# _WebTrackingScore:_ A Combined Web Tracking Risk Score System for Websites
## 2 Web Tracking Mechanisms and Privacy Scanners  
There are a significant number of mechanisms to track users through the Web [6; 10; 16; 17; 18; 19]. These mechanisms can be classified into two categories [2; 16; 20; 21]: stateful and stateless mechanisms. Stateful Web tracking mechanisms are based on the storage of user's identifiers on the Web browser. Stateless tracking refers to tracking user activity on the Web without the storage of persistent data about the user. Next, we describe the main mechanisms within each type of tracking. For stateful Web tracking mechanisms, we can mention the following: cookies, HTML5 local storage, session storage, and IndexedDB. Cookies are the main mechanism used to track users. Cookies can be categorized in several ways depending on their origin, their lifespan, or their purpose, as classified by the UK International Chamber of Commerce (ICC) [22]. This latter classification is also followed by other authors, such as [PERSON] et al. [3], along with Cookipedia ([[https://cookiepedia.co.uk/](https://cookiepedia.co.uk/)]([https://cookiepedia.co.uk/](https://cookiepedia.co.uk/)) (accessed on 19 November 2024)), which is the largest database of pre-category cookies and online tracking technologies. If we consider their origin, cookies can be classified as first-party cookies or third-party cookies. First-party cookies are created by the website the user is currently visiting. Meanwhile, third-party cookies are created by domains other than the website the user is visiting, often through ads or social media. They are the most common mechanism for tracking users on the Web [23]. If we classify cookies according their lifespan, they can be divided into session cookies and persistent cookies. The lifespan of a session cookie lasts until the browser session ends or the Web browser is closed. The lifespan of a persistent cookie extends beyond a session; it has an expiration date that can change from a few days to several years. According to ICC UK [22], cookies can be classified into strictly necessary cookies, performance cookies, functionality cookies, and targeting or advertising cookies. Strictly necessary cookies are essential for the website to function properly, enabling users to navigate through it (e.g., supporting a shopping cart). Performance cookies collect data about visitors' interactions with the website, such as the most visited pages. Functionality cookies are used for personalization and remembering users' choices, such as their preferred language on the website or the type of news they want to see or sharing comments or 'Likes', e.g., Facebook (now Meta) Pixel [24]. Finally, targeting or advertising cookies are used to develop advertising models and determine how adverts are delivered to users (e.g., number of times an ad is displayed). On the other hand, stateless Web tracking [25] does not rely on storing any information on the user's computer but instead identifies the user based on a set of features from the Web browser and computer (operating system, screen resolution, language, time zone, Canvas, etc.) [24; 26]. This kind of tracking can also be made through observation channels in Web browsers [27]. An attacker can also track a user through a Server Name Indication (SNI) TLS handshake extension [28]. As mentioned, stateful Web tracking (primarily cookies) is the most common mechanism, but stateless tracking is increasingly being adopted. [PERSON] et al. [5] found that over 10% of the top 100,000 websites use browser fingerprinting. Additionally, Web browsers are becoming increasingly susceptible to fingerprinting due to their APIs [29]. Finally, regarding tracking on the Web, we want to point out that laws like the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and Brazil's General Personal Data Protection Law (LGPD) require websites to notify users about cookie tracking through consent banners, often offering the option to accept or reject cookies [8; 9; 10].