# _WebTrackingScore:_ A Combined Web Tracking Risk Score System for Websites
## 3 Related Work
In the PrivacyScore [13] Benchmarking Portal ([[https://web.archive.org/web/2024](https://web.archive.org/web/2024)]([https://web.archive.org/web/2024](https://web.archive.org/web/2024)) 0915004701/[[https://privacyscore.org/](https://privacyscore.org/)]([https://privacyscore.org/](https://privacyscore.org/)) accessed on 19 November 2024), an end user can obtain the privacy scoring of a website, which is evaluated according to four groups of elements: tracking made by the website and third parties, encryption of web traffic, protection against various attacks, and encryption of mail traffic. These groups are assessed as follows: green, if all the elements of the group are successful; red, if there is a critical element that fails within the group; yellow, in the rest of the cases. The system is also designed so that end users can see how a specific website is ranked in its peer group and influence the ranking based on their preferences. They can even create their own ranking by modifying weights. The portal is under development and is quite attractive for users. However, it does not include an analysis of fingerprinting mechanisms. SSL Server Test ([[https://www.sslabs.com/ssltest](https://www.sslabs.com/ssltest)]([https://www.sslabs.com/ssltest](https://www.sslabs.com/ssltest)) (accessed on 19 November 2024)) by SSL Labs offers a website security analysis service. Although the security assessment of a website is not within the scope of this work, it is interesting to review its evaluation system [15]. The system considers different elements, such as server's certificate and server's configuration regarding protocol, key exchange support, and cipher support. Based on these categories, they provide a global score and apply a set of rules to grade it into a category between A and F.  
The systems we have mentioned use labels or tags to indicate the level of risk. This approach is also followed in other areas, such as in IoT Devices [35] or Privacy Impact Assessments [36], since it is a simple way to show risk levels to end users. Figure 1: Webcookies classification for cookies. Other systems worth pay attention to are those for fingerprinting Web browsers and computers, such as Panopticlick [14] or _Am I Unique_ ([[https://www.amiumique.org/](https://www.amiumique.org/)]([https://www.amiumique.org/](https://www.amiumique.org/)) (accessed on 19 November 2024)), which follow the evaluation of a set of attributes and measure the entropy they provide. In the case of Panopticlik, it uses 10 attributes to identify users' Web browsers or devices, while _Am I Unique_ uses 17. These tools are useful to determine the degree of uniqueness of the browser or device, and thus identify the user. The assessment they provide indicates how unique your browser or device is as a number among all the users' Web browsers or devices that have been fingerprinted in the system. In some cases, they provide, for each attribute, the ratio of similarity, allowing you to identify the main attributes that make your system (almost) unique. In general, they consider attributes from the Web browser or system (e.g., user agent, operating system information), screen and visual configuration (e.g., screen resolution, colour depth, fonts), plug-ins and extensions (e.g., plug-ins, methods supported), or from hardware and special functions (e.g., audio context, touch screen). However, it is important to note that these attributes analyse the user's Web browser, not the website they are accessing. With regard to cookies, these tools only check whether or not cookies are enabled in the Web browser. Furthermore, some attributes cannot be considered, such as the user agent, since it is not possible to determine whether or not the website is analysing HTTP headers. On the other hand, similar to these proposals, we have considered fingerprinting information that can be detected when accessing the website, such as the use of cookies or JavaScript-based fingerprinting techniques like Canvas, WebRTC, and WebGL.