Blacklight: A Real-Time Website Privacy Inspector

Previ­ous Work

How We Analy­zed Each Type of Trac­king

Third-Party Cookies

Key Logging

Session recor­ding is tech­no­logy that allows a third party to moni­tor and record all of a user’s beha­vior on a webpa­ge—in­clu­ding mouse move­ments, clicks, scro­lling down the page, and anyt­hing you type into a form even if you don’t click submit.

In a 2017 study, rese­ar­chers at Prin­ce­ton Univer­sity found that session recor­ders were collec­ting sensi­tive infor­ma­tion such as pass­words and credit card numbers. When the rese­ar­chers contac­ted the compa­nies in ques­tion, most respon­ded quickly and fixed the underlying cause of the data leak. Howe­ver, the rese­arch high­lights that these aren’t simply bugs but rather inse­cure prac­ti­ces that the rese­ar­chers say should be stop­ped enti­rely. Most compa­nies that offer session recor­ding say they use the data to provide their custo­mers—the websi­tes insta­lling the tech­no­logy—­me­a­ning­ful insights on how to improve a user’s expe­ri­ence on the website. One company, Inspect­let, descri­bes its service as watching “indi­vi­dual visi­tors use your site as if you’re looking over their shoul­ders.” (Inspect­let did not respond to an email seeking comment.)

What Black­light Tests

We define session recor­ding as the loading of a speci­fic type of script by a company that we know to be provi­ding session recor­ding servi­ces.

Black­light moni­tors the network requests for speci­fic URL subs­trings that appear only when session recor­ding is taking place, accor­ding to a list crea­ted by rese­ar­chers at Prin­ce­ton Univer­sity in 2017.

Some­ti­mes key logging is used as part of session recor­ding. In those cases, Black­light would correctly report the session recor­der as both key logging and session recor­ding because we obser­ved both, even though both tests are iden­tifying the same script.  

Black­light accu­ra­tely detects when a website loads these scripts—­but compa­nies typi­cally record only a sample of website visits, so not every user is being recor­ded on every visit.

Finger­prin­ting descri­bes a group of tech­ni­ques that try to iden­tify your brow­ser without setting a cookie. They can iden­tify you even if you block all cookies.

Canvas finger­prin­ting is a type of finger­prin­ting that iden­ti­fies users by drawing shapes and text on a user’s webpage and noting the minor diffe­ren­ces in the way they are rende­red. 

These diffe­ren­ces in font rende­ring, smoot­hing, and anti-alia­sing and other featu­res are used by marke­ters and others to iden­tify indi­vi­dual devi­ces. All of the major inter­net brow­sers, except Chrome, try to coun­ter canvas finger­prin­ting—eit­her by not fulfi­lling data requests for scripts known to have enga­ged in the prac­tice or by trying to stan­dar­dize users’ finger­prints.

The image below is an exam­ple of the type of canvas images used by finger­prin­ting scripts. These canva­ses are usually invi­si­ble to the user.

What Black­light Tests

We follow the metho­do­logy descri­bed in this paper by rese­ar­chers at Prin­ce­ton Univer­sity to iden­tify when the HTML canvas element is used for trac­king purpo­ses. The para­me­ters we use to iden­tify canva­ses that are being drawn for finger­prin­ting purpo­ses are:

• The canvas element’s height and width proper­ties must not be set below 16px.
• Text must be writ­ten to the canvas within at least 10 distinct charac­ters.
• The script should not call the save, restore, or addE­vent­Lis­te­ner methods of the rende­ring context.
• The script extracts and image with a toDa­taURL or with a single call to getI­ma­ge­Data that speci­fies an area with a mini­mum size of 16px × 16px.

We have not seen this in prac­tice, but it is possi­ble that Black­light could falsely label a legi­ti­mate use of the canvas that matches these heuris­tics. In order to account for this, the tool captu­res the image drawn by the script and renders this in the tool. Users should be able to deter­mine the use of canvas simply by viewing this image. A typi­cal finger­prin­ting script is shown above.                                                  

Ad trac­kers are tech­no­lo­gies that iden­tify and collect infor­ma­tion about users. These tech­no­lo­gies usually (but not always) appear with some level of consent from the website owners. They are used to collect website user analy­tics, for ad-targe­ting, and by data brokers and other infor­ma­tion collec­tors to build user profi­les. They usually take the form of Javas­cript scripts or web beacons.

Web beacons are small 1px by 1px images that are placed on a website for trac­king purpo­ses by third parties. Using this tech­ni­que, a third party can deter­mine beha­vi­ors inclu­ding when a parti­cu­lar user went to a site, the kind of brow­ser, and what IP address it used.

What Black­light Tests

Black­light checks all network requests against the Easy­Pri­vacy list, which contains URLs and URL subs­trings that are known to be used for trac­king. Black­light moni­tors the network acti­vity for requests being made to these URLs and subs­trings.

Black­light only records requests being made to third-party domains. It igno­res any URL patterns in the Easy­Pri­vacy list that match a first-party domain. For exam­ple, the EFF hosts its own analy­tics, and that results in requests to “https://anon-stats.eff.org,” their analy­tics subdo­main. If a user types in https://eff.org, Black­light does not consi­der calls to https://anon-stats.eff.org to be a third-party request.

We look up these third-party domains in Duck­Duck­Go’s Trac­ker Radar data set to find out who owns them, how preva­lent they are, and what kinds of servi­ces they provide. We only include third-party domains that belong to the “Ad Moti­va­ted Trac­king” cate­go­ries defi­ned in the Trac­ker Radar data set.

The Face­book pixel is a piece of code Face­book crea­ted that allows other websi­tes to target their visi­tors later with ads on Face­book. Common acti­ons that can be trac­ked by pixel include viewing a page or speci­fic content, adding payment infor­ma­tion, or making a purchase.

What Black­light Tests

Black­light looks for network requests from the site going to Face­book and looks in the URL query para­me­ters for data that matches the schema of what is descri­bed in the docu­men­ta­tion for Face­book’s pixel. We look for three diffe­rent types of data: “stan­dard events, ” “custom events” and “advan­ced matching.”

Google Analy­tics is the most popu­lar website analy­tics plat­form in use today. Accor­ding to whotracks.me 41.7 percent of web traf­fic is analy­zed by Google Analy­tics. While most of the func­ti­o­na­lity of this service is to provide deve­lo­pers and website owners with infor­ma­tion on how their audi­ence is enga­ging with their website, the tool also allows the website to make custom audi­ence lists based on user beha­vior and then target ads to those visi­tors across the inter­net using Google Ads and Display & Video 360. Black­light exami­nes inspec­ted sites for the presence of the tool, not how it is used.

What Black­light Tests

Black­light looks for network requests from the inspec­ted site going to a URL begin­ning with “stats.g.double­click” that also contains the “UA-” Google account iden­ti­fier prefix. This is descri­bed in more detail in Google Analy­tics deve­lo­per docu­men­ta­tion.

To deter­mine the preva­lence of trac­king tech­no­lo­gies on the inter­net both for context in Black­light and for accom­pa­nying news stories, we ran the 100,000 most popu­lar websi­tes as defi­ned by the Tranco List through Black­light. The data and analy­sis code can be found on Github . Black­light success­fully captu­red data for 81,617 of those URLs. The rest either failed to resolve, timed out on multi­ple attempts, or didn’t load a webpage. The percen­ta­ges listed below are for the 81,617 success­ful captu­res.

Some of the analy­sis goes beyond what appe­ars on the tool. The key findings from our survey are as follows:

• 6 percent of websi­tes used canvas finger­prin­ting.
• 15 percent of websi­tes loaded scripts from known session recor­ders.
• 4 percent of websi­tes logged keys­tro­kes.
• 13 percent of sites did not load any third-party cookies or trac­king network requests.
• The median number of third-party cookie loads was three.
• The median number of ad trac­kers loaded was seven.
• 74 percent of sites loaded Google trac­king tech­no­logy.
• 33 percent of websi­tes loaded Face­book trac­king tech­no­logy.
• 50 percent of sites used Google Analy­tics’ remar­ke­ting feature.
• 30 percent of sites used the Face­book pixel.

We clas­si­fied as Google trac­king tech­no­logy any network requests being made to any of the follo­wing domains:

• google-analy­tics.com
• Double­click.net
• Google­tag­ma­na­ger.com
• Google­tag­ser­vi­ces
• Googlesyn­di­ca­tion.com
• Google­ad­ser­vi­ces
• 2mdn.net

We clas­si­fied as Face­book trac­king tech­no­logy any network requests being made to any of the follo­wing Face­book domains:

• face­book.com
• Face­book.net
• atdmt.com

Black­light’s analy­sis is limi­ted by four main factors:

1. It is a simu­la­tion of a user beha­vior, not actual user beha­vior, and could thus trig­ger diffe­rent survei­llance respon­ses.
2. The inspec­ted website could be survei­lling user acti­vi­ties for benign purpo­ses.
3. False posi­ti­ves (possi­ble with canvas finger­prin­ting): Very occa­si­o­nally, legi­ti­mate uses of the HTML canvas match the heuris­tics Black­light uses to iden­tify canvas finger­prin­ting.
4. False nega­ti­ves: The stack tracing tech­ni­que used by Black­light’s Javas­cript instru­men­ta­tion might incor­rectly attri­bute a call to a window API method we are moni­to­ring to a library inclu­ded by a script. For exam­ple, if a finger­prin­ting script uses jQuery to do some calls, jQuery might end up on the top of the stack and Black­light will attri­bute the call to that instead of the script that’s actu­ally respon­si­ble. This possi­bi­lity was brought to our atten­tion by rese­ar­chers who revi­e­wed our metho­do­logy; we have not seen it occur in our tests or our survey of the 100,000 most popu­lar sites.

Regar­ding false posi­ti­ves, when Black­light visits a site, that site can see the request is coming from compu­ters hosted by Amazon’s AWS cloud infras­truc­ture. Because botnets are often run on cloud infras­truc­ture, our tool could trig­ger bot-detec­tion soft­ware on the website, inclu­ding canvas finger­prin­ting. This could result in false posi­ti­ves for the canvas finger­prin­ting test where the purpose of the test is not to track users but rather to detect botnets.

In order to test this, we took a random sample of 1,000 sites from the top websi­tes from the Tranco List that we had alre­ady run through Black­light on AWS. We ran this sample through Black­light soft­ware on our compu­ter locally at a resi­den­tial IP address in New York City. We conclu­ded that the results of a Black­light inspec­tion locally are very simi­lar, but not exac­tly the same, as running it on cloud infras­truc­ture.

Not all survei­llance acti­vity that is imper­cep­ti­ble to the user is neces­sa­rily mali­ci­ous. For instance, canvas finger­prin­ting is used for fraud preven­tion because it can iden­tify a device. And key logging can be used to provide auto­com­plete func­ti­o­na­lity.

Black­light does not attempt to iden­tify the intent of any parti­cu­lar trac­king tech­no­logy it finds.

Nor can Black­light deter­mine exac­tly how a website uses the data it collects on a user when loading session recor­ding scripts and moni­to­ring user beha­vior, such as mouse move­ments and keys­tro­kes.

Black­light does not check the terms of use or privacy poli­cies of the websi­tes it visits to see whet­her they disclose their survei­llance acti­vi­ties.

Input field values

The table below lists the values we program­med Black­light to type into input fields on websi­tes. We used the Mozi­lla auto­com­plete attri­bute write-up as our refe­rence. Black­light also checks for the base64, md5, sha256 and sha512 versi­ons of these values.

Auto­com­plete Attri­bute	Black­light Value
Date	01/01/2026
Email	black­light-head­lessthemar­kup [ punto ] org (black­light-head­less[at]themar­kup[dot]org)
Pass­word	SUPERS3CR3T_PASS­WORD
Search	TheMar­kup
Text	Idaa­a­a­Tar­bell
URL	https://themar­kup.org
Orga­ni­za­tion	The Markup
Orga­ni­za­tion Title	Non-profit news­room
Current Pass­word	S3CR3T_CURRENT_PASS­WORD
New Pass­word	S3CR3T_NEW_PASS­WORD
User­name	idaaaa_tarbell
Family Name	Tarbell
Given Name	Idaaaa
Name	Idaa­a­a­Tar­bell
Street Address	PO Box #1103
Address Line 1	PO Box #1103
Postal Code	10159
CC-Name	IDAA­A­A­TAR­BELL
CC-Given-Name	IDAAAA
CC-Family-Name	TARBELL
CC-Number	4479846060020724
CC-Exp	01/2026
CC-Type	Visa
Trans­ac­tion Amount	13371337