CSS tracking
❗This article is a stub. You can help by expanding it.
#appeals channel in either Zulip or Discord to request removal.An article may be flagged as a stub when it is missing major elements needed to make it useful to a reader. You can help by adding missing sections, verifiable sources, relevant company policies and communications, etc. to make the article more complete.
⚠️This article's relevance is under review. It does not appear to be in-scope for the wiki.
#appeals channel in either Zulip or Discord to request removal. Discussions of this article's relevancy should take place on its talk page.You can help establish relevance by showing how the issue represents either large-scale consumer exploitation (systemic practices, recurring incidents, etc.) or a case of 'modern' consumer rights issues such as privacy violations, barriers to repair, or ownership rights, in line with the Mission statement and Moderator Guidelines.
CSS-based tracking and CSS fingerprinting consist of abusing the semantics of CSS, a styling language used to present virtually all web-pages, in order to trick web-browsers to send data to servers.
How it works
CSS can declare that certain resources/assets be used if certain conditions are met.[1] Since browsers implement lazy-loading, this means that assets will only be requested when the conditions are met. This effectively allows pinging arbitrary URLs when a client-side event happens. Instead of referencing a single endpoint for all events, each event can be associated to a different URL, allowing the tracking-"server" to gather more data about user behavior.[2][3]
Traditionally, CSS tracking was (and still is) implemented as a limited finger-printer, typically by enumerating installed fonts and checking window dimensions.[citation needed]
Either way, the attack has limitations, as caching avoids (no guarantee) repeated requests from happening.
Why it is a problem
Though CSS is widely believed to be "just a declarative styling system" with no practical compute power, it is actually a virtually Turing-complete programming language,[4][5] a fact which may leave even the most privacy-minded users vulnerable to tracking.[citation needed] This mode of attack breaks the common belief that HTML and CSS can only be used to make static/passive documents, whilst JavaScript represents the real "threat" to be countered through disabling.[citation needed]
Examples