Tracking the Trackers

PRIVACY AND DATA protection laws in India are not as stringent as those elsewhere, especially in the West. Indian citizens on the whole don’t appear too concerned about their data footprint being accessed by those looking to make a profit from it. This collective disregard is taken for granted by even social media and messaging platforms, which treat data on Indian users as a property they have rights to use any way they wish. Examples are too many and WhatsApp is the latest to modify its privacy settings to give it greater control on user data in India.

A recent study by a team of global researchers is revelatory in this context: It measures the intensity with which user tracking happens on Indian news websites, and it turns out that we beat all other countries hands down. The overall Indian indifference about data privacy also raises concerns about invasive tracking that these scholars say calls for the Government and industry to work together to prevent misuse and abuse of user information.

The study, titled ‘Under the Spotlight: Web Tracking in Indian Partisan News Websites’, saw eight scholars based across India, the UK, Germany and Spain present their findings after a rigorous study of 103 news websites in India. In this first of its kind study, they found that user tracking on news websites is perhaps the highest in India: ‘The 103 Indian news websites studied have more than 100K cookies, for an average of over 100 cookies per website, but several websites have much higher numbers of cookies. For example, 1,400 cookies are set on the first-party Sandesh.com, by itself and its third-parties.’ The paper adds, ‘Left and Centre-leaning websites serve more [median] cookies than Right-leaning websites. Desktop versions of websites set more cookies than their mobile versions, with interesting exceptions. Third-party domain doubleclick.net is present in 86% of news websites; such ubiquitous presence allows the tracking of a huge proportion of users’ browsing histories.’ Doubleclick.net is owned by Google.

In plain words, a handful of third-party trackers present in 103 Indian news websites are potentially tracking 77 per cent of India’s population.

What exactly are the implications? These researchers tell Open in a joint response to queries, “The tracking is in general high, even more than the US and UK news media. This is highly concerning. Our paper shows exactly how intense is the tracking of users. This needs to be factored in while framing India’s forthcoming Personal Data Protection Bills which, given India’s prominence as a major online market, has to not just reflect the global standards of privacy but set its own high or higher standards. Digital news readers will only grow, and therefore, privacy has to be ensured from the get-go.” The eight authors of the study are Nicolas Kourtellis, Vibhor Agarwal, Yash Vekaria, Pushkal Agarwal, Sangeeta Mahapatra, Shounak Set, Sakthi Balan Muthiah and Nishanth Sastry.

Of the top 10 third-party trackers, including the one owned by Google, eight are from the US and two from Canada. News organisations place these trackers on their portals to attract ads and know user behaviour. The researchers are mindful of such priorities: “Analytics help a website understand its demographics and how users go from one page to another, so some of these analytics may also be translated into better website design for the users. By far the largest source and driver of third-party (TP) trackers, as well as consumers of their outputs, are ad networks.” They add, “In order for ads to be targeted to individual users, these trackers create detailed profiles of users across multiple visits to the same website, but also more dangerously across different websites (for instance, if a user visits a news website and then a shopping website, a TP tracker present on both websites can then identify the shopping interests of the user and help an advertiser deliver more targeted ads to such user).” Incidentally, all studies have shown that news websites have the highest number of trackers, even more than social media platforms and ecommerce websites.

This paper has been chosen to be presented at the high-level International Conference on Web and Social Media in June.

The study shows that the partisanship of the news website does not really matter when it comes to invasion of user privacy. Then, the question is how can users protect themselves?

“Indeed, what we find and show with our study is that both sides of the spectrum track users intensely with varying tracking technologies. Some tech is used more intensely from the left-leaning websites, and other tech is used by the right-leaning websites,” the scholars assert. They emphasise that, with India being a mobile-first country, users get most news links via message-sharing apps such as WhatsApp, Facebook, and so on. “So, users should be very careful while clicking links from unknown domains. Also, users can opt-in for using reliable, lightweight and frequently updated ad blockers and antivirus tools. Users should also campaign for better privacy laws in India. Moreover, they can also use privacy-focused browsers like Brave or Firefox Focus and can clean browsing history and cookies often,” they add.

They say that regulation is the answer. The one to emulate is the European Union’s General Data Protection Regulation (GDPR), which requires explicit and meaningful consent from users before tracking them. Sadly, such regulation is lacking in most jurisdictions around the world, the researchers say, adding, “We also find that in jurisdictions that do offer such protection, websites are employing dark patterns to elicit user consent to be set in ways that are disadvantageous to their privacies.”

Laws can work alongside ensuring privacy built into the design of news websites. However, the opt-in and opt-out clauses that are meant to give users control, are often complicated. “There should be a rule to make news websites come out with privacy policies that are easy for the users to read and understand, with a one-click option to opt-in/opt-out. Also, it is not just the Government but big tech companies who need to be brought on board to protect the privacy of people, as many of them host both information providing sites (for example, news media or social media platforms) as well as trackers. Google’s recent announcement that it will stop selling ads based on users’ browsing data across multiple websites by next year can be a gamechanger in the digital advertising and tracking industry,” they say.

The paper points out that in the absence of structured laws, user data on news reading patterns can be used to generate in-depth, detailed profiles via data synchronisation through separate channels, which in turn can be exploited in numerous ways beyond just showing targeted ads. It says the differential tracking across websites of different political leanings, and the opportunities offered by the above mechanics, can allow propagation of user profiles to a large number of trackers over time.

The concomitant danger is that these profiles may be used by vested groups for targeting a user and invading the user’s privacy, with the potential to influence users visiting news websites.

A recent rise in misinformation from online, hyper-partisan news websites serving fake news, coupled with tracking of users for better profiling and political ad delivery, erodes user trust in the online news ecosystem, the paper says. It also adds that an in-depth study of hyper-partisan Indian news websites to assess how political websites violate their visitors’ privacy is called for.

Yet, the most notable thing about this latest study, which will not immediately strike a chord with the general public being snooped upon, is the ubiquity of search engines and trackers that mine user data for profit. They may be having a field day today in India but, in future, internet surfers may wise up to the profit that a corporation makes from his or her data and demand to be paid for reading the news! And that’s definitely not good news for news producers.

About The Author

Ullekh NP

•