0

Ayenson et al. reported in their paper [Flash Cookies and Privacy II: Now with HTML5 and ETag Respawning][1] years ago that Kissmetrics used ETags to identify clients.

When looking at a site which uses Kissmetrics, for example http://www.up.edu.br/, I can see the ETag element in the response header when loading the Kissmetrics' tracking library.

Kissmetrics ETag

According to their [privacy policy][4], they do not use ETags for tracking purposes:

Kissmetrics’ Use of Cookies and Web Beacons

Cookies. Kissmetrics uses cookies (small text files that Kissmetrics stores locally on your computer) on our Client’s websites for one or more of the following purposes: to help identify unique visitors and/or devices; assess usage patterns and perform traffic analysis; identify visitor preferences; conduct A/B testing; diagnose problems with our servers, and otherwise administer the Kissmetrics Service. Kissmetrics does not use methods such as browser cache, Flash cookies, or eTags, for acquiring or storing information about end users web browsing activity on Client websites or otherwise.

However, I do see the exact same identifier when browsing in private mode.

So, are they using ETags again?

Improve this question
1
  • Hi and welcome to the site! There seem to be a link missing to the privacy policy. Not a big deal, though.
    – Anders
    May 15, 2019 at 14:08

1 Answer 1

Reset to default
3

So, are they using ETags again?

The Etag HTTP header is used for caching in HTTP, i.e. the browsers includes the given tag in the If-None-Match header of the HTTP request so that it only gets the response body if it has been changed compared to the previous access. Etag can be used for tracking but most uses of Etag care only about caching and not tracking. Thus just the existence of this header in the HTTP response is no indicator that it is used for tracking.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .