Part III: Ad Tracking & Surveillance
There are important reasons for website administrators—including of government and school websites—to have limited insights into their users’ experiences. Yet, not all tracking and surveillance technology on the web is the same, and its unfettered and unregulated use should raise important questions. Indeed, one defining characteristic of ad(vertising) tracking and surveillance technology is that it mostly occurs in the background, where it remains opaque and barely understood by most parents, students, educators, journalists, and policymakers:
In Part III of Tracking: EDU, we examine the presence of ad tracking and online surveillance on state and local education agency websites. In general, state departments of education and school districts that choose to deploy these tracking tools on their websites take one or more of the following four approaches to doing so:
- Some self-host analytics software on their own servers and do not share the resulting data with third parties. Free, open source services like Matomo (formerly, Piwik), e.g., offer powerful insights under complete control of website administrators and integrate privacy-respecting features, such as: robust IP address anonymization, automated deletion of old visitor logs and archived reports, geolocation anonymization, and affirmative support for Do Not Track opt outs by website users.
- Other state and local education agencies are in value-added contractual arrangements with third parties that exchange custom analytics and user tracking services—including cloud hosting—for a monthly or annual fee. Depending on the nature of these agreements, user data may be kept private and under complete control of the education agency. Other contractual arrangements, however, may allow user data to be shared or combined with other third-party services or even sold to advertising services.
- The third type of user tracking service employed by state and local education agencies are third-party, cloud-hosted services that provide custom analytics and user tracking services at no cost to state and local education agencies. These cloud-hosted analytics services, dominated by Google’s Google Analytics platform, exchange site-specific insights into user behavior for the ability to track users as they traverse websites across the web and over time. More recently, these services have even set their sights on linking online behavior to behavior offline.
- The fourth type of tracking service implemented on state and local education agency websites—closely related to the third—are those that facilitate integration with popular social media platforms, primarily Twitter and Facebook.
The third and fourth categories, which share the characteristics of being free-of-cost to state and local education agencies to deploy, are dominated by Google via its Google Analytics service and related technologies (such as DoubleClick and Google Tag Manager), but also includes user tracking tools that facilitate deep integration with Facebook (Facebook Connect, Facebook Social Graph, Facebook Social Plugins, etc.) and Twitter (Twitter Button and Twitter Syndication).
Tools like Google Analytics are popular for their cost, ease of use in deploying, and powerful insights:
The data transmitted about users of websites that deploy advertising trackers—whether by Google, Facebook, or Twitter—is combined with data from other sources to create profiles that are used to target advertising and messages with incredible precision.
And, make no mistake, Google, Facebook, and Twitter are advertising companies. For the second quarter of 2017, 87 percent of Alphabet’s (Google’s parent company) $26 billion quarterly revenue was derived from advertising, 98 percent of Facebook’s $9.3 billion quarterly revenue was from advertising, and 85 percent of Twitter’s $574 million quarterly revenue was from advertising.
As advertising companies with large numbers of ‘marketing partners’ deploying their trackers on third-party websites, including state and local education agencies, these three companies promise an unprecedented ability to target ads and social messages designed to influence user behavior and beliefs. Google, for instance, brags:
Similarly, Facebook offers micro-targeting of ads and messaging, based on—among myriad other things—”activities people engage in on and off Facebook.” And, for its’ part, Twitter also offers “robust targeting capabilities.”
Experts, such as Wolfie Christl and Julia Angwin, have identified numerous ways that the data collection and profiling practices of each of these companies—enabled by the presence of online trackers (including analytics services and social media integrations) on third party websites—have led to large-scale manipulation and other profoundly negative consequences for society.
Analyzing Education Agency Websites
Various tools exist to identify advertising tracking and other user surveillance technologies that website owners, including state and local education agencies, deploy on their sites. These include:
- Browsers with built-in ad tracking/privacy controls, such as Brave (very easy to use)
- Web browser ad tracking/privacy extensions (generally easy-to-use and compatible with a wide range of popular web browsers), such as:
- uBlock Origin (coupled with uBlock Origin Extra for Chromium-based browsers), especially via its real-time log inspection (for tech-savvy users)
- Privacy Badger
- Lightbeam (the successor to the add-on ‘Collusion,’ for Firefox only)
- Ghostery (note: there are privacy concerns with this popular extension)
- Intercepting Proxies (for the tech-savvy only), such as OWASP ZAP
- Automated website scanners (for researchers), such as Tracker Tracker
It is important to note that there is a technological ‘arms war’ being waged with respect to tracking and online surveillance technology. The rise in popularity of consumer ad blockers – coupled with concerted efforts by some to intentionally try to break or illegally profit from the advertising technology ecosystem – has led online advertising companies (and those who rely on them for revenue) to employ increasingly sophisticated tracking techniques. With every new ad tracking innovation, privacy advocates and scammers respond. And the cycle repeats.
It should come as no surprise, therefore, that “tracking the trackers” is imprecise and can be dramatically under-reported through the use of some tools if and until they ‘catch up’ with the latest ad tech innovations. As Bill Fitzgerald writes in BuzzFeed and Methods for Tracking the Trackers; or This Is Hard, Chapter 9674 about the work he and Kris Shaffer have done on ad tech and tracking: “Tracking ad trackers is far more complex than it should be.”
This analysis of state and district education websites—conducted in October 2017—relied on results from Tracker Tracker, which “uses Ghostery to detect in a set of URLs a predefined set of ‘fingerprints’ of web technologies, such as social buttons and trackers, and outputs a list of technologies used per URL.” (The database used by Tracker Tracker for this analysis was last updated September 15, 2017 and only the homepage of each site was tested.) In addition, every state and select district website homepages in the sample were also reviewed manually to validate automated test results via the Opera Browser (Version 48.0.2685.50 running on Ubuntu 17.04 (x86_64; Unity7), running Ghostery for Opera version 18.104.22.168.
Note: This research represents a potentially dramatic under counting of trackers found on sites for several reasons: (1) The Tracker Tracker tool – while uniform in its approach – is designed only to identify a limited set of trackers; (2) the tool was set to only identify trackers on a site’s homepage, not the complete website; (3) the tool fails to work on a limited number of sites for technical reasons related to the fact that it cannot fully emulate a human visitor; and (4) the tool was set to only scan a target site once, not repeatedly, and may therefore miss trackers embedded in rotating elements or those targeted to specific categories of users.
Findings: State Department of Education Websites
- Virtually every state department of education website (49 of 51) has implemented some manner of ad tracking and/or online surveillance. Only two states appear to be using no trackers whatsoever on their state education agency website homepages: Maine and Utah.
- 4 state departments of education were found to use 5 or more unique trackers on the homepages of their websites, including: Arizona, Georgia, New York, and Tennessee.
- Over 90 percent of state departments of education (47 of 51) have partnered with one or more of the largest online advertising companies—Google, Facebook, and Twitter—to deploy one or more of their free-of-cost, cloud-based trackers (analytics services or social media integrations) on the homepages of their public websites. The only states not in such partnerships, include: Alabama (self-hosting), Maine (no trackers in use), New Jersey (alternative fee-for-service provider), and Utah (no trackers in use).
- One third of state departments of education (17) have partnered with two or more of the major online ad tracking companies to deploy their trackers on their homepages, including: Arizona, the District of Columbia, Florida, Georgia, Hawaii, Indiana, Iowa, Kansas, Maryland, Montana, New York, Oregon, Rhode Island, South Dakota, Tennessee, Vermont, and Washington.
- 84 percent of all state department of education websites (43 of 51) have partnered with Google to deploy their analytics service on their websites, which involves agreeing to grant Google’s persistent tracking cookies first-party ‘trusted’ status (as opposed to reporting such cookies as third-party trackers). The only states that do not appear to be utilizing Google Analytics on their state department of education websites are: Alaska, Alabama, California, Maine, New Jersey, New Hampshire, Montana, and Utah.
- Ad trackers from Twitter were found on over 35 percent of state department of education website homepages (18 of 51); Facebook ad trackers were found on 10 percent (5 of 51). Trackers from both advertising companies were found on the state department of education websites of: Arizona, Florida, Georgia, Montana, and Tennessee.
Findings: School District Websites
Nearly every school district website in the study sample (158 of 159) has implemented some manner of ad tracking and/or online surveillance on their homepage. Only one school district in the study sample appeared to be using no trackers whatsoever on their website homepage.
- 31 school districts (nearly 20 percent of the study sample) were found to use 5 or more unique trackers on the homepages of their websites. Excessively large numbers of trackers were found on the homepages of 30 percent of members of the Council of Great City Schools and 15 percent of the members of Digital Promise’s League of Innovative Schools.
- Every school district that has implemented trackers on their homepages (158 of 159 school districts in the study sample) has partnered with one or more of the largest online advertising companies—Google, Facebook, and Twitter—to deploy one or more of their free-of-cost, cloud-based trackers (analytics services or social media integrations) on the homepages of their public websites.
- 45 percent of school districts in the study sample (71 of 159) have partnered with two or more of the major online ad tracking companies to deploy their trackers on their homepages. Fully 50 percent of the members of Digital Promise’s League of Innovative Schools have implemented trackers from two or more of the major online advertising companies on the homepages of their websites; 42 percent of members of the Council of Great City Schools and 25 percent of the first cohort of CoSN’s Trusted Learning Environment Seal Initiative have done the same on their school districts’ websites.
- 90 percent of all school district websites (143 of 159) have partnered with Google to deploy their analytics service on their websites, which involves agreeing to grant Google’s persistent tracking cookies first-party ‘trusted’ status.
- Ad trackers from Twitter were found on over 36 percent of school district website homepages (58 of 159); Facebook ad trackers were found on over 25 percent (40 of 159).
In sum, the use of third-party ad tracking and online surveillance technology was found to be nearly universal on both state and local education agency websites. While the use of Google user tracking technology, including but not limited to the use of Google Analytics services, was found to be deployed on 9 of 10 state and local education agency websites, well over 40 unique tracking services were identified in the limited scans conducted by this study. Also commonly found on state and local education agency websites were ad trackers provided by Twitter and Facebook (though Facebook ad tracking was significantly more prevalent at the school district level: found on 25 percent of school district websites in the sample vs. on 10 percent of state department of education websites).
In the next part, we will examine the state of website privacy policies at state and local education agency websites.
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.