Web beacon

This article is about a user tracking technique on the Web. For the location technology, see Bluetooth Low Energy beacon.

A web beacon^{[note 1]} is an element used on web pages or in emails to determine if and when a user has accessed some content.^[1] Web beacons are usually unseen HTML elements that track a webpage's views based on the user's computer sending an HTML request. When implemented using JavaScript, they may be called JavaScript tags.^[2] Web beacons are typically used by third parties to monitor the activity of users at a website for the purpose of web analytics or page tagging.^[3] They can also be used for email tracking.^[4] When the user visits the webpage again, these beacons are connected to cookies established by the server, facilitating undisclosed user tracking.^[5]

Using such beacons, companies and organizations can track the online behavior of web users. Companies started tracking for advertising or web analytics purposes; later social media sites also started to use such tracking techniques through the use of buttons that act as tracking beacons.

In 2017, W3C published a candidate specification for an interface that web developers can use to create web beacons.^[6]

Overview

An innocuous web beacon embedded in a email

A web beacon can be implemented through various techniques used to track who is visiting a web page. They can also be used to see if an email was read or forwarded or if a web page was copied to another website.^[7]

The first web beacons were small digital image files that were embedded in a web page or email. The image could be as small as a single pixel (a "tracking pixel") and could have the same colour as the background, or be completely transparent.^[8] When a user opens the page or email where such an image is embedded, they might not see the image, but their web browser or email reader automatically downloads the image, requiring the user's computer to send a request to the host company's server, where the source image is stored. This request provides identifying information about the computer, allowing the host to keep track of the user.

This basic technique has been developed further so that many types of elements can be used as beacons. Currently, these can include visible elements such as graphics, banners, or buttons, but also non-pictorial HTML elements such as the frame, style, script, input link, embed, object, etc., of an email or web page.

The identifying information provided by the user's computer typically includes its IP address, the time the request was made, the type of web browser or email reader that made the request, and the existence of cookies previously sent by the host server. The host server can store all of this information, and associate it with a session identifier or tracking token that uniquely marks the interaction.

Use by companies

For broader coverage of this topic, see Corporate surveillance.

See also: Facebook beacon

Once a company can identify a particular user, the company can then track that user's behavior across multiple interactions with different websites or web servers. As an example, consider a company that owns a network of websites. This company could store all of its images on one particular server, but store the other contents of its web pages on a variety of other servers. For instance, each server could be specific to a given website, and could even be located in a different city. But the company could use web beacons requesting data from its one image server to count and recognize individual users who visit different websites. Rather than gathering statistics and managing cookies for each server independently, the company can analyze all this data together, and track the behavior of individual users across all the different websites, assembling a profile of each user as they navigate through these different environments.

Email tracking

Mechanism

HTML email messages typically contain hyperlinks to online resources and common software used by a recipient of email may, by default, automatically connect to a server to download remote image files from hyperlinks. A spy pixel is an image file that is deliberately made small, often of a single pixel and of a colour that makes it "impossible to spot with the naked eye even if you know where to look." In order to track individual behavior, the web beacon link has to contain a tag that is unique to each email recipient such as the hash of the recipient's email.^[9][10][11]

Through the use of an embedded beacon, the sender of an email – or even a third party – can record the same sort of information as an advertiser on a website, namely the time that the email was read, the IP address of the computer that was used to read the email (or the IP address of the proxy server that the reader went through), the type of software used to read the email, and the existence of any cookies previously sent. In this way, the sender – or a third party – can gather detailed information about when and where each particular recipient reads their email. Every subsequent time the email message is displayed, the same information can be sent again to the sender or third party.

"Return-receipt-to" (RRT) email headers can also trigger sending of information and these may be seen as another form of a web beacon.^[12]

Usage

Web beacons in emails have a variety of usage cases both legitimate, such as private use or for marketing or research, and illigitimate, such as by spammers and phishers, to verify that an email is read. Using this system, they can send similar emails to a large number of addresses and then check which ones are valid. Valid in this case means that the address is actually in use, that the email has made it past spam filters, and that the content of the email is actually viewed.

Any email user can be reached via email tracking due to the open nature of email so web beacons embedded in emails have greater privacy implications than beacons embedded in web pages.

Countermeasures

To some extent, this kind of email tracking can be prevented by configuring the email reader software to avoid accessing remote images. One way to neutralize such email tracking is to disconnect from the Internet after downloading email but before reading the downloaded messages. (Note that this assumes one is using an email reader that resides on one's own computer and downloads the emails from the email server to one's own computer.) In that case, messages containing beacons will not be able to trigger requests to the beacons' host servers, and the tracking will be prevented. But one would then have to delete any messages suspected of containing beacons or risk having the beacons activate again once the computer is reconnected to the Internet.

Web beacons can also be filtered out at the server level so that they never reach the end-user.

Beacon API

The Beacon API (application programming interface) is a candidate recommendation of the World Wide Web Consortium, the standards organization for the web.^[13] It is a standardized API that directs the web client to silently send tracking data back to the server, i.e. without alerting the user and thus disturbing their experience.^{[citation needed]}

Use of this Beacon API enables user tracking and profiling without the end-user's awareness, as it is invisible to them, and without delaying or otherwise interfering with navigation within or away from the site.^[14] Support for the Beacon API was introduced into Mozilla's Firefox browser in February 2014^[15] and in Google's Chrome browser in November 2014.^[16]

Notes

1. Also called web bug, tracking bug, tag, web tag, page tag, tracking pixel, pixel tag, 1×1 GIF, spy pixel, or clear GIF.