Chrome changes could put users at risk as trackers evade privacy crackdown

The Chrome browser will phase out third-party cookies next year

Credit: Anadolu

An incoming privacy crackdown from Google could put web users at more risk of hacking or identity theft, as tracking companies look to riskier alternative technology to track people across websites.

Security researchers said they had identified a leap in the use of alternatives to third-party cookies, the pieces of code currently used by advertising and analytics companies to identify users as they move around the web.

Google is planning to block the use of third-party cookies in Chrome, the world’s dominant web browser, next year. Advertisers and website publishers have said the move could cause chaos as they are no longer able to use people’s web histories to direct ads.

A group of security researchers including those from the Belgian university KU Leuven found that web advertising companies were increasingly turning to other tracking technologies, in response to similar cookie bans already in place.

The researchers, who described online tracking as a “whack a mole game”, found that one in 10 websites were already using a potentially more troubling form of tracking known as CNAME. It disguises the tracking technology as part of a website, thus giving it trusted access to users’ browsing data.

They found that malicious trackers could potentially hijack this process to make purchases with the victim’s credit card or clone the authentication credentials needed to log in to a private website. In almost all the cases, they found that data was being leaked from the websites due to the technique.

“User data is leaking , persistently and consistently, without user awareness or consent,” wrote Lukasz Olejnik, an independent security researcher who worked on the study.

The 22-month study found that the use of CNAME trackers among the top 10,000 websites has increased by 20pc in that time. Web browsers such as Apple’s Safari, Firefox and Microsoft Edge already block third-party cookies.

However, Google’s decision to do the same next year is likely to have a much bigger effect. Chrome is by far the world’s most popular browser, with a market share of around 50pc in the UK. Companies providing the tracking technology, such as Adobe, advertise the CNAME technology as an alternative when browsers block third-party cookies.

The Competition and Markets Authority is already investigating Google’s move to block third-party cookies in Chrome following complaints from web publishers and advertisers which say it will enhance Google’s own advertising business.

Google said this week that its advertising technology, which is used on millions of websites, would no longer support such types of personal tracking. However, other advertising companies have said they will use alternative tracking technologies.