“Own your data”, part II: Using Ghostery to keep my browsing trail private

While browsing around the internet, data is not only transferred from web servers to our screens, but also in the other direction: mostly invisible to the user, code embedded in websites sends usage data back to the provider of the website and to third-party services.

Working with websites, their design and technical infrastructure on a daily basis, I have always been aware of this. Regardless, the scale of this practice makes me shudder every time I activate the Mozilla Lightbeam plugin (formerly known as Collusion) that visualizes all the tracking providers outside of visited web services:

Sometimes, a website might send usage data to up to 20 different advertising networks, analytics providers and social network sites. And when moving on to the next website, one may notice that the same companies receive tracking data also from there - in above graphic, these are the triangles with connections to more than one visited site (circle).

Particularly common trackers are the big social media networks the like of Facebook, Twitter, Google+ etc., who thanks to their “sharing widgets” or “like buttons” are almost omnipresent on the web in 2014 and therefore able to collect user profiles of highest detail. In addition, Google is indicated as a tracker on almost every website visited, thanks to their Google Analytics product being embedded in a major share of online services.

It’s not just about tracking single visits

As I pointed out in the first post of my series on “Privacy-Aware Design”, the most critical aspect of this third-party tracking is that it allows these services to combine data from different websites and profile users in great detail.

Granted, this activity is almost exclusively based on the desire to serve me targeted advertising or to genuinely improve my use experience of certain online services - it is not to be assumed that these services are interested in an individual’s data in detail. Still, I consider my browsing history to be personal data that belongs to me only (therefore being stored in my browser’s local history table and nowhere else).

Already for years, I have set my browser to delete all website cookies every time I close it - with manual exceptions for some trusted websites - which should at least complicate to connect the data between my browsing sessions (regardless, uniquely identifying a user is still possible without cookies), but looking at these graphs with the spiderweb-like connections from almost any website to third-party trackers, I decided to reclaim my data more radically.

Blocking the trackers all at once

To the rescue comes Ghostery, a plug-in available for all major browsers, that promises to block any transmissions to known third-party data collectors. Being closed source, there is of course no direct way to determine that the provider of the software can be fully trusted, but [Update 2014-02-27: I received an e-mail from Ghostery, reminding me that the source code of any browser plugin can naturally be read as it is JavaScript code; only the license of Ghostery is private] Based on reviews from reliable sources it appears that the company behind the plug-in and their privacy policy can be trusted for the time being (there is however a certain amount of controversy which makes me wish for a similar product to emerge from the open source community before long).

I initially set up the plugin to “block all trackers” by default, and would then allow certain trackers manually if I see that the blocking causes any issues on certain websites or that I would grant some providers access to my data on an opt-in basis (spoiler: no such adjustments have been necessary so far).

After activation, the plug-in adds a small icon to the browser menu bar, which indicates the number of blocked trackers on each website visited. Just as with Lightbeam, it is disconcerting to see how many parties would be informed about my visit without the privacy blocker in place; numbers in the low twenties are not unusual on advertising-heavy media sites with a thorough social media integration.

Surprise benefits

After a few weeks of using Ghostery, I am not only confident that my browsing data no longer ends up in various databases around the globe, but I also discovered some additional benefits I had not expected:

• Even though the plug-in may slow down the initial loading of a page (as it has to be rendered by the blocker software first), websites seem to load faster in total. This is likely thanks to the fact that a lot less data is being transferred and the browser does not collect tracking scripts and tracked content from various servers.
• Much more advertising disappears than I had anticipated. Obviously, the scripts embedding banners from third-party advertising networks are blocked by Ghostery, leading to the disappearance of almost any advertising - except for ads that are delivered by the visited website itself.

While, by removing some visible elements in addition to blocking the invisible background tracking, Ghostery changes the appearance of websites to a certain extent, I have yet to find a website that would “suffer” more than by showing a few white spaces where banners should be. Most noticable, at least to the visually literate, is the fact that fonts loaded from some third-party providers are replaced with fallback alternatives - the web looks a bit more Arial and Times New Roman than before.

The plug-in replaces some of the blocked elements with small icons that can be clicked to allow either loading them once or creating a permanent exception. This comes in handy for example with Disqus comments, which are by default blocked (as Disqus would be able to track a user around several websites) but might occasionally be worth loading on a one-time basis. Avid SNS users might also be glad to see that the sharing buttons can easily be activated in similar fashion.

The only functional issues I have encountered so far were with some video streams, which may fail to load the video, due to advertising logic programmed into the video player. If such video is still considered worth seeing, it is again very easy to add a temporary exception, though sometimes this needs to be done by clicking the Ghostery icon in the menu bar and guessing the right service to unblock.

The long tail?

For individual users like me, Ghostery provides a convenient way to reclaim a certain degree of control over their data. One does not even have to object advertisement-funded websites or web analytics in general - for me at least, using the blocker is more of a statement that I object to the unlimited use of web use data as a commercial asset. And I cannot avoid noticing that - thanks to that little ghost icon with the number of blocked trackers - my appreciation has grown for websites that provide great value without broadcasting my data all over the internet.

Ghostery claims on their website that over 20 million users have the plug-in installed. General research suggesting that 10-20% of users block advertisements may also give an indication of the prevalence of privacy tools like this. It remains to be seen what impact a growing group of users with tracking blockers will leave on the online ecosystem. For now, the minority of users who go through the effort to set up their browsers as described is probably still too small to be taken seriously.