Measure The Web

User Tools

Site Tools

Trace: • requests
privacy:cookies

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
privacy:cookies [2025/01/09 11:20] – fixed headers karelkubicekprivacy:cookies [2026/08/31 19:48] (current) – Add one sentence pointing to the new Privacy:Browser storage page for persistence that is not a Set-Cookie. Authored by Claude karel.kubicek.claude
Line 1: Line 1:
 ====== Classifying Cookies ====== ====== Classifying Cookies ======
  
-Browser cookies are still the most commonly used method for tracking the session state of websites and the identity of visitors. According to prior studies, between 80% in 2012 {[roesner2012_detecting]} and 90% in 2019 {[solomos2019_clash,sanchezrola2019can]} of websites use cookies for user tracking, often without users' knowledge. While other stateless tracking technologies, such as [[Privacy:Fingerprinting]] or [[Privacy:Requests#classification_of_link_decorators|Link decorators]], exist, cookies remain the primary choice, with stateless methods typically used in combination with cookies. This trend persists despite the discontinuation of third-party cookies.+Browser cookies are still the most commonly used method for tracking the session state of websites and the identity of visitors. According to prior studies, between 80% in 2012 {[roesner2012_detecting]} and 90% in 2019 {[solomos2019_clash,sanchezrola2019can]} of websites use cookies for user tracking, often without users' knowledge. While other stateless tracking technologies, such as [[Privacy:Fingerprinting]] or [[Privacy:Requests#classification_of_link_decorators|Link decorators]], exist, cookies remain the primary choice, with stateless methods typically used in combination with cookies. This trend persists, and third-party cookies were in the end **not** discontinued: on 22 April 2025 Google announced it would "maintain our current approach to offering users third-party cookie choice in Chrome, and will not be rolling out a new standalone prompt for third-party cookies".((Privacy Sandbox, [[https://privacysandbox.com/news/privacy-sandbox-next-steps/|"Next steps for Privacy Sandbox and tracking protections in Chrome"]], 22 April 2025. Checked 2026-08-19.)) They remain allowed by default in Chrome, blocked in its Incognito mode, and partitioned per top-level site by default in Firefox and Safari — so what a measurement observes depends on which browser it drove and in which mode; see [[Programming:Stateful stateless#Since 2022 the engine decides, not you]].
  
 Below, we discuss two main classification methods: using datasets of labeled cookies or machine learning (ML) to classify cookies based on their context and request URL. But first some preliminaries. Below, we discuss two main classification methods: using datasets of labeled cookies or machine learning (ML) to classify cookies based on their context and request URL. But first some preliminaries.
 +
 +This page is about cookies. A site can persist an identifier in several other places — ''localStorage'' and ''sessionStorage'', IndexedDB, Cache Storage behind a service worker, and the HTTP and favicon caches — and a crawler that records only cookies sees none of them; that is [[Privacy:Browser storage]].
  
 ===== First- and Third-Party Cookies ===== ===== First- and Third-Party Cookies =====
  
-First-party cookies are set by the domain the user is directly visiting, while all other cookies are from third parties. A common misconception is that first-party cookies are always benign and third-party cookies are always intrusive. However, first-party cookies can also track users or even be set by third parties using CNAME cloaking. First-party cookies are restricted to the website's context, while third-party cookies can track users across multiple websites.+<WRAP important>A common misconception in research is that first-party cookies are always benign and third-party cookies are always intrusive!</WRAP> 
 + 
 +First-party cookies are set by the domain the user is directly visiting, while all other cookies are considered third-party cookies. Although third-party cookies are significantly more used for tracking than first-party cookies, it is wrong to claim that first-party cookies are always benign and third-party cookies are always intrusive. First-party cookies can also track users or even be set by third parties using [[https://arxiv.org/abs/2102.09301|CNAME cloaking]] and there are many third-party cookies serving necessary functionality such as SSO. 
 + 
 +The only difference is from the browser perspective. First-party cookies are accessible only from the first-party website's context, while third-party cookies are accessible across multiple websites that embed the same third party. But this implementation depends on the browser, with [[https://webkit.org/blog/8943/privacy-preserving-ad-click-attribution-for-the-web/|Safari]] and [[https://blog.mozilla.org/en/products/firefox/firefox-rolls-out-total-cookie-protection-by-default-to-all-users-worldwide/|Firefox]] setting the  storage for third parties for every website separately.
  
 Munir et al. {[shaoor2023cookiegraph]} observed that 89.86% of the top-million websites use first-party tracking cookies. Of these, 96.61% are ghostwritten by third-party scripts embedded in the first-party context, and some are set by fingerprinting scripts. Munir et al. {[shaoor2023cookiegraph]} observed that 89.86% of the top-million websites use first-party tracking cookies. Of these, 96.61% are ghostwritten by third-party scripts embedded in the first-party context, and some are set by fingerprinting scripts.
Line 30: Line 36:
 Using datasets of cookies or online classification services has significant disadvantages: they cannot classify unseen data or assign one cookie multiple classes based on dynamic content. However, they offer advantages over ML methods, such as post-crawl classification of detected cookies. Using datasets of cookies or online classification services has significant disadvantages: they cannot classify unseen data or assign one cookie multiple classes based on dynamic content. However, they offer advantages over ML methods, such as post-crawl classification of detected cookies.
  
-We discuss issues with dynamic cookie names, publicly released datasets, and two main online classification services: Cookiepedia and Cookiedatabase. +<WRAP info>
- +
-==== Dynamic Cookie Names ==== +
 Some websites deviate from the typical key-value (cookie name and cookie value) scheme by storing data directly in the cookie name. There are several cases, explained by following examples: Some websites deviate from the typical key-value (cookie name and cookie value) scheme by storing data directly in the cookie name. There are several cases, explained by following examples:
  
   * ''_gat_UA-<ID>'' and ''_ga_<ID>'' (Google Analytics cookies), where the ID is unique to the Google Analytics configuration but not dynamic per user.   * ''_gat_UA-<ID>'' and ''_ga_<ID>'' (Google Analytics cookies), where the ID is unique to the Google Analytics configuration but not dynamic per user.
-  * ''AMCV_<ID>@<host>'' (Adobe Experience Cloud Identity Service cookie), where the ID is unique per user. Such cookie names cannot be found in databases due to their dynamic nature.+  * ''AMCV_<ID>@<host>'' (Adobe Experience Cloud Identity Service cookie), where the ID is unique per user. Such cookie names cannot be found in databases due to their dynamic nature,, except for cases when the database stores patterns. 
 +</WRAP> 
 + 
 +We discuss publicly released datasets and two main online classification services: Cookiepedia and Cookiedatabase. 
  
 ==== OneTrust and CookieBot Dataset ==== ==== OneTrust and CookieBot Dataset ====
Line 81: Line 88:
   - Preferences Cookies (in some jurisdictions known as functionality)   - Preferences Cookies (in some jurisdictions known as functionality)
  
 +==== Cookiesearch ====
 +
 +https://cookiesearch.org/ (no experience)
 ===== Machine-Learning Classification ===== ===== Machine-Learning Classification =====
  
Line 122: Line 132:
 Edit your crawler to load the profile before starting the crawl and to extract the cookie category data afterward: Edit your crawler to load the profile before starting the crawl and to extract the cookie category data afterward:
  
-<file python create_profile.py>+<file python crawl.py>
 import json import json
 from selenium import webdriver from selenium import webdriver
privacy/cookies.1736421607.txt.gz · Last modified: by karelkubicek
Except where otherwise noted, content on this wiki is licensed under the following license: CC BY-NC-SA 4.0
CC BY-NC-SA 4.0 Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki