Booking a trip online? Here’s what tracking cookies could be gathering about your family.
A Mozilla product manager breaks down what cookies you might pick up just from booking a vacation.
In a blog post published today, Mozilla product manager Karen Kim detailed an experiment she conducted to see how many tracking cookies got installed in her browser when she researched a family trip for two adults and two children to Costa Rica.
By visiting multiple flight, hotel, and car rental comparison sites, and using Google to find sightseeing information, guidance on traveling with children, and product recommendations, Kim picked up a total of 1,620 cookies—around 20 percent of which were third-party tracking cookies from analytics and ad companies like Google and Facebook. Kim concluded that there was something “insidious” about the whole situation, saying: “In the act of planning a trip online without anti-tracking protection, someone out there now knows about the ages of your children, your partner’s interests, which family scuba lesson you’ve booked and with whom.”
While some cookies are crucial for keeping modern websites operating, others are a bit more nefarious. Good cookies track things like your preferred language and the contents of your shopping cart, and keep you logged in when you browse around a site. No one really has any issues with these kinds of cookies—they are a necessary part of the modern web. Without them, all but the most basic websites would cease to function.
Third-party tracking cookies, on the other hand, are the kind of cookies that privacy experts are most concerned about. Combined with other kinds of tracking, they allow companies and data brokers to create incredibly detailed profiles of your online activities. In Mozilla’s blog post, Kim said that the advertising companies would have been able to link the age of her children, her partner’s interests, and the tours that she booked together. In theory, the information would have been anonymous as it would have likely been linked to a user ID rather than her name and address—but these anonymous profiles are startlingly easy to de-anonymise.
Worse, though, is that the same companies could also have built profiles for her hypothetical kids. This process starts early. Period and fertility-tracking apps—which are currently under a lot of scrutiny due to the Roe V Wade being overturned in the US—essentially start collecting information about children before they are even born. As their parents search the web for answers to parenting questions, to book vacations, and everything else, that profile grows. Some companies are even gathering and selling data from children while they attend classes online. One pre-pandemic report found that by the time a child is 13, over 72 million pieces of personal data will have been collected on them. That figure is almost certainly higher now.
To counter this, Kim suggests using Firefox which has Total Cookie Protection—a special browser mode that silos cookies to prevent third-party tracking cookies following you around the web—enabled by default. However, most modern browsers now offer similar features. Safari blocks all cross-site tracking, including cookies, by default with a feature called Intelligent Tracking Prevention. Brave, Opera, and the new DuckDuckGo browser all use similar strategies to block third-party cookies while still allowing websites to function normally. Even Microsoft Edge has an option—but you will need to enable its stricter settings. The only real holdout is Google Chrome (unsurprisingly)—but even it is due to start blocking them next year.
Cookies as a tracking tool are on the way out. Soon enough, only users with old and obsolete versions of web browsers will be capable of being tracked using them. The bigger problem, unfortunately, is that tracking continues to evolve. Soon, there might be a whole range of alternative tracking tools that will need to be avoided. In particular, first-party tracking by the websites you visit is very hard to prevent. And while you can block cookies, it’s impossible to stop Google from knowing everything you do across Google properties like Gmail and YouTube. If you are logged into your account, it can see every YouTube video you watch, every document you share, and what you search for.
