How Google tracks with the ping-attribute
Tags: html, analytics, discuss
Published: 2021-01-07 13:04:12

Have you heard about the `ping`-attribute?
It's an attribute on the `<a>`nchor-tag, that most people haven't heard about.

Websites can use the `ping`-attribute to track clicks on hyperlinks.

You provide a space-separated list of URI's:

```html
<a ping="/relativeuri https://not-so-relative-uri.com">
```

Each URI will receive a POST with the request payload 'PING'.

Google use this feature on their search-result-page.  
Here's an example if you search for "ping attribute":

```html
<a href="https://www.w3schools.com/tags/att_a_ping.asp" ping="/url?sa=t&amp;source=web&amp;rct=j&amp;url=https://www.w3schools.com/tags/att_a_ping.asp&amp;ved=2ahUKEwixrcD5g93mAhUqy8QBHRrVAN0QFjACegQIBBAB">...</a>
```

As a user, you will only see the content of the `href`-attribute when you hover the link. You will _not see_ the list of URI's in the `ping`-attribute, that will be POST'ed if you follow the link.

This is against the official recommendation:

> When the `ping` attribute is present, user agents should clearly indicate to the user that following the hyperlink will also cause secondary requests to be sent in the background, possibly including listing the actual target URLs.

---

Google will 'PING', even if you don't allow cookies. You can check it by following these steps:

1. Open an incognito window, and search for "ping attribute".
2. Inspect the markup and delete the Google popup, asking you to accept cookies.
3. Go to the Network-tab of Chrome DevTools and enable "Preserve Log".
4. Clear the current network-traffic.
5. Click on the first link (in my case, it's a w3schools-link).
6. Check the network-traffic. The first couple of entries are from the previous page (the Google result). 

One of them has a 'PING' payload.

If you study that request you'll see, that Google will have more than enough info about your browser and where you're browsing to, even though you never accepted cookies or any other tracking-agreement.

If you do the same in Firefox, the result will *not* have `ping`-attributes, as Firefox currently is the only browser that disables the `ping`-attribute by default. That's why *Google Search* use a JavaScript event handler in Firefox.
 
It's [not possible](https://lapcatsoftware.com/articles/Safari-link-tracking.html) to disable it in Safari. 

And in Chrome, the setting:

```html
chrome://flags#disable-hyperlink-auditing
```

— has been removed. Even if you enable "Do Not Track*)", the `ping` URI's are still POST'ed.

---

If you chose to disable JavaScript altogether, Google use redirects instead of direct links: 

```html
<a href="/url?q=https://www.w3schools.com/tags/att_a_ping.asp" ... >
```

If you inspect the Network traffic once again, you'll see that when you land on the w3schools-page, it'a after a `HTTP 302: Redirect`.

---

In these days of GDPR, it's surprising to see tracking-mechanisms that *cannot be disabled* or bypassed by the user.

### *) Do Not Track
"Do Not Track" (DNT) was a proposed HTTP header field, designed to allow internet users to opt-out of tracking by a website. It's still a setting (typically hidden away under "Advanced") in most browsers, but — alas — it doesn't have any effect, and DNT has been cancelled, which is a pity. 

Thanks for reading!