Under the Spotlight: Web Tracking in Indian Partisan News Websites
Vibhor Agarwal, Yash Vekaria, Pushkal Agarwal, Sangeeta Mahapatra, Shounak Set, Sakthi Balan Muthiah, Nishanth Sastry, Nicolas Kourtellis
UUnder the Spotlight: Web Tracking in Indian Partisan NewsWebsites
Vibhor Agarwal ★ 𝛼 , Yash Vekaria ★ 𝛼 , Pushkal Agarwal 𝛽 , Sangeeta Mahapatra 𝛾 ,Shounak Set 𝛽 , Sakthi Balan Muthiah 𝛼 , Nishanth Sastry 𝛿 , Nicolas Kourtellis 𝜁 𝛼 The LNM Institute of Information Technology, Jaipur, India 𝛽 King’s College London, London, United Kingdom 𝛾 German Institute for Global and Area Studies, Hamburg, Germany 𝛿 University of Surrey, Surrey, United Kingdom 𝜁 Telefonica Research, Barcelona, Spain 𝛼 {vibhor.agarwal.y16, yash.vekaria.y16, sakthi.balan}@lnmiit.ac.in, 𝛽 {pushkal.agarwal, shounak.set}@kcl.ac.uk 𝛾 [email protected], 𝛿 n.s[email protected], 𝜁 [email protected] ABSTRACT
India is experiencing intense political partisanship and sectariandivisions. The paper performs, to the best of our knowledge, the firstcomprehensive analysis on the Indian online news media with re-spect to tracking and partisanship. We build a dataset of 103 online,mostly mainstream news websites. With the help of two experts,alongside data from the Media Ownership Monitor of the Reporterswithout Borders, we label these websites according to their partisan-ship (Left, Right, or Centre). We study and compare user trackingon these sites with different metrics: numbers of cookies, cookiesynchronizations, device fingerprinting, and invisible pixel-basedtracking. We find that Left and Centre websites serve more cookiesthan Right-leaning websites. However, through cookie synchroniza-tion, more user IDs are synchronized in Left websites than Right orCentre. Canvas fingerprinting is used similarly by Left and Right,and less by Centre. Invisible pixel-based tracking is 50% more in-tense in Centre-leaning websites than Right, and 25% more than Left.Desktop versions of news websites deliver more cookies than theirmobile counterparts. A handful of third-parties are tracking usersin most websites in this study. This paper, by demonstrating intenseweb tracking, has implications for research on overall privacy ofusers visiting partisan news websites in India.
India represents the largest and the most diverse news media marketamong democracies, with more than 100,000 registered newspapersand 400 news channels in 22 official languages. The growth ofonline news has been the fastest in the emerging markets, withIndia ranking among the top ten globally when it comes to print andonline news media [21]. Unfortunately, this growth of online politicalcommunications has been accompanied by rising partisanship [9, 25].The mainstream news media as major agents of information andinfluence, become important here.This paper focuses on major news websites in terms of how theytrack their users. Tracking allows them to obtain rich information ★ Both the authors contributed equally to this research. Registrar of Newspapers for India: http://rni.nic.in/ about readers, which may serve their business interest in revenuegeneration through targeted ads, as well as their political interest insetting agendas. There have been US-based studies about partisanmedia mostly in terms of their polarizing effects [5, 16, 38] and afew on tracking [2, 24]. For India, while there have been a few workson the division in the news media along partisan lines [27], thereis a lack of comprehensive, data-driven research on news websitesand tracking behavior. Indian news media are a major source ofinformation for the population [34]. Their tracking behavior hassocio-political implications as they are, by and large, a trusted sourceof public information [22].In this work, for the first time, we provide a comprehensive studyof the news websites in India with respect to partisanship and track-ing of online users. We focus on the online platforms of the largestEnglish, Hindi, and regional language news media (including thosewith print or broadcast platforms and the digital only ones) that canreach more than 77% of India’s population , , making them vulnera-ble to tracking. We first identify the major Indian news publicationsbased on their circulation figures from the Registrar of Newspapersfor India (RNI) supplemented with Indian Readership Survey of Q42019. We then create a list of 103 news websites, curated primar-ily from Alexa [3] and Feedspot [14]. Secondly, with the help oftwo experts in political science and journalism, alongside data fromthe Media Ownership Monitor of the Reporters without Borders,which traces associations between the media and political partiesand corporate interests [28], we label the 103 websites accordingto their partisanship as Right-, Left-, Centre-leaning, or Unknown(methodology explained in Section 3).We address the following questions: RQ1: What is the extent oftracking across partisan news websites? RQ2: What kind of track-ing methods are used on users? To answer them, we measure theintensity of user tracking across partisan websites with simple andadvanced mechanisms: basic first and third-party cookies, cookiesynchronization, device fingerprinting, and invisible pixel-basedtracking (Section 4).We share our Dataset, OpenWPM Crawls, and Codes publiclywith the research community for reproducibility and extension of https://bestmediainfo.in/mailer/nl/nl/IRS-2019-Q4-Highlights.pdf Media Research Users Council:https://bestmediainfo.in/mailer/nl/nl/IRS-2019-Q4-Highlights.pdf Broadcast Audience Research Council, India: https://barcindia.co.in/ a r X i v : . [ c s . C Y ] F e b nder the Spotlight: Web Tracking in Indian Partisan News Websites Agarwal V. and Vekaria Y., et al.our work . From this study, we derive the following key findings(Section 5). The 103 Indian news websites studied have more than100K cookies, for an average of over 100 cookies per website, butseveral websites have much higher number of cookies. For example, ∼ Sandesh.com , by itselfand its third-parties. Left- and Centre-leaning websites serve more(median) cookies than Right-leaning websites. Desktop versions ofwebsites set more cookies than their mobile versions, with interestingexceptions. Third-party domain doubleclick.net is present in 86%of news websites; such ubiquitous presence allows the tracking of ahuge proportion of users’ browsing histories.In addition to the large numbers of cookies, we also find evidenceof practically every known advanced method of user fingerprinting.Around 18% of all distinct third-parties, and 25% of all distinct first-parties in our data are involved in cookie synchronization. Around50% of unique user IDs are synced across tracking domains throughcookie synchronization. Cookie synchronization is higher amongLeft-leaning websites and their third-parties than for Right- andCentre-leaning websites. Over 25% of news websites use devicefingerprinting, which is invisible to the user and invasive to theironline privacy. Around 25.7% of Left, 23.7% of Right, and 17.9%of Centre websites employ different fingerprinting scripts to trackusers. More than 2.5K invisible (1x1 pixel) images (i.e., 23% ofall sent images) are detected on news website homepages. Invisiblepixel-based tracking is employed more by Centre, followed by Leftand then the Right websites.
We briefly discuss here the partisan nature of Indian news websitesas well as online tracking techniques studied in literature.
Partisan nature of Indian news : This paper takes partisanship tomean an adherence to the political beliefs and identification witha political party or cause, manifesting positively as a civic idealof shared values or negatively as a pathology where loyalty to aparty’s ideology/values/goals may trump logic and tolerance to otherpolitical views [39]. While numerous political parties exist in India,the three broad strands of political worldviews correspond to threeprincipal political formations at the national level of Indian politics:“Left” represented by parties like the Communist Party of India(Marxist), “Right to Right-Centre” represented by the BharatiyaJanata Party, and “Left-Centre” corresponding to the Indian NationalCongress. As India is a highly diverse country with their politicalparties and media reflecting this diversity, we take Right-leaningnews media to correspond with the Right to Right of the Centrespectrum of ideologies, the Left-leaning news media to correspondwith the Left to Left of the Centre spectrum, and the Centre-leaningmedia to be positioned in between the Right-Centre and the Left-Centre. The growth of heightened political partisanship may havea dramatic impact on media behavior and their influence on publicopinion, especially if they intensely track users.
Online tracking ecosystem and measurements : With the riseof online information consumption, online platforms have attractedthird parties for online advertising [26, 30]. These advertisementsare strategically drafted and placed on websites to get more user at-tention including pop-ups and banners [26, 35]. These websites track Data and code available at http://tiny.cc/india-tracking users by injecting cookies at the users’ side [7, 10, 20, 37] for contentpersonalization and improving user experience. However, cookiesand other data are also shared with other third parties, raising privacyconcerns. Users have an option to accept or reject these third-partycookies, but many users are not aware of the consequences if theyaccept them. These websites also use more sophisticated trackingtechniques like cookie synchronization [1, 2, 11, 20, 31, 36], devicefingerprinting [11, 29], and invisible (1x1) pixel-based tracking [15].Since users are often unaware of their presence, such methods posea greater privacy threat to the websites’ visitors. Studies have shownthat some popular trackers like Doubleclick and Google Analytics(both Google trackers) can be present in up to 50% and 70%, respec-tively, of top one million visited websites [11]. Specifically, newswebsites have seen large volume of trackers and advertisements in-cluding political campaigns [2, 11, 32]. Among USA news websites,Right-leaning websites track users more and have high cookie syn-chronization within the partisan group websites [2]. Having said that,less is known about the tracking ecosystem of Indian news media,which has recently seen exponential growth in online consumption.There are studies in online engagement (including social media)showing polarization and media bias, but none covers the exposureof user data to the tracking world [8, 25, 33]. With our work, we aimto fill this gap by measuring the extent to which users are exposedto a high amount of web tracking, using the aforementioned fourtracking techniques. We also explore tracking on desktop and mobileplatforms in Indian news media with partisan leanings.
Here, we discuss the methodology followed to curate a list of topnews websites in India, including metadata crawled for each using
Feedspot [14] and
Alexa.com [3], to label these websites based ontheir political leanings (Sec. 3.1). Furthermore, in Sec. 3.2, we pro-vide details of our website traffic crawling using
OpenWPM [11, 12],a tool for desktop browser automation and crawling, and
Cook-ies.txt [17], a browser plug-in for mobile browser automation.
We follow the methodology outlined in Figure 1 (left part) for web-site list creation and partisanship labeling.
List Creation:
We first examined a list of 141 top Indian newswebsites on the Web (ranked as on 28 April 2020) provided byFeedspot [14]. This website, maintained by over 25 experts, is up-dated daily and covers a wide range of factors to rank and discoverthe most prominent online news websites in India. They curate web-sites whose publishers explicitly publish their content via Feedspot,as well as by monitoring search engines and social media throughin-house media tools. The next list of websites we studied is fromAlexa (29 April 2020) [4]. Alexa Internet, Inc., is an AmericanWeb traffic analysis company, whose toolbar gathers information ofaround 30 million websites across the globe, based on their internetbrowsing behavior and traffic patterns. Their website stores the dataand provides extensive analysis of the websites. From Alexa, we gota list of 49 top Indian news websites based on their online popularityand traffic. Some of them were common with the Feedspot data. Wecombined Feedspot and Alexa lists to obtain a list of 153 websites.nder the Spotlight: Web Tracking in Indian Partisan News Websites Agarwal V. and Vekaria Y., et al.
Interactions betweenPartisan Websites andWeb Trackers : jth Indian News Website with leaning = i
Indian News Websites ...
OpenWPM
SQLite DB
StatelessCrawlStatefulCrawl
Web TrackingEcosystem
Responses Cookie-basedTrackingHTTP(s)Tracking-relatedDataPolitical ScienceExperts
Labelling of Political-leaning
CookieSynchronization Device FingerprintingInvisible Pixel-basedTracking
Privacy Analysis
Sources of IndianNews Websites Curation
Verified by : Right Leaning Websites: Left Leaning Websites: Centre Leaning Websites
Central India
Figure 1: Our framework for labeling Indian news websites along partisan lines and collecting web traffic data for studying webtracking mechanisms. Colors represent party-leaning: Right=Blue, Centre=Yellow, and Left=Red.
A large portion of news consumption in India happens throughonline platforms (Facebook, Twitter, and Instagram) rather thanTV/Radio [34]. Therefore, we further augment our data by visitingeach website’s Facebook, Twitter, and Instagram pages for metadatacollection. After opening a particular website on Facebook, Twitteror Instagram, we performed (in April 2020) a breadth first searchon other ‘Indian news page recommendations’ shown in the right-side panel under the heading of “Related Pages” in Facebook, “Youmight like” in Twitter, and “Related Accounts” at the bottom inInstagram. We added to our list all Indian news media shown inrecommendations (as described above) while visiting the socialmedia pages of initially curated websites. In the second-iteration,we repeated this with newly collected news media from the first-iteration. We repeated this approach up to five times, by which weobserved that 90% of recommendations were already in our dataset.Using this approach, we added to our list 65 new Indian news medialeading to a total of 218 websites. Then we removed websites withinactive web pages and retained only those which had more than10K followers on at least one of the three social media platformsinvestigated (to ensure we only include the popular ones). Our finallist has 123 Indian news websites, spanning nine languages and 28states. All have an online website, which can be freely accessedover the internet. Out of 123 websites, 10.56% are popular as TVchannels, 53.66% are print media and remaining 35.78% only havea website (no TV channel or print media). We determine popularityin terms of viewership/readership in TV/print media.
Website Labeling:
In order to understand and categorize websitesbased on their partisan leanings, we undertook a three-step labelingprocess. First, we approached two political science and journalismexperts who manually coded the political leanings of these websites.This approach has been used by media monitors at Buzzfeed News in past studies to review political leaning in the US news ecosystem. Second, we checked for their partisan associations from Media Own-ership Monitor [28] including data on parent company. The labelingwas then done along a spectrum of Right (Conservative: Right toRight-Centre), Left (Liberal: Left to Left-Centre), and Centre (i.e.,less biased or a combination of both Left and Right, that is, whenthe same parent company has two ideologically different news sites)categories based on ownership and ideological association. 20 web-sites were discarded due to uncertainty in their leaning. And theremaining 103 websites were labeled with a partisan leaning andconsidered for our study. The inter-annotator agreement betweenexperts, measured by Cohen’s Kappa, is 0.97. Throughout the paper,we use this categorization, with short names: “Left” for “Left toLeft-Centre”, “Right” for “Right to Right-Centre”, and “Centre” for“Centrist or representing view-points of Right and Left”. Our datasetconsists of Left-, Centre-, and Right-leaning websites.
We start our data collection using OpenWPM [11] by performing fivestateless crawls, while visiting the websites’ homepages from CentralIndia between August 10, 2020 to August 30, 2020. Stateless crawlsmake each website visit independent. Parallel browser instanceswere launched to allow multiple, simultaneous crawls of these newswebsites from a single location. We performed such crawls acrossdifferent times and days to account for infrequent but unavoidablenetwork errors during each crawl. We recorded more than 100Kcookies in total.We also performed five time-variant and order-variant, statefulcrawls of the websites’ homepages from September 01, 2020 toSeptember 15, 2020. Stateful crawls are important since we want tostudy tracking mechanisms such as cookie synchronization (CS). CSrequires state information to be maintained across different websitesand visits, to detect if user IDs from previous visits are being syncednder the Spotlight: Web Tracking in Indian Partisan News Websites Agarwal V. and Vekaria Y., et al.in future visits and with other websites and their third-parties. Time-variance is applied by crawling on different days with days-longtime between crawls.Order-variant means the websites are visited in a shuffled order foreach crawl, for the results to be independent of the website ordering.In stateful crawls, no parallel browser instances are launched todetect third-parties that indulge in cross-site tracking of users.For 23 of the 103 websites, we also find manually that they serveseparate mobile versions. Therefore, we perform five additionalcrawls for these mobile websites to compare tracking behavior indesktop websites and their mobile counterparts. The crawling for mo-bile websites uses
Cookies.txt , a Firefox Plug-In [17] to get browsercookies information. We automate this process using Selenium .At first, a Firefox browser is set to not block any type of cookies.Further steps include opening a Firefox Mobile Emulator in an incog-nito mode, loading the plug-in, visiting the mobile versions of thewebsites’ homepages (e.g., m.timesofindia.com ), and storing cookiesinformation. In these five crawls, we store 1400 cookies in total. In this section, we detail the methodology to measure various track-ing methods used by Indian news websites and the associated ad-ecosystem – Figure 1 (right part).
To perform the cookie-based analysis, we use the javascript_cookies table of SQLite dump from the OpenWPM crawled data. This dataprovides information on all different types of cookies being set bydifferent domains. In addition, we use the Disconnect List , whichis extensively used by the research community to report knowntracking domains, and categorize them into eight distinct categories:Advertising, Analytics, Content, Social, Fingerprinting, Cryptomin-ing, Disconnect, and Unknown. We use this list to understand thedistribution of cookies across these categories. Cookie synchronization (CS) is a cross-site tracking mechanism thatenables two trackers to generate a detailed browsing profile of theuser, by sharing unique user IDs with each other. CS circumventsthe Same-Origin Policy (SOP) . Past works have studied CS indifferent contexts [1, 2, 11, 13, 20, 31, 36]). However, CS has neverbeen studied specifically for Indian news websites along partisanlines or with respect to the privacy implications that it has in thecontext of India. CS can be abstracted as a two-step process. Inthe first step, a unique user ID is exchanged between two TPs inthe form of HTTP(s) requests, responses, or redirects in an effortto learn the identity of the given user on the web. This ID canbe used to aggregate user information by a variety of means [19]through step two. In the second step, domains exchange or mergethe identified user’s data including browsing histories, browsingpatterns, and interests through a separate “data sharing channel” tobuild a complete, consolidated user profile. https://github.com/disconnectme/disconnect-tracking-protection SOP allows tracking domains to access only cookies set by them.
Privacy impact:
Tracking and targeting based on CS primarily helpsadvertisers [23], especially in programmatic (real-time bidding) ad-vertising, where data sharing and purchasing involves CS for bettertargeting [18]. As a result of CS, trackers are able to track a givenuser over a larger set of websites, where they may not even be em-beded as TPs. In fact, repetitive CS across websites can enrich aparticular user’s profile built by trackers, helping them to preciselytrack and target a user over time. Also, server-to-server exchangesof user data (CS step 2 above) have become common [11], enablingdeeper user profiling.
Methodology:
We capture CS for websites in our dataset using sim-ilar methodology of past studies [1, 13, 31]. We use the fundamentalstructure of the open-source python code from [1] (referred to as
CSCode hereafter) and make modifications to work for our scenario:unlike [1] that crawled data simultaneously on two machines be-fore analyzing them with
CSCode , we perform time-variant crawls(Sec. 3.2).For each crawl, we detect CS for each leaning group and a combi-nation of them. For example, while studying CS between Left andRight, we iterate over all distinct pairs of websites (w1,w2) where w1 is any website which is Left only, while w2 is Right only (with w1!=w2 and (w1,w2) ≡ (w2,w1) ). Since we have 39 Left and37 Right websites, there are 39x37=1443 total pairs. For intra-partycomparisons like Right-Right for instance, the total unique pairswill be computed as 𝐶 = . Next, for each pair, we considerall the HTTP(s) request, response, and cookies data related to w1 and w2 , and use CSCode to search for IDs synced between FPs andTPs while visiting w1 and w2 . We try all possible combinations ofwebsite pairs falling into different partisan lines, i.e.: • 𝑤 ∈ 𝑊 𝐿 and 𝑤 ∈ 𝑊 𝐿 ; 𝑤 ∈ 𝑊 𝑅 and 𝑤 ∈ 𝑊 𝑅 • 𝑤 ∈ 𝑊 𝐶 and 𝑤 ∈ 𝑊 𝐶 ; 𝑤 ∈ 𝑊 𝐿 and 𝑤 ∈ 𝑊 𝑅 • 𝑤 ∈ 𝑊 𝐿 and 𝑤 ∈ 𝑊 𝐶 ; 𝑤 ∈ 𝑊 𝑅 and 𝑤 ∈ 𝑊 𝐶 Since [1] is an older paper on CS, we validated
CSCode , as wellas various parameters used with recent works on CS [2, 20, 31,36]). We made the following key changes to ensure result correct-ness. First, for each URL,
CSCode extracts the top-level-domain(e.g., com from rtb.gumgum.com ) in [1]. However, it is not rele-vant to study CS across such top-level domains. Instead, we fol-low [31] and map all domains (from cookies, requests, responseURLs, etc.) to the high-level domains returned by the WhoIS tool (e.g., rtb.gumgum.com is mapped to gumgum.com as obtained fromWhoIS). Second, CSCode constraints minimum length of an ID tobe characters. However, [36] suggests to discard shorter IDs, sincethey do not contain sufficient entropy to represent a user ID. Wefollow [31] and use threshold of characters to minimize falsepositives. Interestingly, the shortest ID detected in our data is characters long. Third, we upgraded CSCode to support python3and dependencies.
Limitations:
CSCode gives a strict conservative ID detection withfewer false positives [1]. However, false negatives may occur whenID is shared in URL parameters in an encoded or encrypted format [6,31], or when ID strings are hidden inside the longer strings with non-standard delimiters. According to [1], the adversarial trackers couldhave short-lived cookies mapped to user IDs at the backend-serverto later on track the user. Such cases are not captured by our code. As [1], we consider cookies with expiration date ≤
30 days nder the Spotlight: Web Tracking in Indian Partisan News Websites Agarwal V. and Vekaria Y., et al.Hence, our results represent a lower bound on the actual CS takingplace in a real-time scenario.
Privacy impact:
A device or browser fingerprinting is a powerfultechnique that websites and TPs use to identify unique users andtrack their online behavior. This method collects information aboutthe user’s browser type and version, operating system, time-zone,language, screen resolution, and other settings. It can lead to seriousprivacy issues as users are oblivious to this happening, and can haveimportant implications on the way third-parties track users acrossthe Web without cookies in the future.
Methodology:
Our fingerprinting measurement methodology [11]utilizes data collected by OpenWPM, as described in Sec. 3.2. Inparticular, we detect different types of fingerprinting such as canvas,WebRTC, and audioContext, by checking webpages and the inter-faces they call, such as
HTMLCanvasElement and
CanvasRender-ingContext2D for canvas,
RTCPeerConnection , createDataChannel and createOffer for WebRTC, and AudioContext and
OscillatorNode for audioContext.
Privacy impact:
Invisible pixels are 1x1 pixel images that do notadd any content to the websites hosting them. TPs use these invisiblepixels to track user’s behavior on a website. Whenever a websiteloads, it sends subsequent requests to the server to load variousassets like images, ads, and other media on the website. To load theseinvisible (1x1) pixels on the websites, TPs send some informationusing the requests sent to retrieve the images. Crucially, the usersare unaware of the pixels’ existence on the websites and that thesepixels report user’s activity. Therefore, every such pixel represents athreat to the user’s privacy.
Methodology:
We follow [15], and for every crawl using Open-WPM, we store all HTTP requests, responses, and redirects, alongwith response headers, to capture the communication between aclient and a server. We then filter HTTP requests and responses bychecking the content-type in the response header. If the content-type is an image , the corresponding requests and responses are for images.Next, we check for content-length in the response headers to filterout only those HTTP requests and responses with content-length less than 1KB. This threshold is used to save storage space (i.e.,not to store all images but only probable 1x1 pixel images). In [15],they use 100KB threshold, but this is a very large size for such 1x1pixel images. In fact, we found all detected invisible pixels in ourdataset are less than 1KB in size. All such images are downloadedusing the image’s URL recorded in the filtered HTTP requests andresponses and then checked for the image’s dimensions. If bothheight and width of an image are 1 pixel, then the image is labeledas invisible pixel. The corresponding HTTP request/response, imageURL, content length, and third-party setting of each invisible pixelare recorded for further analysis.
In this section, we present our privacy analysis on the partisan web-sites of our dataset, and how they track users. We start with cookie-based tracking analysis (Sec. 5.1). We then study more complex
Figure 2: CDF of number of cookies for Left, Centre, and Right-leaning news websites, for their desktop and mobile versions (ifavailable). tracking techniques such as cookie synchronization (Sec. 5.2), de-vice fingerprinting (Sec. 5.3), and invisible pixel-based tracking(Sec. 5.4).
We analyze 100K cookies placed by FPs and TPs while visiting the103 Indian news websites. Figure 2 shows the CDF of the number ofcookies for all the Left-, Centre-, and Right-leaning news websitesavailable for desktop (103) and mobile (23) versions of the web-sites. The median number of cookies are 86, 84, and 92 for Left-,Right-, and Centre-leaning desktop websites, and 30, 42, and 36,respectively, for mobile websites. Therefore, in all political leanings,websites for desktop push more cookies to the user’s browser thanmobile versions (in median). In mobile versions, Centre and Rightwebsites track users more compared to the Left by 1.2 and 1.4 times(KS-value: 0.33, p-value: 0.007), respectively, and Right websitestracks more than Centre websites by 1.2 times (KS-value: 0.28, p-value: 0.054). In desktop versions, median numbers are close for allleanings. The Right websites have fewer cookies than the Left, andthe Left has fewer than the Centre. Interestingly, when consideringthe case of websites for desktop delivering a lot more cookies thanthe median, Left tracks more than the Right and Centre. For example, sandesh.com , which is in the Left to Left-Centre political spectrum,has the highest number of cookies: more than 1400 cookies (medianover five crawls). These cookies are set by the FP and TPs on thiswebsite. When desktop websites have cookies less than the median,the trend is reversed, i.e., Right tracks more than Left and Centre.The different versions for desktop and mobile platforms for thesame news website imply opportunity for collaboration or data leak-age between the two tracking ecosystems across different devices.In Figure 3, we compare the total number of cookies for each of the23 news websites with mobile and desktop versions. Most websites(20/23) set more cookies in their desktop as compared to their mobileversions. Interesting exceptions are
Times of India , Punjab Kesari ,and
Daily Hunt , which set more cookies in their mobile websites.More cookies indicate higher intensity of tracking as well as net-work activity (for storing, updating, and synchronizing said cookies)between the browser and server. Therefore, such (mobile) websitesnder the Spotlight: Web Tracking in Indian Partisan News Websites Agarwal V. and Vekaria Y., et al.
Figure 3: Median number of cookies in mobile vs. desktop ver-sions for 23 news websites, grouped by political leaning in de-creasing order of their Facebook followers. $ G Y H U W L V L Q J & R Q W H Q W 6 R F L D O $ Q D O \ W L F V ) L Q J H U S U L Q W L Q J 2 W K H U ' L V F R Q Q H F W / L V W F D W H J R U L H V R I 7 3 G R P D L Q V W K D W V H W F R R N L H V & R X Q W R I G L V W L Q F W F R R N L H V H W W L Q J 7 3 G R P D L Q V L Q D ) 3 / H I W : H E V L W H V & H Q W U H : H E V L W H V 5 L J K W : H E V L W H V Figure 4: For each first-party (FP), the distribution of countof distinct cookie-setting third-parties (TPs) by DisconnectListcategories. neither respect users’ privacy nor consider the mobile device’s lim-ited resources regarding power and bandwidth (data) consumption.We further investigate the difference in tracking between mobileand desktop, and study the unique TP domains that are presentin mobile, desktop, or both versions. On one hand, we find 68%of TPs exist in both mobile and desktop versions, allowing themto perform in-depth monitoring of (same) users, and linking themacross multiple devices. On the other hand, we find 16% of TPs existonly on mobile versions. For e.g., websites such as
Times of India and
Punjab Kesari have more than 50% of their TPs present in theirmobile versions and not in their desktop versions.We also study the type of TPs that set cookies on browsers, usingthe Disconnect List (DL). Note: we group together “Cryptomining”,“Disconnect” & “Unknown” as “Other”. Figure 4 shows the box-plotdistribution of each category. Statistically, with a KS-value 0.35(p-value: 0.0195), the largest portion of TP domains is advertisingand observed across all partisan websites, with Centre and then,Right being the most frequent. This is unsurprising since most newswebsites are funded by display ads. Interestingly, the second most
Figure 5: Top 10 TP domains setting cookies in Left, Centre, orRight-leaning news websites. Their presence on general web isalso plotted for comparison. frequent category (apart from “Other”) is TP domains performingfingerprinting (KS-value: 0.31, p-value: 0.0534). When comparedwith medians, we again observe Centre and Right websites beingmore intense with fingerprinting than Left. We investigate suchdomains further in Sec. 5.3.Finally, we look into the top TP domains involved in cookie-basedtracking. Figure 5 shows the top 10 TPs, per political leaning of thefirst-party website embedding them. We also compare the embedded-ness of these TPs with their appearance in the “general web”. Thisis to understand how much more or less intensely these TPs trackusers visiting Indian news websites compared to the general web,following the same strategy as in [2]. For general web, we crawl datafrom whotracks.me , the percentage of websites in which detectedthird-parties embed their cookies on the Web. We find these TPs aremore embedded in the Right-leaning websites than Left or Centre.Unsurprisingly, doubleclick.net is present in most websites in ourlist: 100% of Right, 80% of Left, and 82% of Centre websites, whilein general web, it is tracking only 21% of websites. Additionally,we look at the portion of cookies contributed by these TPs. We find pubmatic.com sets most cookies, contributing an overall 9% of cook-ies in our data. Also, the top 10 (2%) TPs set 42% cookies in ourdataset.
Takeaways:
Desktop versions of websites set more cookies than mo-bile. Also, Right- and Centre-leaning websites embed more Adver-tising and Fingerprinting TPs than Left-leaning websites, includingthe top entity doubleclick.net . In general, a handful of TPs providehigh coverage of users across all political spectrum of Indian newswebsites.
We compute cookie synchronization (CS) for all stateful crawls asdescribed in Sec. 4.2, and summarize results across different partisanleaning groups, as shown in Table 1.nder the Spotlight: Web Tracking in Indian Partisan News Websites Agarwal V. and Vekaria Y., et al.
Table 1: Statistics on cookie synchronizations detected betweenfirst party (FP) and third party (TP), or TP-TP domains, forall combinations of FP website pairs crawled, e.g., “Right-Left”means first a visit to a Right-leaning website and then a visit toa Left-leaning website (or vice-versa).
Leaning Avg. ID syncs Avg. ID syncs Avg. ID syncsGroup per unique ID per TP-TP pair per FP-TP pair
Right-Right 2.59 3.83 1.65Left-Left 4.67 4.45 2.23Centre-Centre 3.37 3.00 1.71Right-Left 4.75 4.06 1.45Right-Centre 3.45 3.45 1.63Left-Centre 5 L J K W 5 L J K W / H I W / H I W & H Q W U H & H Q W U H 5 L J K W / H I W 5 L J K W & H Q W U H / H I W & H Q W U H / H D Q L Q J E D V H G J U R X S V R I Z H E V L W H V $ Y H U D J H Q X P E H U R I V \ Q F V $ Y J 6 \ Q F V S H U X V H U , ' $ Y J 6 \ Q F V S H U 7 3 7 3 S D L U $ Y J 6 \ Q F V S H U 7 3 ) 3 S D L U Figure 6: Distributions of average number of CSs per ID, withrespect to political leaning groups and combinations.
In general, we see that any user browsing that involves visiting aLeft-leaning website (before or after a Left, Right or Centre website)leads to an elevated number of CSs per unique ID, in comparisonto only Right- or Centre-leaning websites (first column of Table 1).This is also the case for CSs detected between TP-TP pairs. TPs inCentre-Centre group seem to perform the least amount of such CSsin comparison to other groups. Finally, Left-Left and Left-Centrehave the highest CSs in FP-TP pairs in comparison to other groups.Right-related groups perform the least CSs.In Figure 6 we look at the distribution of CSs performed per pairof websites visited, per combination of partisan website groups. Witha KS-value of 0.0748 at 0.0029 significance, the highest number ofCS happens when Left-Left (i.e., intra-partisan) group of websitesis visited. Similarly, among the inter-partisan groups, Left-Centrewebsite visits involve high CS tracking (KS-test: 0.0431, p-value:0.0003)To further investigate the trackers involved in CS, we look at thedomains and observe that ∼
24% of FPs and ∼
18% of TPs are per-forming CS. In fact, we observe tracking domains like pubmatic.com ,which sync with other domains as high as 87 IDs. Additionally, someIDs are synced with multiple domains. For example, ID c3514a4b-11de-4cce-b428-365a3f6294b1-tuct65bc2e7 was found to be syncedacross 24 different tracking domains (from approx. 600+ TPs in ourdata). Moreover, a higher median number of TPs are performingCS in Left and Centre websites than Right. We also plot the top10 TPs most involved in CS in Figure 7. We observe that the top T o t a l C S y n c s a c r o ss c r a w l s LeftCentreRight p u b m a t i c liji t r u b i c o n p r o j e c t c a s a l e m e d i a g u m g u m t a b o o l a y a h o o e m x d g t d o u b l e c li c k r x . i o Top 10 Third-Party Domains involved in CS0510152025 % o f N e w s W e b s i t e s ( o f s a m e l e a n i n g ) Figure 7: Top 10 TPs involved in CSs, grouped by political lean-ing. Total CSs (top y-axis) is (TP-TP)+(TP-FP) CSs. cookie-setting domains are also present here in CS. In fact, pub-matic.com which is setting most cookies, is also performing mostCS and in most websites: ∼
25% Left, ∼
19% Centre, ∼
16% Right.Also, rubiconproject.com and doubleclick.net perform CS in 15-22%of websites.
Takeaways:
Detected user IDs are synchronized two to six times, onaverage, between one to five parties, on average, depending on thetype of pair entity involved (TP-TP or FP-TP). Same top domainssetting cookies, appear to do heavy CS as well, covering up to 25%of websites. Left-leaning websites and their TPs do more CS thanRight- or Centre-leaning ones.
In this section, we present results of different fingerprinting tech-niques like Canvas, WebRTC, and AudioContext fingerprintingbased on the methodology discussed in Sec. 4.3. Overall, we find 32distinct fingerprinting scripts set by 18 domains on 25.7% of Left-,23.7% of Right-, and 17.9% of Centre-leaning news websites. Also,the most dominant type of fingerprinting is Canvas. In particular, 26canvas scripts are found on 23 (18.7%) websites, from 13 uniquedomains; top three: jsc.mgid.com , s0.2mdn.net , and razorpay.com .Also, we find one WebRTC script set by adsafeprotected.com , andfour audioContext scripts in four websites. Takeaways:
Overall, 18-25% of FPs and TPs perform tracking usinguser device fingerprinting, with Left and Right adopting equally thistracking technology.
We find 11582 images on the website homepages, out of which 5121images have less than 1 KB size. Following the process outlined inSec. 4.4, we identify 2513 invisible (1x1) pixel images, i.e., 21.7%of all images found. Figure 8 shows the CDF of median numberof invisible pixels embedded in Left-, Right-, and Centre-leaningnder the Spotlight: Web Tracking in Indian Partisan News Websites Agarwal V. and Vekaria Y., et al.
Number of invisible pixels: Log CD F RightCentreLeft
Figure 8: CDF of median number of invisible pixels for Left,Centre, and Right-leaning websites. websites. These medians are 12, 10, and 15, respectively. The CDFshows more intense pixel tracking by Left and Centre, than Right.Figure 9 represents the top 20 FP websites having the highestnumber of invisible pixels, ordered by number of pixels found ontheir homepages. Out of the top 20, nine are Left, seven are Right,and four are Centre. Again,
Sandesh.com with its third-parties, ear-lier found to set most cookies, has the highest number of detectedinvisible pixels (261). Moreover, 138 distinct TPs are detected settingthese 2,513 invisible pixels.Figure 10 shows the top 10 TPs setting invisible pixels, ordered bytotal number of pixels set in the news websites. It also shows the totalnumber of pixels set per TP. Google-related properties ( googlesyndi-cation.com , google-analytics.com , and google.co.in ) dominate themarket, as the largest cumulative third-party domain that uses in-visible pixels to track users’ behavior on these websites. Interestingoutliers exist such as rtb.gumgum.com that sets 113 invisible pixelson just two Left websites. Takeaways:
Websites embed TPs performing invisible pixel-basedtracking, with Centre-leaning websites tracking 50% more intenselythan Right, and 25% more than Left. Top TPs in other trackingmethods (cookies, CS etc.) also perform heavy pixel-tracking, with
Google properties covering 60-80% of the websites.
In this work, and for the first time in literature, we have done anextensive, data-driven study on the Indian online news ecosystemwith respect to tracking by websites of mainstream news mediawith partisan leanings. The sample of news media studied havecomparable resources and reach.
Dataset:
One of our contributions from this study is the labeleddataset of 103 news websites (reaching 77% of Indian population)with their political leanings (Left, Right, and Centre), which wemake publicly available to the research community (along with allcrawls and coded methods). The aim of this paper is to show thetypes and extent of tracking done by mainstream news websites,which sets the essential foundation for future studies on the purposeof such targeting. Further, our findings on tracking in mobile anddesktop versions is crucial as more and more Indians have started toconsume news on mobile versions.
Figure 9: Top 20 news websites having invisible pixels vs. theirpolitical leanings.Figure 10: Top 10 Third-Party Domains setting invisible pixelson first-parties. Upper figure: total number of pixels set. Bottomfigure: % of websites embedding each third-party.Findings on user tracking:
Our study shows the extensive presenceof cookies irrespective of a news website’s partisan leanings: on av-erage, over 100 cookies are placed by first (FP) and third parties (TP)when visiting any of the news media websites we studied. In general,more cookies are placed in the desktop than the mobile platforms.Right-leaning websites place 1.2x and 1.4x the number of cookiesthan Centre- and Left-leaning ones in the mobile platform, whereasin the case of desktop, it is the opposite: Left tracks more than Centreand Right. We also find that 68% of TPs exist in both mobile anddesktop versions, allowing them to perform in-depth monitoring bylinking users across multiple devices. When analyzing the categoriesof TPs, we find that Right- and Centre-leaning websites embed moreadvertising and fingerprinting TPs than Left-leaning ones. Also, thender the Spotlight: Web Tracking in Indian Partisan News Websites Agarwal V. and Vekaria Y., et al.top TP doubleclick.net is present in 86% of FP news websites, show-ing the capability of one TP domain to dominate the tracking cultureacross all partisan news websites in India. Tracking with cookiesgoes beyond their mere presence on the browser. About one-fourth ofFPs and one-fifth of TPs are involved in cookie synchronization (CS).We detect user IDs being synchronized close to six times (on aver-age) between up to five parties, on average, depending on the type ofsyncing pair entity (TP-TP or FP-TP). We find that the Left-leaningwebsites and their TPs do more CS than Right- or Centre-leaningones. Although around 20% of all websites use canvas fingerprintingfor tracking purposes, there is little difference between Right andLeft (Centre is somewhat less) here. In terms of invisible pixel-basedtracking, TP domains in Centre-leaning websites track more thanLeft and the Left more than the Right. We note that the same topTPs in other tracking methods (cookies, CS etc.) are also at the tophere:
Google properties cover 60-80% of websites, underlining thedomination of the tracking market by one entity.
Absence of Privacy Laws: “The Wild Tracking East”.
Our resultson user tracking demonstrate that in the absence of explicit privacylaws in India, partisan websites employ different, and at times inva-sive tracking strategies to profile their visitors. Left-leaning websitesset more cookies, do more CS, and more pixel-based tracking, andLeft and Right are almost equally intense in terms of device fin-gerprinting. But what is interesting is the domination of just a fewTPs that track across the studied news websites irrespective of theirpartisanship. With a reach of 77% of population from these 103websites, the data tracked by one or few TP domains across partisanwebsites means that not only news websites, but even a handful ofTP domains can play a very crucial role by serving political andother targeted ads.
Implications for Privacy:
In India, if structured privacy laws are tocome into effect, online user privacy must be given high importance.Methods of tracking currently in place can not only expose a user’swebsite visits and browsing histories to the tracker, but also helptracking domains to aggregate the user’s browsing patterns andinterests. These can be used to generate in-depth, detailed profilesvia data synchronization through separate channels, which in turncan be exploited in numerous ways beyond just showing targeted ads.In fact, the differential tracking across websites of different politicalleanings, and the opportunities offered by the above mechanics, canallow propagation of user profiles to a large number of trackers overthe time. Therefore, there is scope for these profiles being used byvested groups for targeting a user and invading the user’s privacy,with the potential to influence the users visiting news websites.
Future Work:
The limitations of our present study along the fol-lowing main lines can be tackled in future works:
1. Vernacular diversity:
Our dataset was primarily focused on web-sites using English language (76/103 English, with 14/103 in Hindiand 13/103 in regional languages). However, the diversity of lan-guages in this country (apart from Hindi and English, India has22 scheduled languages and several state-based official languages)raises the question: Do different political leanings perform differenttype and intensity of tracking across languages and news websitesrepresenting them in the regional Indian space?
2. Wide & Complex Political Spectrum:
Templates derived from thereference points and cases in Western settings can only partiallyexplain the underlying political dynamics in India. Political parties in India typically defy linear binaries of Left and Right. In such acontext, the coverage bias and media effects are variable and arecontingent upon subject, personalities, and circumstances. Whilethe categorizations herein of “Left” and “Right” have been usedas a heuristic tool, future research should dive into the contextualspecifics of Indian political lines, and offer analysis with finer granu-larity of the political spectrum.
3. Fake News & Hyper-partisanship:
Recent rise in misinforma-tion from online, hyper-partisan news websites serving fake news,coupled with tracking of users for better profiling and political ad de-livery, erodes user trust in the online news ecosystem. It requires anin-depth study of the hyper-partisan Indian news websites to assesshow political websites violate their visitors’ privacy.
ACKNOWLEDGMENTS
N. Kourtellis has been partially supported by the European Union’sHorizon 2020 Research and Innovation Programme under grantagreements No 830927 (Concordia), No 871793 (Accordion), andNo 871370 (Pimcity). S. Set is a Marie-Sklodowska Curie (GlobalIndia ETN) Research Fellow at King’s College London. Authorsalso thank Arpan Gupta for helping in crawling. These results reflectonly the authors’ findings and do not represent the views of theirinstitutes/organisations.
REFERENCES [1] Gunes Acar et al. 2014. The web never forgets: Persistent tracking mechanisms inthe wild. In
Proc. CCS . 674–689.[2] Pushkal Agarwal et al. 2020. Stop tracking me bro! Differential tracking of userdemographics on hyper-partisan websites. In
Proc. WWW
Proc.WWW . 545–554.[6] Nataliia Bielova et al. 2020. Missed by Filter Lists: Detecting Unknown Third-Party Trackers with Invisible Pixels.
Proc. PETs
ACM TOIT
18, 4 (2018), 1–22.[8] Sunandan Chakraborty et al. 2018. Political Tweets and Mainstream News Impactin India: A Mixed Methods Investigation into Political Outreach. In
Proc. ACMCOMPASS (Menlo Park and San Jose, CA, USA). Article 10, 11 pages. https://doi.org/10.1145/3209811.3209825[9] Anupam Das and Ralph Schroeder. 2020. Online disinformation in the run-up tothe Indian 2019 election.
Information, Communication & Society (2020), 1–17.[10] Steven Englehardt et al. 2015. Cookies that give you away: The surveillanceimplications of web tracking. In
Proc. WWW . 289–299.[11] Steven Englehardt and Arvind Narayanan. 2016. Online tracking: A 1-million-sitemeasurement and analysis. In
Proc. CCS . 1388–1401.[12] Steven Englehardt and Arvind Narayanan. 2020. OpenWPM Framework. Avail-able at https://github.com/mozilla/OpenWPM, accessed on 08 May 2020.[13] Marjan Falahrastegar et al. 2016. Tracking personal identifiers across the web. In
International Conference on PAM . Springer, 30–41.[14] Feedspot. 2020. Top 100 Indian News Websites on the Web. Available athttps://blog.feedspot.com/indian_news_websites/, accessed on 28 April 2020.[15] Imane Fouad et al. 2018. Missed by Filter Lists: Detecting Unknown Third-PartyTrackers with Invisible Pixels. arXiv (2018), arXiv–1812.[16] R. Kelly Garrett et al. 2019. From Partisan Media to Misperception: AffectivePolarization as Mediator.
Journal of Communication (2019), 490–512.[17] Genuinous. 2017. Cookies.txt Chrome Extension. Available at https://chrome.google.com/webstore/detail/cookiestxt/njabckikapfpffapmjgojcnbfjonfjfg?hl=en, accessed on 17 May 2020.[18] Arpita Ghosh et al. 2015. To match or not to match: Economics of cookie matchingin online advertising.
ACM TEAC
3, 2 (2015), 1–18.[19] Roberto Gonzalez et al. 2017. The cookie recipe: Untangling the use of cookiesin the wild. In
TMA . IEEE, 1–9.[20] Xuehui Hu and Nishanth Sastry. 2020. What a Tangled Web We Weave: Under-standing the Interconnectedness of the Third Party Cookie Ecosystem. In
Proc. nder the Spotlight: Web Tracking in Indian Partisan News Websites Agarwal V. and Vekaria Y., et al.
WebScience
USENIX Security .[24] Tim Libert and Victor Pickard. 2015. Think you’re reading the news forfree? New research shows you’re likely paying with your privacy. Avail-able at https://theconversation.com/think-youre-reading-the-news-for-free-new-research-shows-youre-likely-paying-with-your-privacy-49694, accessed on 19Oct 2020.[25] Sangeeta Mahapatra and Johannes Plagemann. 2019. Polarisation and politicisa-tion: the social media strategies of Indian political parties. (2019).[26] Scott McCoy, Andrea Everard, Peter Polak, and Dennis F Galletta. 2007. Theeffects of online advertising.
Commun. ACM
Proceedings of W2SP (2012), 1–12. [30] Panagiotis Papadopoulos et al. 2017. If you are not paying for it, you are theproduct: How much do advertisers pay to reach you?. In
Proc. IMC . ACM, 142–156.[31] Panagiotis Papadopoulos et al. 2019. Cookie synchronization: Everything youalways wanted to know but were afraid to ask. In
WWW . 1432–1442.[32] Stylianos Papathanassopoulos et al. 2013. Online threat, but television is stilldominant: A comparative study of 11 nations’ news consumption.
JournalismPractice
7, 6 (2013), 690–704.[33] Adnan Qayyum et al. 2018. Exploring media bias and toxicity in south asianpolitical discourse. In
ICOSST . IEEE, 01–08.[34] Reuters India Digital News Report. 2019. Reuters India Digital News Report.Available at https://reutersinstitute.politics.ox.ac.uk/sites/default/files/2019-03/India_DNR_FINAL.pdf, accessed on 17 Oct 2020.[35] Till Speicher et al. 2018. Potential for Discrimination in Online Targeted Adver-tising. In
Proc. FAT , Vol. 81. 1–15.[36] Tobias Urban et al. 2020. Measuring the Impact of the GDPR on Data Sharing inAd Networks. In
Proc. ACM ASIA CCS .[37] Narseo Vallina-Rodriguez et al. 2016. Tracking the trackers: Towards un-derstanding the mobile advertising and tracking ecosystem. arXiv preprintarXiv:1609.07190 (2016).[38] Chris J. Vargo and Lei Guo. 2017. Networks, Big Data, and Intermedia AgendaSetting: An Analysis of Traditional, Partisan, and Emerging Online U.S. News.
Journalism & Mass Communication Quarterly (2017), 1031–1055.[39] Jonathan White and Lea Ypi. 2016.
