The Creepies and the Crawlies: Cross device monitoring in web and mobile apps

Abstract

Cross-device tracking is a creepy practice where an ad tracking companyidentifies a consumer via one of their devices and uses that information toidentify another of their devices. I performed a novel analysis of 7,561 websites(automated), 16 websites (manual) and 25 iOS mobile apps (manual) todetermine the extent of cross-device tracking from a logged-in Facebook useron their devices. Of the websites that had login with Facebook (865 automatedand 16 manual), 28.3% of websites (250) and 80% of mobile apps (20) sentplaintext or hashed personally identifiable information (PII) to a third party thatwas not Facebook. Excluding Facebook, 32 third parties took PII on both awebsite and mobile app which gives those third parties the potential to conductcross-device tracking.Based on the potential harms of cross-device tracking I recommend thatthe US Federal Trade Commission enact policies to limit the negative effects ofcross-device tracking while still encouraging innovation in the space thatrespects the privacy and security of the consumer. Specifically I advocate thatthe FTC should 1) encourage that company’s privacy policies dictate exactlyhow and whether cross-device tracking will be implemented 2) work with theDAA to require companies to add good faith single opt-out capabilities frombehavioral tracking (and full single opt-out capabilities for top 10 ad spaceplayers) and 3) begin a robust education campaign to talk to consumers andimportantly, developers of mobile and web applications.