0

If cookies store an unique ID to track the user on server-side and the content of this cookies is transmitted to the web site owner, how can I monitor / know what type of information are they collecting ? I have EditThisCookie installed but other than the cookie flags and some random string number (is it the unique ID?) I cannot find really useful / human readable information.

4

how can I monitor / know what type of information are they collecting

Not at all. Since the information that is actually associated to you is stored server-side, you simply have no way of knowing.

The only thing you see is this cookie, which is really nothing but an ID to know that you are you.

So, there's no human-readable information in the cookie, because it typically only stores some session ID.


You can, from the existence of a cookie, however, infer that the server is capable of tracking which sites on that server you've accessed. This gets a lot more involved as soon as there's, for example, advertisement or content-delivery networks involved. Whilst you see multiple, different cookies that belong to different domains/servers, behind the scenes, these servers will be collaborating to "piece together" a more comprehensive picture of your e.g. surfing behaviour.

Facebook is a prime example. There's many sites that embed some Facebook widgets on their pages. Now, Facebook knows what site their widget is embedded in, and can track you, because you've got a facebook cookie (at the very least from the moment you've logged in) and are connecting to Facebook's servers to get the widget's content. Now, Facebook gets a history of all pages with embedded facebook widgets you're visiting.

Google ads, doubleclick etc aren't any less tracking. I'd recomment the excellent Privacy Badger extension that tries to (heuristically) figure out which servers use cookies to identify you across different websites and (semi)automatically blocks cookies or loading content from these servers.

  • 1
    Don't know Fiddler. "All the server side data needs to make to the server, right?" No, wrong, your browser's not giving away any of your personal information aside from being the same user. You're being observed. To make an analogy: This is not someone stealing your private phone book to find out what friends you have (in which case you could simply stop people that run away from you, holding a phone book), but someone inherently having a GPS tracker on you to watch you move through the city. – Marcus Müller Feb 18 '17 at 11:42
  • 1
    Let that someone be facebook. Now, because you're logged into facebook, it knows that user with ID fs9gfqdgag is Adam86. It watches you walk through the city. You enter a fast food restaurant. The manager of the fast food restaurant might even get a call that says "hey, that guy who just walked in? He's also interested in skiing (because I saw him walk into a ski shop a minute ago), so for 5ct I can tell him about your new skiing burger". – Marcus Müller Feb 18 '17 at 11:47
  • 1
    None of the cookies you ever have contain the info "loves skiing"; that info is built from the sites you visit and your behaviour on there (how much time did you take between visiting similar sites, how often do you visit them, at what times do you visit them) and the info you contribute (maybe on Facebook you selected winter sports as interest) as well as statistics (maybe there's a high correlation between reading articles on thermal underwear and liking skiing). None of that info is contained in the cookie. It's just pieced together based on you publicly carrying an ID. – Marcus Müller Feb 18 '17 at 11:50
  • 1
    There's no "implementing cookies". Cookies are part of the HTTP spec. And they were designed to make a user recognizable on repeated visits to a domain, so yes, that's what you do with cookies, you recognize your users. – Marcus Müller Feb 18 '17 at 11:53
  • 1
    And using embedded elements, often not even visible, to allow ad and analysis networks to track your visitors, has been state of the art in online marketing and content publishing for at least the last decade. – Marcus Müller Feb 18 '17 at 11:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.