# Combating Web Tracking: Analyzing Web Tracking Technologies for User Privacy
## 2 Tracking on the Web
### Web Tracking Methods
#### 2.1.1 Cookie  
Cookies are small information files created by Web servers and sent to Web browsers. The browser stores these cookies for a predetermined period or for the duration of the user's session on the website. When the user makes subsequent requests to the Web server, the browser automatically attaches the relevant cookies.  
There are various types of cookies. Session Cookies are temporary and are deleted once the browser is closed. They are typically used to manage user sessions, such as keeping the user logged in while navigating between pages. Persistent Cookies remain on the user's device even after the browser is closed, allowing the site to remember user preferences or login details between sessions. Third-Party Cookies are set by domains other than the one the user is visiting. They are generally used for advertising or tracking purposes across multiple websites and are the most controversial from a privacy and security standpoint.  
Security Risks of Cookies  
Cookies can pose several security risks. Cookie theft (session hijacking) occurs when session cookies, which manage session states, are intercepted using methods such as man-in-the-middle (MITM) attacks or cross-site scripting (XSS). If an attacker gains access to a user's session cookie, they can impersonate the user and control the session. Cross-site scripting (XSS) allows attackers to inject malicious scripts into a vulnerable website, which can then access cookies containing sensitive information, such as session IDs [20]. These can be exploited for session hijacking attacks. Cross-Site Request Forgery (CSRF) exploits cookies by tricking users into submitting unintended requests. Since browsers automatically send cookies with each request, attackers can manipulate a logged-in user into performing actions without their consent. Persistent data collection is possible even after cookies are deleted from the device. Data collected while the cookie was active may have already been transmitted to the server. This allows third parties, such as ad networks, to retain and manage the data, even after the cookie is no longer on the user's device. This presents a major privacy concern, as data can be used for tracking without the user's direct control [21]. Tracking and privacy concerns arise from third-party cookies, which track users across multiple websites [22]. Advertisers and data brokers can compile detailed user profiles based on browsing habits. Due to this pervasive tracking, regulations like the EU's General Data Protection Regulation (GDPR) require user consent for cookie tracking [22].  
To mitigate these risks, several security measures can be implemented: A secure flag ensures cookies are transmitted only over encrypted HTTPS connections, preventing them from being sent in plain text over insecure HTTP connections. An HttpOnly flag prevents client-side scripts, such as those injected via XSS attacks, from accessing cookies, which is essential for protecting session cookies from theft. A SameSite attribute restricts cookies from being sent with cross-site requests, mitigating CSRF attacks. When enabled, cookies are only sent if the request originates from the same site, making cross-site attacks more difficult. Cookie expiration, particularly for session cookies, should be set to a short duration to minimize the window of opportunity for attackers to exploit them.