From Third-Party to First-Party: Measuring and Protecting Against Modern Web Tracking Mechanisms
2026-06-15 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors studied how websites track users, noticing a shift from third-party trackers to first-party and server-side tracking, which are harder to detect using usual tools. They checked many popular websites and found that over half use these newer tracking methods. By analyzing tracking scripts, they saw the system is tightly connected, with big companies like Google leading. They also found that common blocking tools don't work well against these methods and suggested new rules that block many more tracking requests.
web trackingfirst-party trackingserver-side trackingclient-side detectionfilter liststracking scriptsprivacyweb analyticsGooglenetwork graph
Authors
Christian Böttger, Tareq Khouja, Norbert Pohlmann, Nurullah Demir, Tobias Urban
Abstract
Web user tracking has always been a cat-and-mouse game between privacy-conscious users and trackers. Recently, this conflict has driven a shift from third-party tracking toward first-party tracking (FPT) and server-side tracking (SST). By relocating tracking logic to the browser's first-party context or the website's backend, these mechanisms obscure data flows and render traditional client-side detection tools increasingly ineffective. Despite the growing adoption of these techniques, our understanding of their deployment at scale remains limited, and generalized protection mechanisms are lacking. In this work, we conduct a large-scale measurement of top sites to assess this shift and the prevalence of FPT and SST. We develop a provider-independent methodology to detect these mechanisms and find that over 54% of analyzed sites now deploy FPT or SST-related techniques. By clustering scripts based on their similarity and constructing a network graph, we demonstrate that the ecosystem is densely connected and dominated by major vendors like Google. Finally, we demonstrate that current filter lists are largely ineffective against first-party tracking, and we propose new rules to address this gap. We show that these rules block 63% more requests than traditional filter lists.