Web Bugs

We used data from Ghostery, a crowd-sourced application that detects the presence of web bugs and allows users to report them to a central database. The Ghostery data identified 117 unique web bug servers on 393,829 unique domains visited during the month of March by approximately 30,000-45,000 users.


No Accountability for Third Party Trackers

In our analysis of privacy policies, 36 of the websites affirmatively acknowledged the presence of third-party tracking. However, each of these policies also stated that the data collection practices of these third parties were outside the coverage of the privacy policy. This appears to be a critical loophole in privacy protection on the Internet.

Users are Tracked Online by Dozens of Companies

Many websites featured multiple web bugs; some had several dozen. The two sites with the most web bugs were both blogging sites: Blogspot had 100 and Typepad had 75 (Blogger came in fourth with 31). These numbers seems larger than what a typical user might expect upon visits to a website.

Tracking Companies Have Extensive Coverage

In addition to the abundance of web bugs on individual sites, the data shows that tracking companies have the potential to cover vast swaths of the Internet. The biggest players showed up on hundreds of thousands of unique domains.

Dominance of Google

From our analysis, it is apparent that Google is the dominant player in the tracking market. Among the top 100 websites this project focused on, Google Analytics appeared on 81 of them. When combined with the other trackers it operates, such as DoubleClick, Google can track 92 of the top 100 websites. Furthermore, a Google-operated tracker appeared on 348,059 of 393,829 distinct domains tracked by Ghostery in March 2009 (over 88%).

We are not claiming that Google aggregates information from each of these trackers into a central database, though it does possess the capability to do so. It appears that they strive to keep data in silos. For instance, their Analytics FAQ indicates that they give website operators control over how Google may use the data. Operators can keep data gathered by Google Analytics from being used by Google for other services. However, Google creates incentives for site operators to share by offering premium services only to those websites that share data.