Presentation at PETS 2026
The Privacy Enhancing Technologies Symposium (PETS) is an annual international forum for research on technologies that protect privacy and personal data. Its scope includes anonymous communication, privacy-preserving machine learning, cryptography, data protection, surveillance resistance, usable privacy, and the legal and societal dimensions of privacy technologies.
Marco Squarcina and Matteo Maffei contributed to a study on improving web tracking detection that was presented at the 26th Privacy Enhancing Technologies Symposium (PETS 2026), held from 20 to 25 July 2026 in Calgary, Canada. The paper, “From Syntactic Matching to Taint Tracking and Back: A Comparative Study of Web Tracking Detection Techniques,” was developed jointly with Stefano Calzavara of Università Ca’ Foscari Venezia and Samuele Casarin of Università Ca’ Foscari Venezia and Scuola IMT Alti Studi Lucca.
The study examines techniques for detecting stateful web tracking, a widespread practice in which websites store identifiers in browser storage, such as cookies, and subsequently transmit them to third-party trackers. These identifiers allow tracking companies to recognise users across visits and websites.
The researchers compare two widely used detection approaches: syntactic matching and taint tracking. Syntactic matching relies on heuristics to identify browser-stored identifiers in third-party network requests, including transformed versions such as Base64-encoded values. Taint tracking takes a more systematic approach by following data flows throughout JavaScript execution—from operations that read identifiers from browser storage, through subsequent transformations, to requests that transmit tracking-related values to third-party services. The results show that taint tracking is generally more precise than conventional syntactic matching, but also produces a substantial number of false negatives. The researchers therefore conclude that neither method is sufficiently reliable when used independently and without additional validation.
To address these limitations, the authors developed a sound validation algorithm that automatically confirms findings produced by syntactic matching, creating a more precise version of the technique. The study shows that syntactic matching and taint tracking offer complementary perspectives on web tracking: while syntactic matching identifies similarities between stored identifiers and transmitted values but has limited visibility into JavaScript execution, taint tracking follows runtime information flows in greater detail. Combining validated syntactic matching with taint tracking therefore delivers the strongest overall results and enables a more robust and nuanced assessment of tracking practices on the web.
Future work will extend the evaluation to machine-learning-based detection methods and additional filter lists beyond Disconnect. The researchers also plan to contribute further improvements to Foxhound, a Firefox-based research browser that uses dynamic taint tracking to trace data flows through JavaScript execution and the browser’s Document Object Model. These improvements aim to strengthen Foxhound as a robust measurement tool for analysing web tracking practices.
