Measuring Web Tracking and Browser Fingerprinting Across the Popularity Spectrum: A Stratified Crawl of 20,911 Websites from the Tranco Top Million

Abstract: Third-party tracking and browser fingerprinting are routinely measured on the most popular websites, yet most of the web lives in the long tail of the popularity distribution. We present a stratified measurement of 20,911 websites drawn from the Tranco top-one-million list in three rank bands (1–10k, 10k–100k and 100k–1M). Each landing page was loaded in an instrumented Chromium browser that routes every connection through a destination-validating safety proxy, records all requests and cookies, matches them against the DuckDuckGo Tracker Data Set, and counts calls to canvas, WebGL and audio fingerprinting APIs. 13,045 pages loaded successfully. Re-weighted to the whole list, 84.1% of websites contact at least one known tracker and 27.0% exhibit at least one fingerprinting signal. Tracker presence is flat across popularity, but invasive practices are not: session replay (17.6% vs 9.6%), fingerprinting (33.3% vs 26.8%) and third-party cookies (55.0% vs 44.2%) are significantly more common at the head of the list than in the tail. We also find that 3,660 sites (17.5%) answered the automated browser with an error or bot-challenge page, and that these challenge pages are themselves heavy finger printers. The resulting feature dataset (107 attributes per site) is used to train the Ovael malicious-tracker detection system.

Keywords: Web tracking, browser fingerprinting, web measurement, stratified sampling, Tranco, privacy, bot detection, dataset.