Tracking Fireworks

In two articles, I had videos from YouTube embedded on this site, Toxic and Ex Machina. While tinkering with the theme-switching, I had the network monitor of my browsers open to see what’s going on with the timing, and… whoa, whoa, I thought, what’s going on here?! More accidentally than on purpose I discovered that YouTube and Google injected massive tracking on my site for these articles. Thinking of it now, it should not have surprised me. Silly me that I didn’t think about it before.

Embedding a video is like showing a complete third-party webpage within my own page, ie. it’s a full HTML-document, with <head> and <body> sections, hence YouTube can put anything there. And they do. I have since removed the embedding, just offering links to watch the video on their site. Not that they don’t track you there, but at least on my site I don’t want to contribute to this data collection and people tracking racket.

Only embedding the YouTube video already runs a dozen or so trackers when the page is opened. As long as you don’t start and watch the video, there are trackers that “call home” on a periodic basis, technically fetching small images of a few bytes, but transferring data using the GET parameters of the request. There are also POST requests.

The firework starts, as soon as you start the video. The trackers go wild. I assume they report back how far you watched the video and data like that. When you pause the video, again a burst of calls home.

Of course, I could assume that this is all for purely technical reasons, to control the streaming, to monitor and report back about the streaming quality. I am sure, some of it is. Maybe even most. But calls back to or very likely are not for technical reasons.

I quickly ran some checks on other major websites, loading the front page:

  • New York Times: 26 trackers, 54 data points collected on load.
  • The Guardian UK: 25 trackers, 73 data points collected on load.
  • NZZ: 19 trackers, 47 data points collected on load.

YouTube is in good company here. What I really was not aware of is that as long as you stay on these sites, there are calls “home”, like a heartbeat. And when loading a page, long after you already have started reading, the initial trackers still run for five, ten, or more seconds.

To be clear, I don’t talk about advertising. I understand that these companies have to earn money somehow. It’s the tracking and data collection that’s nefarious.

As DuckDuckGo describe it:

Tracker networks aggregate your web history into a data profile about you. Major tracker networks are more harmful because they can track and target you across more of the internet.

Ah, by the way, the video service Vimeo does not have this problem with embedded films. Check out Tian Xiang. There’s only my tracker, the one I told you about and is also explained here. Vimeo does not inject any trackers, no calling home. Nothing. Pure technical interaction between client and server when you play the video.

But Vimeo is a paid service. I think this exemplifies very well to which point today’s “free” services all over the Internet have taken us. As I said before, don’t like. And install tracker blockers.

    • Image: Tamarin Bay, 1 Jan 2019