research-article

Measuring Third-party Tracker Power across Web and Mobile

Authors:

Nigel ShadboltAuthors Info & Claims

ACM Transactions on Internet Technology (TOIT), Volume 18, Issue 4

Article No.: 52, Pages 1 - 22

https://doi.org/10.1145/3176246

Published: 07 August 2018 Publication History

Abstract

Third-party networks collect vast amounts of data about users via websites and mobile applications. Consolidations among tracker companies can significantly increase their individual tracking capabilities, prompting scrutiny by competition regulators. Traditional measures of market share, based on revenue or sales, fail to represent the tracking capability of a tracker, especially if it spans both web and mobile. This article proposes a new approach to measure the concentration of tracking capability, based on the reach of a tracker on popular websites and apps. Our results reveal that tracker prominence and parent–subsidiary relationships have significant impact on accurately measuring concentration.

References

[1]

Gunes Acar, Marc Juarez, Nick Nikiforakis, Claudia Diaz, Seda Gürses, Frank Piessens, and Bart Preneel. 2013. FPDetective: Dusting the web for fingerprinters. In Proceedings of the ACM SIGSAC Conference on Computer 8 Communications Security. ACM, 1129--1140.

Digital Library

[2]

Alessandro Acquisti, Curtis R. Taylor, and Liad Wagman. 2016. The economics of privacy. J. Econ. Lit. 54, 2 (2016), 442--492.

[3]

Jonathan Anderson, Joseph Bonneau, and Frank Stajano. 2010. Inglorious installers: Security in the application marketplace. In WEIS. Citeseer.

[4]

Julia Angwin. 2016. Google has quietly dropped ban on personally identifiable web tracking. ProPublica. https://www.propublica.org.

[5]

Steven Arzt, Siegfried Rasthofer, Christian Fritz, Eric Bodden, Alexandre Bartel, Jacques Klein, Yves Le Traon, Damien Octeau, and Patrick McDaniel. 2014. Flowdroid: Precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for android apps. ACM SIGPLAN Not. 49, 6 (2014), 259--269.

Digital Library

[6]

Arslan Aziz and Rahul Telang. 2015. What Is a Cookie Worth? Technical Report.

[7]

Brandon Bailey. 2016. WhatsApp is going to share your phone number with Facebook. San Francisco, The Associated Press.

[8]

Leonid Batyuk, Markus Herpich, Seyit Ahmet Camtepe, Karsten Raddatz, Aubrey-Derrick Schmidt, and Sahin Albayrak. 2011. Using static analysis for automatic assessment and mitigation of unwanted and malicious activities within android applications. In Proceedings of the 2011 6th International Conference on Malicious and Unwanted Software (MALWARE’11). IEEE, 66--72.

Digital Library

[9]

Ben Bold. 2017. Google and facebook dominate over half of digital media market. Retrieved from https://www.campaignlive.co.uk/article/google-facebook-dominate-half-digital-media-market/1444793.

[10]

Theodore Book and Dan S. Wallach. 2015. An empirical study of mobile ad targeting. arXiv Preprint arXiv:1502.06577 (2015).

[11]

Richard Clayton and Tony Mansfield. 2014. A study of Whois privacy and proxy service abuse. In Proceedings of the 13th Workshop on Economics of Information Security.

[12]

Jay Cline. 2014. U.S. takes the gold in doling out privacy fines. Computerworld, February 17, 2014.

[13]

James Covert. 2016. Twitter kicked tires on yahoo merger. Retrieved from http://nypost.com/2016/06/02/twitter-talks-to-yahoo-about-merger/.

[14]

Benjamin Edelman. 2015. Does google leverage market power through tying and bundling? J. Competit. Law Econ. 11, 2 (2015), 365--400.

[15]

Benjamin G. Edelman and Damien Geradin. 2016. Android and competition law: Exploring and assessing google’s practices in mobile. Euro. Competit. J. 12, 2--3 (2016), 159--194.

[16]

Manuel Egele, Christopher Kruegel, Engin Kirda, and Giovanni Vigna. 2011. PiOS: Detecting privacy leaks in iOS applications. In Proceedings of the Network and Distributed System Security Symposium (NDSS’11). 177--183.

[17]

William Enck, Peter Gilbert, Seungyeop Han, Vasant Tendulkar, Byung-Gon Chun, Landon P. Cox, Jaeyeon Jung, Patrick McDaniel, and Anmol N. Sheth. 2014. TaintDroid: An information-flow tracking system for realtime privacy monitoring on smartphones. ACM Trans. Comput. Syst. 32, 2 (2014), 5.

Digital Library

[18]

Steven Englehardt and Arvind Narayanan. 2016. Online tracking: A 1-million-site measurement and analysis. In Proceedings of the ACM Conference on Computer and Communications Security 2016.

Digital Library

[19]

Steven Englehardt, Dillon Reisman, Christian Eubank, Peter Zimmerman, Jonathan Mayer, Arvind Narayanan, and Edward W. Felten. 2015. Cookies that give you away: The surveillance implications of web tracking. In Proceedings of the 24th International Conference on World Wide Web. ACM, 289--299.

Digital Library

[20]

Nathaniel Fruchter, Hsin Miao, Scott Stevenson, and Rebecca Balebako. 2015. Variations in tracking in relation to geographic location. arXiv Preprint arXiv:1506.04103 (2015).

[21]

Commissioner Pamela Jones Harbour. 2007. Dissenting Statement in the Matter of Google/Doubleclick. FTC File No. 071-0170. (2007).

[22]

P. Hustinx. 2014. Privacy and competitiveness in the age of big data. European Data Protection Supervisor, March 26, 2014 (online report).

[23]

IAB. 2016. IAB Internet Advertising Revenue Report 2015. (2016).

[24]

Robert H. Lande. 2008. The microsoft-yahoo merger: Yes, privacy is an antitrust concern. University of Baltimore School of Law Legal Studies Research Paper No. 2008-06.

[25]

Christophe Leung, Jingjing Ren, David Choffnes, and Christo Wilson. 2016. Should you use the app for that? Comparing the privacy implications of app-and web-based online services. (unpublished).

[26]

Timothy Libert. 2015. Exposing the invisible web: An analysis of third-party HTTP requests on 1 million websites. Int. J. Commun. 9 (2015), 3544--3561.

[27]

Jialiu Lin, Bin Liu, Norman Sadeh, and Jason I. Hong. 2014. Modeling users’ mobile app privacy preferences: Restoring usability in a sea of permission settings. In Proceedings of the Symposium on Usable Privacy and Security (SOUPS’14). USENIX Association, Menlo Park, CA, 199--212.

Digital Library

[28]

Ziang Ma, Haoyu Wang, Yao Guo, and Xiangqun Chen. 2016. LibRadar: Fast and accurate detection of third-party libraries in android apps. In Proceedings of the 38th International Conference on Software Engineering Companion. ACM, 653--656.

Digital Library

[29]

Saskia Meier. 2014. Erfolgreicher Anzeigenverkauf in Mobilen Medien: Eine Empirische Analyse Zu Verkaufsindikatoren im Mobile Advertising. Springer-Verlag.

[30]

Rodrigo Montes, Wilfried Sand-Zantman, and Tommaso M. Valletti. 2015. The value of personal information in markets with endogenous privacy. CEIS Working Paper No. 352.

[31]

Organisation for Economic Co-operation and Development (OECD). 2015. Data-Driven Innovation: Big Data for Growth and Well-Being. OECD Publishing.

[32]

Lukasz Olejnik, Tran Minh-Dung, and Claude Castelluccia. 2014. Selling off privacy at auction. Network and Distributed System Security Symposium (NDSS).

[33]

Frank A. Pasquale. 2013. Privacy, antitrust, and power. George Mason Law Rev. 20, 4 (2013), 1009--1024.

[34]

Lingzhi Qiu, Zixiong Zhang, Ziyi Shen, and Guozi Sun. 2015. AppTrace: Dynamic trace on android devices. In Proceedings of the 2015 IEEE International Conference on Communications. IEEE, 7145--7150.

[35]

Jingjing Ren, Ashwin Rao, Martina Lindorfer, Arnaud Legout, and David Choffnes. 2016. Demo: ReCon: Revealing and controlling PII leaks in mobile network traffic. In Proceedings of the International Conference on Mobile Systems, Applications, and Services Companion (MobiSys’16 Companion). 117--117.

Digital Library

[36]

Franziska Roesner, Tadayoshi Kohno, and David Wetherall. 2012. Detecting and defending against third-party tracking on the web. In Proceedings of the 9th USENIX Conference on Networked Systems Design and Implementation. USENIX Association, 12--12.

Digital Library

[37]

Sam Schechner. 2017a. Germany says facebook abuses market dominance to collect data. Retrieved from https://www.wsj.com/articles/facebook-abuses-its-dominance-to-harvest-your-data-says-german-antitrust-enforcer-1513680355.

[38]

Sam Schechner. 2017b. In-app mobile ad spend to reach 45.3bn, facebook and google rejoice. Retrieved from http://adage.com/article/digital/facebook-google-dominate-45-billion-app-ad-market/310761/.

[39]

Carl Shapiro. 2010. The 2010 horizontal merger guidelines: From hedgehog to fox in forty years. Antitrust Law J. 77, 1 (2010), 49--107.

[40]

Peter Swire. 2007. Protecting consumers: Privacy matters in antitrust analysis. Cent. Am. Prog. 19, 10 (2007), 7.

[41]

V. F. Taylor and I. Martinovic. 2017. To update or not to update: Insights from a two-year study of android app evolution. In Proceedings of the ACM Asia Conference on Computer and Communications Security (ASIACCS’17).

Digital Library

[42]

Narseo Vallina-Rodriguez, Srikanth Sundaresan, Abbas Razaghpanah, Rishab Nithyanand, Mark Allman, Christian Kreibich, and Phillipa Gill. 2016. Tracking the trackers: Towards understanding the mobile advertising and tracking ecosystem. arXiv Preprint arXiv:1609.07190 (2016).

[43]

Max Van Kleek, Ilaria Liccardi, Reuben Binns, Jun Zhao, Daniel J. Weitzner, and Nigel Shadbolt. 2017. Better the devil you know: Exposing the data sharing practices of smartphone apps. In Proceedings of the 2017 CHI Conference on Human Factors in Computing Systems. ACM, 5208--5220.

Digital Library

[44]

Vincent Verouden. 2004. The role of market shares and market concentration indices in the european commission’s guidelines on the assessment of horizontal mergers under the EC merger regulation. In Comments Prepared for the FTC and US DOJ Merger Enforcement Workshop.

[45]

Frederick R. Warren-Boulton. 1990. Implications of US experience with horizontal mergers and takeovers for canadian competition policy. The Law and Economics of Competition Policy.

[46]

Zhonghao Yu, Sam Macbeth, Konark Modi, and Josep M. Pujol. 2016. Tracking the trackers. In Proceedings of the 25th International Conference on World Wide Web. International World Wide Web Conferences Steering Committee, 121--132.

Digital Library

[47]

Ethan Zuckerman. 2014. The internet’s original sin. The Atlantic 14, 8 (2014).

Cited By

Pybus JCoté M(2024)Super SDKs: Tracking personal data and platform monopolies in the mobileBig Data & Society10.1177/2053951724123127011:1Online publication date: 21-Feb-2024
https://doi.org/10.1177/20539517241231270
Singh RMilkuri SLiu YLi Q(2024)TraceMonitor: A Novel AI-Based Chrome Extension to Enhance User Awareness of Privacy Leakage towards Green Web Browsing2024 IEEE Green Technologies Conference (GreenTech)10.1109/GreenTech58819.2024.10520452(59-63)Online publication date: 3-Apr-2024
https://doi.org/10.1109/GreenTech58819.2024.10520452
Rodriguez DDel Alamo JFernández-Aller CSadeh N(2024)Sharing is Not Always Caring: Delving Into Personal Data Transfer Compliance in Android AppsIEEE Access10.1109/ACCESS.2024.334942512(5256-5269)Online publication date: 2024
https://doi.org/10.1109/ACCESS.2024.3349425
Show More Cited By

Index Terms

Measuring Third-party Tracker Power across Web and Mobile
1. Security and privacy
  1. Human and societal aspects of security and privacy
    1. Economics of security and privacy

Recommendations

Third Party Tracking in the Mobile Ecosystem
WebSci '18: Proceedings of the 10th ACM Conference on Web Science

Third party tracking allows companies to identify users and track their behaviour across multiple digital services. This paper presents an empirical study of the prevalence of third-party trackers on 959,000 apps from the US and UK Google Play stores. ...
CookieGraph: Understanding and Detecting First-Party Tracking Cookies
CCS '23: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security

As third-party cookie blocking is becoming the norm in mainstream web browsers, advertisers and trackers have started to use first-party cookies for tracking. To understand this phenomenon, we conduct a differential measurement study with versus without ...
Platform or wholesale? a strategic tool for online retailers to benefit from third-party information

Online retailing is dominated by a channel structure in which a retailer either buys products from competing manufacturers and resells to consumers (wholesale scheme) or lets manufacturers sell directly to consumers on its platform for a commission (...

Comments

Information & Contributors

Information

Published In

cover image ACM Transactions on Internet Technology

ACM Transactions on Internet Technology Volume 18, Issue 4

Special Issue on Computational Ethics and Accountability, Special Issue on Economics of Security and Privacy and Regular Papers

November 2018

348 pages

ISSN:1533-5399

EISSN:1557-6051

DOI:10.1145/3210373

Editor:
Munindar P. Singh
Department of Computer Science, North Carolina State University

Issue’s Table of Contents

Copyright © 2018 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected].

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 07 August 2018

Accepted: 01 December 2017

Revised: 01 October 2017

Received: 01 November 2016

Published in TOIT Volume 18, Issue 4

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article
Research
Refereed

Funding Sources

UK Engineering and Physical Sciences Research Council (EPSRC)

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

34
Total Citations
View Citations
1,002
Total Downloads

Downloads (Last 12 months)76
Downloads (Last 6 weeks)7

Reflects downloads up to 23 Feb 2025

Other Metrics

View Author Metrics

Citations

Cited By

Pybus JCoté M(2024)Super SDKs: Tracking personal data and platform monopolies in the mobileBig Data & Society10.1177/2053951724123127011:1Online publication date: 21-Feb-2024
https://doi.org/10.1177/20539517241231270
Singh RMilkuri SLiu YLi Q(2024)TraceMonitor: A Novel AI-Based Chrome Extension to Enhance User Awareness of Privacy Leakage towards Green Web Browsing2024 IEEE Green Technologies Conference (GreenTech)10.1109/GreenTech58819.2024.10520452(59-63)Online publication date: 3-Apr-2024
https://doi.org/10.1109/GreenTech58819.2024.10520452
Rodriguez DDel Alamo JFernández-Aller CSadeh N(2024)Sharing is Not Always Caring: Delving Into Personal Data Transfer Compliance in Android AppsIEEE Access10.1109/ACCESS.2024.334942512(5256-5269)Online publication date: 2024
https://doi.org/10.1109/ACCESS.2024.3349425
Rodriguez DDel Alamo JCozar MGarcía B(2024)ROI: a method for identifying organizations receiving personal dataComputing10.1007/s00607-023-01209-2106:1(163-184)Online publication date: 1-Jan-2024
https://dl.acm.org/doi/10.1007/s00607-023-01209-2
Flensburg SLai S(2023)Follow the Data! A Strategy for Tracing Infrastructural PowerMedia and Communication10.17645/mac.v11i2.646411:2Online publication date: 13-Apr-2023
https://doi.org/10.17645/mac.v11i2.6464
Pierson JKerr ARobinson SFanni RSteinkogler VMilan SZampedri G(2023)Governing artificial intelligence in the media and communications sectorInternet Policy Review10.14763/2023.1.168312:1Online publication date: 21-Feb-2023
https://doi.org/10.14763/2023.1.1683
Sebastián SDiugan RCaballero JSanchez-Rola IBilge L(2023)Domain and Website Attribution beyond WHOISProceedings of the 39th Annual Computer Security Applications Conference10.1145/3627106.3627190(124-137)Online publication date: 4-Dec-2023
https://dl.acm.org/doi/10.1145/3627106.3627190
Ekambaranathan AZhao JChalhoub G(2023)Navigating the Data AvalancheProceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies10.1145/35962677:2(1-24)Online publication date: 12-Jun-2023
https://dl.acm.org/doi/10.1145/3596267
Lai SAndelsman VFlensburg S(2023)Datafied school life: the hidden commodification of digital learningLearning, Media and Technology10.1080/17439884.2023.221906349:3(371-387)Online publication date: Jun-2023
https://doi.org/10.1080/17439884.2023.2219063
Ullah IKanhere SBoreli R(2023)Privacy-preserving targeted mobile advertising: A Blockchain-based framework for mobile adsJournal of Network and Computer Applications10.1016/j.jnca.2022.103559211(103559)Online publication date: Feb-2023
https://doi.org/10.1016/j.jnca.2022.103559
Show More Cited By

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Article

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Figures

Tables

Media

View Issue’s Table of Contents