A soon-to-be-published study by researchers at Princeton University and KU Leuven University in Belgium recently uncovered a new, virtually undetectable form of tracking called canvas fingerprinting. This tracking code, written primarily by AddThis, works by telling your browser to draw a hidden image that can be used to uniquely identify each user’s device. These fingerprints are then used to build profiles of users based on their browsing history, which in turn influences the kinds of ads and other content those users see. The researchers found code for this tracking on about 5% of the top 100,000 websites, especially embedded in social media sharing tools.
When interviewed about canvas fingerprinting, AddThis CEO Rich Harris said that the company began testing it as a possible alternative to cookies, and that they only use the data for internal development and not ad targeting. But AddThis isn’t the first company to explore this kind of tracking. A 2012 study at UC San Diego noted the possibility of using canvas fingerprinting to assign unique fingerprints, and other programmers have experimented with creating canvas fingerprinting code. This kind of tracking may very well become more prevalent and could be used by other advertisers and companies. Built-in browser privacy settings won’t prevent canvas fingerprinting, but Disconnect blocks it by default. We already block AddThis and Ligatus (the two most popular canvas fingerprinting trackers), and we’re updating our block list to include the other companies identified in the study. The nature and method of online tracking is constantly evolving, and we’re always adapting to meet the ever-changing needs of our users. Privacy matters, and we put you back in control of your online data.