Blacklight: A Real-Time Website Privacy Inspector

Previous Work

How We Analyzed Each Type of Tracking

Third-Party Cookies

Key Logging

Session recording is technology that allows a third party to monitor and record all of a user’s behavior on a webpage—including mouse movements, clicks, scrolling down the page, and anything you type into a form even if you don’t click submit.

In a 2017 study, researchers at Princeton University found that session recorders were collecting sensitive information such as passwords and credit card numbers. When the researchers contacted the companies in question, most responded quickly and fixed the underlying cause of the data leak. However, the research highlights that these aren’t simply bugs but rather insecure practices that the researchers say should be stopped entirely. Most companies that offer session recording say they use the data to provide their customers—the websites installing the technology—meaningful insights on how to improve a user’s experience on the website. One company, Inspectlet, describes its service as watching “individual visitors use your site as if you’re looking over their shoulders.” (Inspectlet did not respond to an email seeking comment.)

What Blacklight Tests

We define session recording as the loading of a specific type of script by a company that we know to be providing session recording services.

Blacklight monitors the network requests for specific URL substrings that appear only when session recording is taking place, according to a list created by researchers at Princeton University in 2017.

Sometimes key logging is used as part of session recording. In those cases, Blacklight would correctly report the session recorder as both key logging and session recording because we observed both, even though both tests are identifying the same script.  

Blacklight accurately detects when a website loads these scripts—but companies typically record only a sample of website visits, so not every user is being recorded on every visit.

Fingerprinting describes a group of techniques that try to identify your browser without setting a cookie. They can identify you even if you block all cookies.

Canvas fingerprinting is a type of fingerprinting that identifies users by drawing shapes and text on a user’s webpage and noting the minor differences in the way they are rendered. 

These differences in font rendering, smoothing, and anti-aliasing and other features are used by marketers and others to identify individual devices. All of the major internet browsers, except Chrome, try to counter canvas fingerprinting—either by not fulfilling data requests for scripts known to have engaged in the practice or by trying to standardize users’ fingerprints.

The image below is an example of the type of canvas images used by fingerprinting scripts. These canvases are usually invisible to the user.

What Blacklight Tests

We follow the methodology described in this paper by researchers at Princeton University to identify when the HTML canvas element is used for tracking purposes. The parameters we use to identify canvases that are being drawn for fingerprinting purposes are:

• The canvas element's height and width properties must not be set below 16px.
• Text must be written to the canvas within at least 10 distinct characters.
• The script should not call the save, restore, or addEventListener methods of the rendering context.
• The script extracts and image with a toDataURL or with a single call to getImageData that specifies an area with a minimum size of 16px × 16px.

We have not seen this in practice, but it is possible that Blacklight could falsely label a legitimate use of the canvas that matches these heuristics. In order to account for this, the tool captures the image drawn by the script and renders this in the tool. Users should be able to determine the use of canvas simply by viewing this image. A typical fingerprinting script is shown above.                                                  

Ad trackers are technologies that identify and collect information about users. These technologies usually (but not always) appear with some level of consent from the website owners. They are used to collect website user analytics, for ad-targeting, and by data brokers and other information collectors to build user profiles. They usually take the form of Javascript scripts or web beacons.

Web beacons are small 1px by 1px images that are placed on a website for tracking purposes by third parties. Using this technique, a third party can determine behaviors including when a particular user went to a site, the kind of browser, and what IP address it used.

What Blacklight Tests

Blacklight checks all network requests against the EasyPrivacy list, which contains URLs and URL substrings that are known to be used for tracking. Blacklight monitors the network activity for requests being made to these URLs and substrings.

Blacklight only records requests being made to third-party domains. It ignores any URL patterns in the EasyPrivacy list that match a first-party domain. For example, the EFF hosts its own analytics, and that results in requests to “https://anon-stats.eff.org,” their analytics subdomain. If a user types in https://eff.org, Blacklight does not consider calls to https://anon-stats.eff.org to be a third-party request.

We look up these third-party domains in DuckDuckGo’s Tracker Radar data set to find out who owns them, how prevalent they are, and what kinds of services they provide. We only include third-party domains that belong to the “Ad Motivated Tracking” categories defined in the Tracker Radar data set.

The Facebook pixel is a piece of code Facebook created that allows other websites to target their visitors later with ads on Facebook. Common actions that can be tracked by pixel include viewing a page or specific content, adding payment information, or making a purchase.

What Blacklight Tests

Blacklight looks for network requests from the site going to Facebook and looks in the URL query parameters for data that matches the schema of what is described in the documentation for Facebook’s pixel. We look for three different types of data: “standard events,” “custom events” and “advanced matching.”

Google Analytics is the most popular website analytics platform in use today. According to whotracks.me 41.7 percent of web traffic is analyzed by Google Analytics. While most of the functionality of this service is to provide developers and website owners with information on how their audience is engaging with their website, the tool also allows the website to make custom audience lists based on user behavior and then target ads to those visitors across the internet using Google Ads and Display & Video 360. Blacklight examines inspected sites for the presence of the tool, not how it is used.

What Blacklight Tests

Blacklight looks for network requests from the inspected site going to a URL beginning with “stats.g.doubleclick” that also contains the “UA-” Google account identifier prefix. This is described in more detail in Google Analytics developer documentation.

To determine the prevalence of tracking technologies on the internet both for context in Blacklight and for accompanying news stories, we ran the 100,000 most popular websites as defined by the Tranco List through Blacklight. The data and analysis code can be found on Github . Blacklight successfully captured data for 81,617 of those URLs. The rest either failed to resolve, timed out on multiple attempts, or didn’t load a webpage. The percentages listed below are for the 81,617 successful captures.

Some of the analysis goes beyond what appears on the tool. The key findings from our survey are as follows:

• 6 percent of websites used canvas fingerprinting.
• 15 percent of websites loaded scripts from known session recorders.
• 4 percent of websites logged keystrokes.
• 13 percent of sites did not load any third-party cookies or tracking network requests.
• The median number of third-party cookie loads was three.
• The median number of ad trackers loaded was seven.
• 74 percent of sites loaded Google tracking technology.
• 33 percent of websites loaded Facebook tracking technology.
• 50 percent of sites used Google Analytics’ remarketing feature.
• 30 percent of sites used the Facebook pixel.

We classified as Google tracking technology any network requests being made to any of the following domains:

• google-analytics.com
• Doubleclick.net
• Googletagmanager.com
• Googletagservices
• Googlesyndication.com
• Googleadservices
• 2mdn.net

We classified as Facebook tracking technology any network requests being made to any of the following Facebook domains:

• facebook.com
• Facebook.net
• atdmt.com

Blacklight’s analysis is limited by four main factors:

1. It is a simulation of a user behavior, not actual user behavior, and could thus trigger different surveillance responses.
2. The inspected website could be surveilling user activities for benign purposes.
3. False positives (possible with canvas fingerprinting): Very occasionally, legitimate uses of the HTML canvas match the heuristics Blacklight uses to identify canvas fingerprinting.
4. False negatives: The stack tracing technique used by Blacklight’s Javascript instrumentation might incorrectly attribute a call to a window API method we are monitoring to a library included by a script. For example, if a fingerprinting script uses jQuery to do some calls, jQuery might end up on the top of the stack and Blacklight will attribute the call to that instead of the script that's actually responsible. This possibility was brought to our attention by researchers who reviewed our methodology; we have not seen it occur in our tests or our survey of the 100,000 most popular sites.

Regarding false positives, when Blacklight visits a site, that site can see the request is coming from computers hosted by Amazon’s AWS cloud infrastructure. Because botnets are often run on cloud infrastructure, our tool could trigger bot-detection software on the website, including canvas fingerprinting. This could result in false positives for the canvas fingerprinting test where the purpose of the test is not to track users but rather to detect botnets.

In order to test this, we took a random sample of 1,000 sites from the top websites from the Tranco List that we had already run through Blacklight on AWS. We ran this sample through Blacklight software on our computer locally at a residential IP address in New York City. We concluded that the results of a Blacklight inspection locally are very similar, but not exactly the same, as running it on cloud infrastructure.

Not all surveillance activity that is imperceptible to the user is necessarily malicious. For instance, canvas fingerprinting is used for fraud prevention because it can identify a device. And key logging can be used to provide autocomplete functionality.

Blacklight does not attempt to identify the intent of any particular tracking technology it finds.

Nor can Blacklight determine exactly how a website uses the data it collects on a user when loading session recording scripts and monitoring user behavior, such as mouse movements and keystrokes.

Blacklight does not check the terms of use or privacy policies of the websites it visits to see whether they disclose their surveillance activities.

Input field values

The table below lists the values we programmed Blacklight to type into input fields on websites. We used the Mozilla autocomplete attribute write-up as our reference. Blacklight also checks for the base64, md5, sha256 and sha512 versions of these values.

Autocomplete Attribute	Blacklight Value
Date	01/01/2026
Email	blacklight-headlessthemarkup [ punto ] org (blacklight-headless[at]themarkup[dot]org)
Password	SUPERS3CR3T_PASSWORD
Search	TheMarkup
Text	IdaaaaTarbell
URL	https://themarkup.org
Organization	The Markup
Organization Title	Non-profit newsroom
Current Password	S3CR3T_CURRENT_PASSWORD
New Password	S3CR3T_NEW_PASSWORD
Username	idaaaa_tarbell
Family Name	Tarbell
Given Name	Idaaaa
Name	IdaaaaTarbell
Street Address	PO Box #1103
Address Line 1	PO Box #1103
Postal Code	10159
CC-Name	IDAAAATARBELL
CC-Given-Name	IDAAAA
CC-Family-Name	TARBELL
CC-Number	4479846060020724
CC-Exp	01/2026
CC-Type	Visa
Transaction Amount	13371337