RegTrack: Uncovering Global Disparities in Third-party Advertising and Tracking

TL;DR

This analysis reveals that browser choice, user location, and hosting jurisdiction each shape tracking exposure in distinct ways, informing the design of privacy tools, regulatory enforcement strategies, and future measurement methodologies.

Abstract

Third party advertising and tracking (A&T) are pervasive across the web, yet user exposure varies significantly with browser choice, browsing location, and hosting jurisdiction. We systematically study how these three factors shape tracking by conducting synchronized crawls of 743 popular websites from 8 geographic vantage points using 4 browsers and 2 consent states. Our analysis reveals that browser choice, user location, and hosting jurisdiction each shape tracking exposure in distinct ways. Privacy focused browsers block more third party trackers, reducing observed A&T domains by up to 30% in permissive regulatory environments, but offer smaller relative gains in stricter regions. User location influences the tracking volume, the prevalence of consent banners, and the extent of cross border tracking: GDPR regulated locations exhibit about 80% fewer third party A&T domains before consent and keep 89-91% of A&T requests within the EEA or adequacy countries. Hosting jurisdiction plays a smaller role; tracking exposure varies most strongly with inferred user location rather than where sites are hosted. These findings underscore both the power and limitations of user agency, informing the design of privacy tools, regulatory enforcement strategies, and future measurement methodologies.

Figures (10)

• Figure 1: Overview of RegTrack. We fix browsers, locations, and consent states, then crawl websites from per-location VMs, spawning containers for each (browser, site, consent) configuration to collect HAR files and screenshots. Post-processing filters invalid pages with a multimodal LLM and labels domains as 1st-party, other 3rd-party, or A&T 3rd-party using public blocklists.
• Figure 2: Total number of A&T, by browser, after accepting all cookies in US-Ohio (plain) and France (striped).
• Figure 3: Comparison between the prevalence of websites displaying a banner (inner circle) and their contribution to total A&T traffic (outer circle). Red $\blacksquare$ denotes sites with a banner, and blue $\blacksquare$ denotes sites without.
• Figure 4: Average third-party A&T domains before/after accepting cookie banners, and from sites with no banner, for Chrome.
• Figure 5: Cross-border data flows showing first-party (left) and A&T (right) server locations based on IP geo-location.