❗This article is a stub. You can help by expanding it.
#appeals channel in either Zulip or Discord to request removal.An article may be flagged as a stub when it is missing major elements needed to make it useful to a reader. You can help by adding missing sections, verifiable sources, relevant company policies and communications, etc. to make the article more complete.
CSS-based tracking and CSS fingerprinting, consist on abusing the semantics of CSS, in order to trick web-browsers to send data to servers.
How it works
CSS can declare that certain resources/assets be used if certain conditions are met.[1] Since browsers implement lazy-loading, this means that assets will only be requested when the conditions are met. This effectively allows pinging arbitrary URLs when a client-side event happens. Instead of referencing a single endpoint for all events, each event can be associated to a different URL, allowing the tracking-"server" to gather more data about user behavior.[2][3]
Traditionally, CSS tracking was (and still is) implemented as a limited fingerprinter, typically by enumerating installed fonts and checking window dimensions.[citation needed]
Either way, the attack has limitations, as caching avoids (no guarantee) repeated requests from happening.
Why it is a problem
This is an insidious practice, as CSS is widely believed to be "just a declarative styling language", even though it's practically Turing-complete.[4][5] Even privacy-minded users have this misconception, which makes them equally vulnerable to this class of tracking.[citation needed] Most people believe that simply disabling Javascript is enough. This attack breaks the expectation that HTML and CSS can only be used to make static/passive documents.
Examples