Measure The Web

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Classifying Cookies ======

Browser cookies are still the most commonly used method for tracking the session state of websites and the identity of visitors. According to prior studies, between 80% in 2012 {[roesner2012_detecting]} and 90% in 2019 {[solomos2019_clash,sanchezrola2019can]} of websites use cookies for user tracking, often without users' knowledge. While other stateless tracking technologies, such as [[Privacy:Fingerprinting]] or [[Privacy:Requests#classification_of_link_decorators|Link decorators]], exist, cookies remain the primary choice, with stateless methods typically used in combination with cookies. This trend persists despite the discontinuation of third-party cookies.

Below, we discuss two main classification methods: using datasets of labeled cookies or machine learning (ML) to classify cookies based on their context and request URL. But first some preliminaries.

===== First- and Third-Party Cookies =====

<WRAP important>A common misconception in research is that first-party cookies are always benign and third-party cookies are always intrusive!</WRAP>

First-party cookies are set by the domain the user is directly visiting, while all other cookies are considered third-party cookies. Although third-party cookies are significantly more used for tracking than first-party cookies, it is wrong to claim that first-party cookies are always benign and third-party cookies are always intrusive. First-party cookies can also track users or even be set by third parties using [[https://arxiv.org/abs/2102.09301|CNAME cloaking]] and there are many third-party cookies serving necessary functionality such as SSO.

The only difference is from the browser perspective. First-party cookies are accessible only from the first-party website's context, while third-party cookies are accessible across multiple websites that embed the same third party. But this implementation depends on the browser, with [[https://webkit.org/blog/8943/privacy-preserving-ad-click-attribution-for-the-web/|Safari]] and [[https://blog.mozilla.org/en/products/firefox/firefox-rolls-out-total-cookie-protection-by-default-to-all-users-worldwide/|Firefox]] setting the  storage for third parties for every website separately.

Munir et al. {[shaoor2023cookiegraph]} observed that 89.86% of the top-million websites use first-party tracking cookies. Of these, 96.61% are ghostwritten by third-party scripts embedded in the first-party context, and some are set by fingerprinting scripts.

===== Categories =====

Law((ePrivacy Directive, Article 5.3)) recognizes only two categories of cookies: those strictly necessary for the service and others. The industry, however, has developed various categorization schemes:

  * [[https://web.archive.org/web/20240619102040/https://www.cookielaw.org/wp-content/uploads/2019/12/icc_uk_cookiesguide_revnov.pdf|Cookie guide by UK’s International Chamber of Commerce (ICC UK) from 2012]] is the most widely adopted scheme, with the following four categories:((Categories description is adapted from {[bollinger2022automating]}. Refer to the guide for the original descriptions, which were found to be unclear to users {[lin2024it,jiwani2024crumbling]}.))
    * Strictly-necessary cookies:
      * Required to enable essential functions of the website, such as registration or shopping carts. They are always enabled to allow for a smooth and problem-free browsing experience.
    * Functionality cookies:
      * Enable non-essential convenience or usability features of a website, such as saving style preferences between visits. However, this may also include a minor number of tracking cookies. We recommend enabling these cookies to improve the user experience.
    * Analytics cookies:
      * Used to collect statistical information about how visitors use a website. This information is often used to measure the performance and guide the development of a website, but can include sensitive data and allow user tracking. Disable these if you are concerned over potential trackers from analytics services.
    * Advertising/tracking cookies:
      * Used to tailor advertisements to the viewer, help track the user and collect sensitive data of the user's browsing behavior, usually across multiple websites. Said data is then also often sold to third parties. We recommend rejecting these types of cookies to protect your privacy.
  * [[https://web.archive.org/web/20210520213158/https://iabeurope.eu/iab-europe-transparency-consent-framework-policies/#A_Purposes|12 purposes by IAB]], commonly used in CMPs implementing the TCF.

===== Datasets and Classification Services =====

Using datasets of cookies or online classification services has significant disadvantages: they cannot classify unseen data or assign one cookie multiple classes based on dynamic content. However, they offer advantages over ML methods, such as post-crawl classification of detected cookies.

<WRAP info>
Some websites deviate from the typical key-value (cookie name and cookie value) scheme by storing data directly in the cookie name. There are several cases, explained by following examples:

  * ''_gat_UA-<ID>'' and ''_ga_<ID>'' (Google Analytics cookies), where the ID is unique to the Google Analytics configuration but not dynamic per user.
  * ''AMCV_<ID>@<host>'' (Adobe Experience Cloud Identity Service cookie), where the ID is unique per user. Such cookie names cannot be found in databases due to their dynamic nature,, except for cases when the database stores patterns.
</WRAP>

We discuss publicly released datasets and two main online classification services: Cookiepedia and Cookiedatabase.


==== OneTrust and CookieBot Dataset ====

Many websites label cookies in their consent notices or privacy policies. Some CMPs unify the display of cookie lists, which enables large-scale scraping of these labels. Bollinger and Kubicek et al. {[bollinger2022automating]} crawled 30k websites using CMPs, collecting a dataset of 2.2 million declared cookies, with over 80% being third-party cookies.

The dataset is available [[https://zenodo.org/records/5838646/files/datasets.zip?download=1|here]] as part of [[https://zenodo.org/records/5838646|this publication artifact]]. Scraped cookie categories are in ''/04_Cookie_Databases/tranco_05May_20210510_201615.sqlite'', in the table ''consent_data'', with the following columns:

  * ''name'' and ''domain'': Identify cookies by name and domain.
  * ''cat_name'': Category defined by website operators via the CMP, often aligning with the 12 IAB TCF purposes.
  * ''cat_id'': Numeric representation of ICC UK categories: 0 = Strictly-necessary, 1 = Functionality, 2 = Analytics, 3 = Advertising/tracking.

Note that 80% of cookies are third-party cookies, the majority of these involve multiple entries for a given name and domain. However, these entries might assign contradicting labels, in fact, 7.2% of cookies have labels that do not match the majority label. You should therefore aggregate labels for given cookie and domain pair, and then pick the most popular category.

There will be soon a new release based on December 2024 crawl, reach Karel Kubicek if you are reading this text and wanting the data.

==== Open Cookie Database ====

[[https://github.com/jkwakman/Open-Cookie-Database|The Open Cookie Database]] is a crowdsourced effort to describe and categorize major cookies. As of January 2025, the published CSV file contains 2203 cookies classified into categories similar to the ICC UK guide:

  * Functional (also known as technical, essential or strictly necessary)
  * Personalization (also known as preferences)
  * Analytics (also known as performance or statistics)
  * Marketing (also known as tracking or social media)
  * Security (custom category, used only by a few tens of cookies, which are mostly strictly necessary according to ICC UK's guide)

==== Cookiepedia ====

[[https://cookiepedia.co.uk/|Cookiepedia]] is a commercial website by OneTrust, containing about 42M cookies. Categories align with ICC UK's four categories, Strictly Necessary, Functionality, Performance=Analytics, and Targeting/Advertising, read more about the [[https://cookiepedia.co.uk/classify-cookies|labeling process]]. OneTrust uses Cookiepedia to simplify cookie category assignments for their users (website operators), which however incentivizes labeling cookies as strictly necessary to avoid website breakage. This was observed by Bollinger and Kubicek et al. {[bollinger2022automating]} in Section 4.5.

To you Cookiepedia directly on the website, you can either select to search by website or cookie name. In the first case, Cookiepedia overviews of all the first- and third-party cookies, and in the latter, it shows the aggregated purpose across all websites with this cookie. This has limitations for first-party cookies, as different websites may use cookies with the same name for different purposes. For instance [[https://cookiepedia.co.uk/cookies/user_id|user_id cookies]] is classified as Strictly Necessary despite that many websites use it to track users.

You can [[https://github.com/dibollinger/CookieBlock-Consent-Crawler/blob/67434cce8cab56e7097568a4162d86ee0752295f/domain_sources/cookiepedia_domain_scraper.py|scrape Cookiepedia]] or download dataset of almost 1M cookies collected by {[shaoor2023cookiegraph]} as a [[https://github.com/cookiegraph/CookieGraph/blob/main/Feature%20Extraction%20and%20Classifier/code/labelling_scripts/cookiepedia.csv|CSV here]].

==== Cookiedatabase ====

[[https://cookiedatabase.org/#about|Cookiedatabase]] is an open alternative to Cookiepedia with 15.5k cookies operated by Complianz.io CMP. They use the following categories:

  - Statistics-Anonymous
  - Statistics/analytics (also known as performance)
  - Marketing/Tracking (also known as Ad-storage, or social media)
  - Functional  (also known as technical, essential or strictly necessary)
  - Preferences Cookies (in some jurisdictions known as functionality)

==== Cookiesearch ====

https://cookiesearch.org/ (no experience)
===== Machine-Learning Classification =====

Using machine learning to classify cookies, rather than relying on static datasets, addresses the limitation of classifying unseen data. Research indicates that ML methods may even outperform human classification. However, practical deployment of ML-based approaches faces challenges similar to those in ML-based advertising blocking: they are prone to adversarial attacks, may disrupt website functionality, and can potentially be used for fingerprinting. These limitations however does not hinder application of ML-based detection in research.

==== CookieBlock Model ====

In **Automating Cookie Consent and GDPR Violation Detection** {[bollinger2022automating]}, researchers developed an ML model to classify cookies according to the four ICC UK purposes. They scraped data from 30k websites using CMPs like OneTrust and CookieBot, collecting over 2 million cookies labeled by website operators.

The researchers extracted statistically rich, domain-specific features from the collected cookies. These features are derived from multiple attributes, including the cookie name, domain, value, expiry, and flags such as “HttpOnly.” For example, the entropy of a cookie's value is a key feature for identifying unique identifiers used for tracking, while the presence of a language locale often signifies cookies necessary for language settings.

The authors trained an XGBoost model, achieving an 87.2% accuracy (84.4% balanced accuracy). This performance is competitive with the Cookiepedia dataset when considering website operators' labels as the ground truth. The confusion matrices below provide a detailed comparison.

<WRAP center box>
{{privacy_cookies_cookieblock_vs_cookiepedia.png|Performance comparison of Cookiepedia to the automated XGBoost model, showing that CookieBlock model is competitive with human expertise according to Bollinger et al.}}
<div>Performance comparison of Cookiepedia to the automated XGBoost model, showing that CookieBlock model is competitive with human expertise according to {[bollinger2022automating]}.</div>
</WRAP>

Since the CookieBlock model requires instrumentation of cookie events, such as cookie updates, it must be applied during the crawling process. You can use OpenWPM's cookie instrumentation or install the CookieBlock browser extension to classify cookies. Follow these steps to set up CookieBlock in your crawler:

  - Install the CookieBlock extension in the same browser used by your crawler ([[https://chrome.google.com/webstore/detail/cookieblock/fbhiolckidkciamgcobkokpelckgnnol|Chrome]], [[https://addons.mozilla.org/en-US/firefox/addon/cookieblock/|Firefox]], or other browsers listed on the [[https://karelkubicek.github.io/post/cookieblock|CookieBlock page]]).
  - During installation, ensure all cookie categories and "Keep Track of Cookie History" are enabled. To be safe, open the cookie popup and click "Pause Cookie Removal."
  - Identify the extension ID by navigating to CookieBlock's settings and checking the URL: ''%%chrome-extension://<ID>/options/cookieblock_options.html%%''.
  - Export the profile and load it into your crawler.
  - After the crawl, collect all data from CookieBlock's database.

The following Python code illustrates these steps for a Selenium-operated Chrome browser. Note that while this step is manual, it is necessary to perform it only once.

<file python create_profile.py>
from selenium import webdriver  # requires the Selenium package

# Initialize the ChromeDriver with options to set the profile path
options = webdriver.ChromeOptions()
options.add_argument("--user-data-dir=./profile_dir")
driver = webdriver.Chrome(options=options)

# Install the extension in the browser, retrieve its ID, and then close the browser.
# Backup ./profile_dir directory.
</file>

Edit your crawler to load the profile before starting the crawl and to extract the cookie category data afterward:

<file python create_profile.py>
import json
from selenium import webdriver
import pandas as pd

# Before crawl: Initialize the ChromeDriver with the profile
options = webdriver.ChromeOptions()
options.add_argument("--user-data-dir=./profile_dir")
driver = webdriver.Chrome(options=options)

# Here is your crawler's logic
driver.get('https://google.com')  # example

# After crawl: 
# Extract the crawled data
EXTENSION_ID = 'fbhiolckidkciamgcobkokpelckgnnol'  # replace with your ID identified in step 3.

# Load extension settings
driver.get(f'chrome-extension://{EXTENSION_ID}/options/cookieblock_options.html')

# Extraction script
indexeddb_script = """
function getCookieBlockHistory() {
    return new Promise((resolve, reject) => {
        var request = window.indexedDB.open("CookieBlockHistory", 1);

        request.onerror = function(event) {
            reject("Error opening IndexedDB: " + event.target.errorCode);
        };

        request.onsuccess = function(event) {
            var db = event.target.result;
            var transaction = db.transaction(["cookies"], "readonly");
            var objectStore = transaction.objectStore("cookies");
            var data = [];
            objectStore.openCursor().onsuccess = function(event) {
                var cursor = event.target.result;
                if (cursor) {
                    data.push(cursor.value);
                    cursor.continue();
                }
            };

            transaction.oncomplete = function() {
                resolve(JSON.stringify(data));
            };

            transaction.onerror = function(event) {
                reject("Transaction error: " + event.target.errorCode);
            };
        };
    });
}

return getCookieBlockHistory().then(data => {
    return data;
}).catch(error => {
    return error;
});
"""
indexeddb_data = driver.execute_script(indexeddb_script)

try:
    cookies = json.loads(indexeddb_data)
except TypeError as e:
    print("Error:", e)
    cookies = []

df = pd.DataFrame(cookies)
df.to_csv('./cookies.csv', index=False)
</file>

Example output:

<code>
                 name                      domain path  current_label       label_ts storeId                                      variable_data
0                 AEC                 .google.com    /              0  1736265280414       0  [{'host_only': False, 'http_only': True, 'secu...
1               EUULE              www.google.com    /              0  1736265428337       0  [{'host_only': True, 'http_only': False, 'secu...
2                 NID                 .google.com    /              0  1736264250782       0  [{'host_only': False, 'http_only': True, 'secu...
3                 OTZ   chromewebstore.google.com    /              0  1736264250788       0  [{'host_only': True, 'http_only': False, 'secu...
4  TESTCOOKIESENABLED              www.google.com    /              0  1736265280594       0  [{'host_only': True, 'http_only': False, 'secu...
5       __Secure-ENID                 .google.com    /              0  1736265280415       0  [{'host_only': False, 'http_only': True, 'secu...
6                 _ga  .chromewebstore.google.com    /              2  1736264250780       0  [{'host_only': False, 'http_only': False, 'sec...
7      _ga_KHZNC1Q6K0  .chromewebstore.google.com    /              2  1736264250792       0  [{'host_only': False, 'http_only': False, 'sec...
</code>

Fields:
  * ''name'', ''domain'', and ''path'': identify the cookie
  * ''current_label'': ICC UK's four categories (0 = Strictly necessary, 1 = Functionality, 2 = Analytics, 3 = Advertising/tracking cookies)
  * ''label_ts'': timestamp of cookie creation
  * ''variable_data'': list of cookie changes, each containing:
    * ''http_only'', ''secure'', ''session'', ''same_site'': binary flags
    * ''expirationDate'': timestamp
    * ''value'': value of the cookie set in this change
    * ''timestamp'': change timestamp

==== CookieGraph Model ====

**CookieGraph: Understanding and Detecting First-Party Tracking Cookies** {[shaoor2023cookiegraph]} extends CookieBlock to resist adversarial modifications by avoiding easily mutable features (e.g., name) and leveraging network graph features to capture cookie usage patterns. This approach requires even further instrumentation, available only in their custom crawler.

Find the CookieGraph artifact at https://github.com/cookiegraph/CookieGraph/.

==== Authentication Cookies ====

**A Supervised Learning Approach to Protect Client Authentication on the Web** {[calzavara2015supervised]} investigates classifying cookies used for authentication. However, the code and model have not been published.

====== References ======

/*
To insert citations, follow these steps:

  - Verify the BibTeX entry exists in https://measuretheweb.org/literature/bibliography. If not, add it there.
  - Use {[CitationKey]} where needed in the text; it will render as a numbered reference.
  - Keep this section unchanged to display the bibliography.

If any step fails, a purple warning will appear on the preview page.
*/

<bibtex bibliography></bibtex>


/* This enables discussion under this article. */
~~DISCUSSION~~