1 Web Tracking—A Definition

It frequently occurs that astonishment sets in about upcoming advertisement while surfing the internet. By pure chance, the advertised products match those products users are interested in for quite some time. But how does the linking of information work, which occurs, for instance, in case of “targeted advertising”? The answer is: by web tracking.

By using web tracking a webmaster gets to know inter alia the user behavior on his website, from which website users enter the webmaster’s site, how long they stay on it and how often they visit the site.Footnote 1 Additionally, location data and content from email communication can be tracked. Evaluating this multitude of users’ data tracks, the webmaster is able to create tracking profiles. These profiles contain statements based on probabilities about interests, political persuasion, level of education, and even the sexual orientation of the visitors. This is valuable information, since it enables highly targeted advertising.

In general, the more they know about the customers’ interests and wishes, the more accurately advertising targeting can be and the more likely it is that customers buy the advertised products.

2 What Types of Web Tracking Technologies Exist?

There are various types of web tracking technologies. In view of the large number of tracking methods, only some of them are exemplified below.

Cookies are one classical tracking tool: small text files stored in the user’s browser, assigning information about the site he came from—for example, he clicked on an advertising banner on another website—the frequency of visits and his behavior on the website.Footnote 2 Not all types of cookies should be regarded with mistrust. What they all have in common is the recognition of a browser, respectively, of a user. The essential question in this context is: who set the cookie and with what intention?

The cookie set by a webmaster once the visitor loaded the website primarily, simplifies the visit of the website.Footnote 3 The browser’s recognition by cookies enables a faster loading of the website. If the website provides authentication, further login is expendable. Third party cookies, however, allow cross-website tracking through all websites, on which they are placed.Footnote 4

So-called zombie cookies are a persistent type of tracking cookies, which cannot be deleted easily. They are stored in the browser several times and on different ways. Deleting one type of cookie is detected by the other cookie files and enables auto recovery of the deleted one.

Furthermore, another method which is normally combined with tracking cookies is embedding content on foreign websites with social plugins by Facebook or other social media platforms.Footnote 5 Facebook, for example, places the “Like-Button” on various websites. In combination with cookies, tracking the user’s behavior (so-called coverage analysis/web analytics) is possible even if the user already left the Facebook Website or has not visited Facebook before.

It is also possible to recognize and locate a user by the IP address of his device which is transmitted to the server with each visit of a website.Footnote 6 An approximate localization is possible, because most regions allocated a special range of IP addresses.Footnote 7

Another tracking tool is canvas fingerprinting. It allows webmasters to recognize the user’s digital fingerprint by analyzing browser settings, transmitted with every page view (including browser version, installed browser add-ons, operating system, screen definition and more).Footnote 8 Combining these with other information an extensive profile of the user can be generated.

By analyzing Email content to certain signal words it is able to detect interests and needs of the user. As a result, improved targeted advertising—so called E-Mail tracking—is provided. This affects, for example, users with Gmail accounts.Footnote 9

Through the establishment of smartphones and tablets web tracking achieved a new level of user analysis. App Tracking allows a cross-application identification of the user.Footnote 10 Depending both on the apps that are installed as well as how (or not) the user configured his smartphone, location data, surfing behavior and other information is recorded. Those apps, which record location data and allow extensive analysis, are, regardless of the service offered, often for free. There are considerable doubts that these apps are for free, actually—understanding “free” as a service without consideration. The user “pays” by the disclosure of his data.

Tracking by recording users’ keystrokes while surfing online, a new method from the field of behavior analysis is still in its infancy.Footnote 11 Special softwareFootnote 12 can identify users by their input speed, key press and writing behavior. According to the company BehavioSec, in a test phase 99% of users has been identified.Footnote 13

The companies, that use tracking tools described above, can profit by considerably expanded range of user tracking (so called cross-domain-tracking). A greater range of cross-domain tracking raises not only the quantity of the data used to create user profiles but also—and this is a crucial point—the quality of the data. This results in a holistic mosaic of the respective user.

3 How to Avoid Being Tracked

There are several ways in which tracking can be limited—but you cannot prevent it entirely. Users can change their browser settings, delete cookies manually or install browser add-ons like AdBlock or Ghostery.

Later browser versions provide a preinstalled privacy mode with integrated tracking prevention. By activating this mode, all blacklisted trackers are blocked.

Furthermore, an interesting approach for the prevention of web tracking developed by German company eBlocker is using hardware directly connected at the WLAN access point.Footnote 14 The advantage of this anti-tracking technology is the protection of all devices connected to the wireless network.

Even deactivating JavaScript in the browser is a way to prevent cookies from being stored in the browser or at least to reduce the stored cookies. In newer browser versions, it is not easy to disable it manually, sometimes you need browser add-ons or you need to change the core settings of the browser.

One disadvantage of such protections is that many sites cannot be visited anymore or with restricted functionality only.

4 The Example of Facebook

The connection of different tracking technologies, especially cookies and social plugins, and the technologies’ explosiveness for data protection is shown at the example of Facebook.

Web tracking practice of Facebook runs by implementing the “Like” button on various websites and the use of cookies—especially the Datr-Cookies, which upsets German data protectionists for years.Footnote 15

This cookie is linked to the “Like” button and is stored in the browsers of all users visiting websites with the “Like” button implemented. It does not matter if the user pressed the button or—and this is explosive from the perspective of data protection—if the user is registered at Facebook.Footnote 16 This cookie allows recognition every time visiting a Facebook fan pageFootnote 17 or website with Facebook “Like” plugin.Footnote 18

The fact Facebook tracks also non-members without consent in data processing has moved Belgian and French data protection authority to take action in the recent past. Under current EU law the user’s consentFootnote 19 in data processing is required in these cases.

In 2015 Belgian data protection authority sued Facebook (Belgian Privacy Commission 2015) for omission of the procedure described above. The authority threatened a fine of 250,000 € for each day on which Facebook continued its tracking practices, which in the opinion of the authority violate data protection law. In the court of first instance, the applicant won, but Facebook appealed against it, already.Footnote 20

In France, the data protection authority set Facebook a deadline to end the tracking of non-members without their consent.Footnote 21

For the question if web tracking by using these technologies violates data protection law, it is crucial, if the tracked data is personal data. Whether IP addresses are personal data is discussed in literature and case law, for a long time.Footnote 22 German Federal Court (BGH) requested the European Court of Justice (ECJ) in 2015 to give a ruling thereon.Footnote 23 Its decision could have extensive implications for the current tracking practice and its legal assessment.Footnote 24

5 Summary and Outlook

The web tracking technologies described above exemplarily confirm the thesis of data as the “new oil”. Because of the parties’ commercial interests (webmasters, marketing companies and others) it is no surprise advertisement is the important source of financing websites.

To this, the increasing tendency of Internet users to prevent ads and tracking by using ad blockers or other technologies is diametrically opposed.

There is growing evidence that, in order to fulfill the economic potential also in future, internet industry will respond, and will develop new technologies.

For example, Germany’s highest-circulation newspaper blocks its website for users with activated ad blockers. Who wants to enjoy the free content, should pay at least in the form of advertising. Other newspapers will follow probably. Newspapers abroad implemented already similar mechanisms. What technical developments are coming and how the jurisdiction will react on that—only the future will tell.