How bad has privacy become on the World Wide Web? Really bad, a new audit shows.
At least 87% of the world’s most-popular web domains engage in some form of digital tracking without you ever signing in, according to investigative journalism nonprofit The Markup. Many, it found, even covertly record the way you move your mouse or type. This is the hidden tech that lets companies learn who you are, what you like and even the secrets you look at online so they can tailor what you see, make ads follow you around – or even sell your information to others.
The good news: You can run a privacy check on any site yourself by using the free tool made for the audit, called Blacklight. Think of it, in The Markup’s words, as a “meat thermometer that you can stick into any website and get an instant reading on its level of creepiness.”
Blacklight was created by Surya Mattu, who wanted not just to stop website snooping, but a tool to see exactly what was going on when you visit sites with the default Google Chrome, the popular browser I once dubbed “spy software.”
Earlier this month, engineer and journalist Mattu ran Blacklight on a list of the 100,000 most-popular domains on the Web. Some of those addresses didn’t have a website on them or wouldn’t load. But of the more than 80,000 that he could scan, a grim picture emerged.
– Only 13% of sites didn’t load any ad trackers or third-party cookies, which are snippets of code sites leave in your browser to identify you.
– 15% of websites loaded technology called “session recorders,” the digital equivalent of recording videos as you surf a site, as one tech provider describes it. “For me, this was the biggest shock,” Mattu told me.
– 4% logged keys you typed into forms and boxes even without hitting submit.
– 6% of websites used a newer, harder-to-avoid form of tracking called canvas fingerprinting. (Last year, an investigation I worked on with privacy company Disconnect found fingerprinting on a third of the 500 most-popular websites.)
– 74% of sites loaded Google tracking technology, and 33% loaded Facebook trackers. It’s staggering to see the reach of those two Silicon Valley giants – it’s easy to forget they track you even when you’re not using their websites or apps.
Worse, Mattu’s numbers are likely conservative. On sites that ask you to accept cookies before they’re loaded, particularly common in Europe, Blacklight doesn’t click “accept” – so those sites registered as less creepy.
“I think this is just a reflection of how business operates when it goes unchecked,” said Mattu. “I don’t think there is some super-evil person sitting somewhere trying to collect everyone’s information. There is economic incentive for having this data, and over the last 15 years that incentive has only increased.”
Blacklight isn’t the perfect or only measure of privacy – it’s a cat and mouse game with the companies that develop tracking tech. But I hope The Markup updates its audit every year, so we can track how the web changes as more people become concerned about privacy, and new privacy laws attempt to outlaw some of the snooping.
What’s the point for non-techies? Use Blacklight quickly to see whether you want to trust a site – or evaluate the claims of a CEO who touts “privacy is a human right.” You can download your results, share anything shocking with me or with the smart team at The Markup.
Here’s what’s “normal,” for comparison: The median number of third-party cookies on websites is 3. The median number of ad trackers is 7.
What you find might surprise you. As of Sept. 24, pet food maker Purina notches almost every possible kind of tracking Blacklight detects, which Purina can use to learn about the demographics and interests of people, their brand loyalty and even to understand how they use their website. It has 14 ad trackers, 28 third-party cookies, fingerprinting and monitoring keystrokes and mouse clicks. (Tell Fluffy to be careful out there.)
Sensitive websites track people, too. Planned Parenthood has 42 third-party cookies, according to Blacklight.
Joe Biden’s website uses fewer third-party cookies, 10, than Donald Trump’s website, 18, according to Blacklight.
Microsoft uses 43 third-party cookies. Apple uses zero – in fact, it uses no tracking tech at all, according to Blacklight.
The Washington Post’s site uses six third-party cookies and allows Google Analytics to track you, but doesn’t have Facebook trackers, according to Blacklight. The New York Times has 12 trackers, the Wall Street Journal has 44 and The New Yorker has 152.
Just remember: You don’t have to give up all hope of preserving your privacy. There are steps you can take to protect your privacy on the web.
For most people, I recommend making one simple change: Switch browsers to one that includes automatic protection. I like Mozilla’s Firefox, but Apple’s Safari and the new version of Microsoft Edge also provide some protection, as do the privacy-focused DuckDuckGo and Brave.
But if you just can’t quit Chrome, or you’re forced to use it for work, there are ad-blocking and tracker-blocking plugins that can de-fang Chrome, including Privacy Badger and Ghostery.
And if you live in the state of California, there’s also a law called CCPA that gives you the ability to tell any business to stop selling your data.
