# _WebTrackingScore:_ A Combined Web Tracking Risk Score System for Websites
## 4 Web TrackingScore: Definition and Evaluation
### Definition of the WebTrackingScore Metric
#### Base values  
Let us examine the weight we have decided to assign to each combination within the evaluation system. We consider third-party persistent cookies to be the most dangerous, followed by first-party persistent cookies. Next are third-party session cookies, which are less common, and finally, first-party session cookies. * **Strict cookies:** According to the definition, this type of cookie does not compromise the user's privacy, so it will have minimal weight within the system. Similarly, we can exclude the following combinations: {strict, first-party, persistent}, {strict, third-party, session}, and {strict, third-party, persistent}, which are marked with an \"X\" in Figure 9.  
Figure 8: Ranges according to the WebTrackingScore metric. Figure 9: Weight of the combinations with cookies whose purpose is purely strict. * **Performance cookies:** According to the definition, this type of cookie can occur in all combinations, such as {performance, first-party, persistent}, {performance, first-party, session}, {performance, third-party, session}, and {performance, third-party, persistent}. Performance cookies collect information in an anonymous way, so we have decided that they will not contribute any weight in the evaluation system, as they do not compromise a user's privacy; they will not contribute any weight in the evaluation system. As shown in Figure 10, their weight will be 0 in all combinations. * **Functionality cookies:** This type of cookie collects personal information from the user. Although this information may be anonymized if configured by the user, this is not the default option. Since most users may be unaware of this setting, the weight of this type of cookie is included within the evaluation system. With this type of cookie, all their combinations are also possible, and their weights are as shown in Figure 11. These cookies are not primarily designed to track user activity but to provide advanced functionality to users. However, since they may be used for tracking, we have decided to assign a weight to each of their combinations in the evaluation system. Thus, we have decided to assign a weight of 1 to session cookies if they are first-party and 2 if they are third-party. This is because session cookies are not primarily designed to collect information, so their weights are reduced. Persistent cookies are assigned slightly higher weights due to their persistent nature, with a weight of 3 for first-party cookies and 4 for third-party cookies. * **Advertising cookies:** These cookies are the most commonly used cookie and pose the greatest risk to user privacy. The combinations that it makes sense to consider are [advertising, first-party, persistent] and [advertising, third-party, persistent], as their primary goal is to track user behaviour over time across one or multiple websites. However, the combinations [advertising, first-party, session] and {advertising, third-party, session} may also exist, so they will also be included in the evaluation system. For advertising cookies, we have decided to make a greater distinction between persistent cookies and session cookies (which are generally less relevant for this type of cookie). Therefore, first-party session cookies are given slightly less weight than  
Figure 11: Weight of the combinations with cookies whose purpose is functionality. Figure 10: Weight of combinations with cookies whose purpose is performance. third-party cookies because, although they originate from the website you are visiting, they are still designed to collect user information, thereby posing a risk to user privacy. * **Cookies whose function is unknown:** It is not always possible to categorize a cookie according to its function (e.g., due to poor or missing documentation, obfuscated implementation, behaviour that varies in terms of the function of the context). Therefore, we will consider the following combinations: {unknown, first-party, session}, {unknown, first-party, persistent}, {unknown, third-party, session}, and {unknown, third-party, persistent}.