0

E.g. using the uMatrix extension to Firefox, one can see that third-party websites often pull in content from multiple Google-owned domains. These domains include adservice.google.com (and adservice.google.co.uk, etc).

adservice.google.com has access to cookies set for google.com. I think the only any technical reason to prefer using a sub-domain of google.com here, is the ability to track users who have logged in to Google Apps.

(I think other third-party domains like googleads.g.doubleclick.com or pagead2.googlesyndication.com do not have this ability. Searching, I find that there is also a domain googleadservices.com. Also, I found a post mentioning that the Doubleclick Floodlight was adding a call to adservices.google.com.)

Of course, this "tracking" could include the ability to configure your "advertising preferences" in your Google Account. But if your browser is already successfully block third-party tracking, then you will not mind if your browser is also blocking the method Google use to check if you opted out of "personalized" adverts :-).

Firefox has started to "block cookies from known third party trackers in Firefox". (I read somewhere this might be rolled out incrementally, but you can definitely opt-in to it).

Clicking through the blog post to the detailed documentation, there is currently a default blocklist, but you can also opt-in to "Level 2 block list. Blocks all detected trackers. Some websites or content may not load properly". The default is "Level 1 block list (Recommended). Allows some trackers so fewer websites break."

Question: by default, does Firefox block third-party adverts provided by Google from tracking through the Google Account you are logged in to? Or, has Firefox been forced to allow this in the default settings, to avoid breaking something?

Of course this could get into an "arms race", but that's what the nature of what Firefox has taken on here. So I understand any answers can only tell me about the current status; they can't make guarantees about what Google will be able to do in future.

  • 3
    please explain how this is a Unix or a Linux question – jsotola Jun 13 '19 at 17:20
  • @jsotola look at the tags. I chose which site to ask this on quite carefully. – sourcejedi Jun 13 '19 at 17:21
  • "Applications packaged in *nix distributions (note: being cross-platform does not disqualify)". – sourcejedi Jun 13 '19 at 17:25
  • 1
    @jsotola do you think it's worth deleting this and asking on superuser.com? – sourcejedi Jun 13 '19 at 17:27
  • This has been an arms race since cookies were invented. Typically advertisers (of which google is one) don't like ad blockers, likewise those who data-mine your activity on the web don't like tracker blockers, they drive down business. To that end, google are very shy about telling you how they track you for fear someone will block them. Thus I think you will struggle to find an answer referencing the current state-of-the-art from google's side. However google notoriously can / will track based on a large number of diverse data points. This enables cross-device tracking. – Philip Couling Jun 13 '19 at 17:42
0

[Update on 2019-07-06: I am not seeing third-party cookies from adservice.google.co.uk when I re-tested today. This domain still does not appear on the list of trackers used by Firefox, despite me reporting it to Disconnect at the time. If I notice Firefox letting though any "third party cookies" from Google again, I will try to contact Firefox.]

My Firefox appears to be blocking third-party cookies from adservice.google.com. But not blocking the cookies from adservice.google.co.uk.

I have Firefox 67.0, installed from the Fedora Linux package. The current date is 2019-06-13.

I visited a test site, and clicked on the shield in the left hand side of the address box. Under "Content Blocking", I clicked on "Blocking Tracking Cookies". Under "Tracking cookies", it shows that cookie(s) from adservice.google.com were blocked.

Further down, under "third party cookies", it shows that there were cookie(s) from adservice.google.co.uk that were not blocked by Firefox's tracking protection.

Further confusion

From Firefox's documentation:

By default, Firefox protects you from being tracked in private windows using a list of known trackers provided by Disconnect. Firefox allows some trackers so websites can function properly. You can change your settings to block trackers all the time, to block trackers from Disconnect’s level 2 list, or to not block any trackers at all.

The link goes to https://disconnect.me/trackerprotection. It gives some description, including:

Trackers we block

“Trackers” are those services that we’ve identified and determined meet the definition of tracking above.

Disconnect compiles several lists of trackers. The open source list of trackers that power our browser extensions, Firefox’s private browsing mode, and many other popular privacy tools can be found here, along with a change log and notes. Or you can view a simple list of blocked trackers here. Example changes to this tracker list can be seen below. Please submit feedback here.

It is not obvious to me where the "level 1" and "level 2" blocking is distinguished.

I cannot find that the current block list includes the specific domains adservice.google.com or even google.com. uMatrix currently shows me third party cookies by google.com. uMatrix does not seem to show me any third party cookie by adservice.google.com or adservice.google.co.uk.

So even what uMatrix is showing me seems to be something a bit different from what the Firefox built-in interface shows me. Confusing.

And I can't make sense of what the built-in interface shows me in terms of what I see in the open-source blocklist.

I also think I can see an entry on the block list for google.co.uk, which uMatrix shows me is setting third party cookie(s).

One possible explanation for some discrepancies might be if the linked "open source list of trackers" is not used by Firefox any more. And instead, Firefox has licensed a more complex system from Disconnect on commercial terms. This seems relatively odd though - either Firefox would be getting something more advanced than the branded Disconnect extension for Chrome, or the bit about Disconnect browser extensions using the open source list is also out of date. So far it seems equally likely that I'm mis-understanding something somewhere :-)

Further background - how Disconnect.me lists can "block" google.co.uk cookies without massive risk of breaking google.co.uk as a first-party site

README.md at https://github.com/disconnectme/shavar-prod-lists -

Tracking protection technically works by blocking loads from blocked domains. But the Entity List conceptually changes it, so that it is no longer about domains, but about the companies. If you are visiting a website, engaged 1-on-1 with them, Tracking Protection will block the other companies who the user may not realize are even present and didn't explicitly intend to interact with.

Tracking Protection blocks loads on the blacklist when they are third-party. The Entity list whitelists different domains that are wholly owned by the same company. For example, if abcd.com owns efgh.com and efgh.com is on the blacklist, it will not be blocked on abcd.com. Instead, efgh.com will be treated as first-party on abcd.com, since the same company owns both. But since efgh.com is on the blacklist it will be blocked on other third-party domains that are not all owned by the same parent company.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.