While third-party tracking on the web has garnered much
attention, its workings remain poorly understood. Our
goal is to dissect how mainstream web tracking occurs in
the wild. We develop a client-side method for detecting
and classifying five kinds of third-party trackers based
on how they manipulate browser state. We run our
detection system while browsing the web and observe
a rich ecosystem, with over 500 unique trackers in our
measurements alone. We find that most commercial
pages are tracked by multiple parties, trackers vary widely
in their coverage with a small number being widely
deployed, and many trackers exhibit a combination of
tracking behaviors. Based on web search traces taken
from AOL data, we estimate that several trackers can each
capture more than 20% of a user’s browsing behavior. We
further assess the impact of defenses on tracking and find
that no existing browser mechanisms prevent tracking by
social media sites via widgets while still allowing those
widgets to achieve their utility goals, which leads us to
develop a new defense. To the best of our knowledge, our
work is the most complete study of web tracking to date.