Preventing cross-site tracking and web cookie sharing

Last week, a group of ad agencies blasted Apple for Safari’s emerging anti-tracking technology, which would clearly undermine current advertising practices.

Here’s a link to that story, as well as to another post with Apple’s official response to that shot across their bow.

I was doing a bit of reading on the issue and found myself on the WebKit.org post that started the whole kerfuffle, a blog post by John Wilander entitled Intelligent Tracking Prevention.

From the post:

WebKit has long included features to reduce tracking. From the very beginning, we’ve defaulted to blocking third-party cookies. Now, we’re building on that. Intelligent Tracking Prevention is a new WebKit feature that reduces cross-site tracking by further limiting cookies and other website data.

And:

Websites can fetch resources such as images and scripts from domains other than their own. This is referred to as cross-origin or cross-site loading, and is a powerful feature of the web. However, such loading also enables cross-site tracking of users.

Imagine a user who first browses example-products.com for a new gadget and later browses example-recipies.com for dinner ideas. If both these sites load resources from example-tracker.com and example-tracker.com has a cookie stored in the user’s browser, the owner of example-tracker.com has the ability to know that the user visited both the product website and the recipe website, what they did on those sites, what kind of web browser was used, et cetera. This is what’s called cross-site tracking and the cookie used by example-tracker.com is called a third-party cookie. In our testing we found popular websites with over 70 such trackers, all silently collecting data on users.

It all comes down to privacy. Do you want the ability to browse the web without being tracked? Do ad agencies have the right to impose a “tracking cost” as the price of you being able to browse? Is it their web? To me, there’s an underlying presumptuousness, arrogance, in portraying agencies as the injured party because they are losing their right to track users.