没有第三方 cookie 的跨域用户跟踪？
既然大多数人都在禁用第 3 方 cookie 的情况下进行浏览，那么如何实施跨域网络跟踪服务（例如，行为广告）？
更明确地说，第三方跟踪服务如何识别对不同域的两个请求来自同一个人？
我想到了一些选择：
- 也许基于 iframe，通过将第三方跟踪服务的跟踪页面嵌入到各个网站中。此包含的跟踪页面应该能够为跟踪域设置第一方 cookie（？）。如果包含的页面对于每个跟踪页面都是唯一的，那么应该可以将请求与嵌入 iframe 的网站相匹配？！
- 基于IP + 用户代理（不可靠）的
- 浏览器指纹识别和时钟偏差 测量（我希望这在今天还没有被普遍使用）
- Cookie 切换，即将会话 ID 作为参数附加到各个页面之间的所有链接。然后，访问的页面可以使用与引用页面相同的 ID 设置自己的 cookie。问题是，如果没有通过单击这些准备好的链接之一来访问第二页，则此方法不起作用。
- 使用非传统 Cookie，例如 Flash Cookie。 也许其中一些怪物不遵守同源政策？
那么，它是如何完成的呢？
编辑：我刚刚注意到禁用第 3 方 cookie 只会阻止创建新的 cookie，但现有的 cookie 仍然很容易发送到第三方域。因此，人们可以以某种方式将用户重定向到第三方跟踪服务，该服务设置第一方 cookie，然后可以由网络错误读取。有趣的。
How are cross-domain web tracking services implemented (e.g., for behavioral advertising), now that the majority of people are browsing with 3rd party cookies disabled?
More explicitly, how does a third party tracking service recognize that two requests to different domains are coming from the same person?
Some options come to my mind:
- Maybe iframe-based, by embedding a tracking page from the third-party tracking service into various sites. This included tracking page should be able to set first party cookies for the tracking domain (?). If the included page is unique for each tracked page, it should be possible to match the request to the website the iframe is embedded into?!
- IP + user agent based (unreliable)
- browser fingerprinting and clock skew
measurements (I hope this is not already in common use today) - Cookie handover, that is, append the session ID as a paremeter to all links between the various pages. The visited page can then set its own cookie with the same ID as the referring page. Problem is, this does not work if the second page is not visited by clicking one one of those prepared links.
- Using non-traditional cookies, such as Flash Cookies. Maybe some of these monsters don't honor the same-origin policy?
So, how is it being done?
EDIT: I just noticed that disabling 3rd party cookies will only prevent the creation of new cookies, but existing ones are still readily sent to the third party domain. Hence, one could somehow redirect the user to the 3rd party tracking service, which sets a first-party cookie, which could then later be read by a web bug. Interesting.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
这取决于服务，但对于行为广告来说，仍然主要使用第三方 cookie 来完成。目前大多数人都不会阻止它们，因此它的效果很好，很有用。它们在主要浏览器中默认启用，并且没有多少人乱搞这些设置。上次我看到统计数据时，这个数字还不到 5%，但这可能会根据您所查看的用户的人口统计数据而有很大差异。在我所做的工作中，我通常看到 cookie 拒绝率要低得多。
无论如何，跟踪是一门不精确的科学，因为有多种因素可能会破坏人们与网络访问的链接（例如人们使用多种设备和浏览器的普遍趋势）。
我个人对这个主题的看法是，在线广告行业需要谨慎对待他们在这一领域所做的事情，因为公众对这个主题的看法似乎很混乱，可能会导致拒绝超过出于隐私原因是必要的。
It depends on the service but for behavioral advertising it's still mainly being done using third party cookies. Most people currently don't block them so it works well enough to be useful. They are enabled by default in the major browsers and not many people mess around with the settings. The last time I saw a statistic on it the number was less than 5% but this can vary considerably depending on the demographics of the users you're looking at. In the work I do I generally see much lower numbers of cookie rejection rates.
Tracking is an inexact science anyway as there are multiple things that can disrupt the linking of people to web visits (such as the common trend of people using multiple devices and browsers).
My personal opinion on the subject that I think you're getting at is that the Online Advertising Industry needs to be careful about what they do in this area because public opinion on the subject appears to be confused and could lead to a rejection of more than is necessary for privacy reasons.