–233.
[37] School of Psychology University of New England, Z-scores, Online article (2019). https: [46] MedCalc, Values of the Chi-squared distribution,
Online article (2019). https://www.medcalc.
//webstat.une.edu.au/unit_materials/c4_
org/manual/chi-square-table.php.
descriptive_statistics/z_scores.htm.
[38] Citizen Lab, URL testing lists intended for discovering website censorship, Online article (2019).
https://github.com/citizenlab/testlists/.

[47] Analytics Help, Understanding PII in Google’scontracts and policies, Online article (2019).
https://support.google.com/analytics/
answer/7686480?hl=en.

[39] A. Lerner, A. K. Simpson, T. Kohno, F. Roesner,
Internet jones and the raiders of the lost trackers: Anarchaeological study of web tracking from 1996 to
2016, in: USENIX Security Symposium’16, Austin,
TX, USA, 2016.

[48] Official Journal of the European Union, EU GDPR,
Online article (Apr 26, 2016). https://eurlex.europa.eu/legal-content/EN/TXT/
HTML/?uri=CELEX:32016R0679&from=EN.
[49] ScoreCard Research, ScoreCard Research Privacy policy, Online article (Dec 19, 2017).
http://www.scorecardresearch.com/
privacy.aspx?newlanguage=1.

[40] Bell Canada, Online advertising program, Online
article (2019). https://www.bell.ca/onlinemarketing.

18

[50] Akamai, Internet connection speeds and adoption
rates by geography, Online article (Jun 1, 2017).
https://www.akamai.com/us/en/about/ourthinking/state-of-the-internet-report/
state-of-the-internet-connectivityvisualization.jsp.
[51] P. Laperdrix, W. Rudametkin, B. Baudry, Beauty
and the beast: Diverting modern web browsers tobuild unique browser fingerprints, in: IEEE Symposium on Security and Privacy’16, San Jose, CA,
USA, 2016.

[53] Freedom House, Freedom on the Net 2017 Egypt, (Apr. 2017). https://freedomhouse.
org/report/freedom-net/2017/egypt.
[54] B. Krishnamurthy, K. Naryshkin, C. Wills, Privacy
leakage vs. protection measures: the growing disconnect, in: WTSP’11, 2011.
[55] S. Zimmeck, J. S. Li, H. Kim, S. M. Bellovin, T. Jebara, A privacy analysis of cross-device tracking,in: USENIX Security Symposium’17, Vancouver,
British Colombia, Canada, 2017.

[52] DLA Piper, Data protection laws of the [56] F. Wollsén, OpenWPM WebExtension experiment / API, Online article (July 30, 2018).
world,
Onlinearticle(2019).
https:
https://github.com/mozilla/OpenWPM//www.dlapiperdataprotection.com/.
WebExtension-Experiment.

19