CSS tracking

❗Article Status Notice: This Article is a stub

---

This article is underdeveloped, and needs additional work to meet the wiki's Content Guidelines and be in line with our Mission Statement for comprehensive coverage of consumer protection issues. Learn more ▼

Issues may include:

• This article needs to be expanded to provide meaningful information
• This article requires additional verifiable evidence to demonstrate systemic impact
• More documentation is needed to establish how this reflects broader consumer protection concerns
• The connection between individual incidents and company-wide practices needs to be better established
• The article is simply too short, and lacks sufficient content

How you can help:

• Add documented examples with verifiable sources
• Provide evidence of similar incidents affecting other consumers
• Include relevant company policies or communications that demonstrate systemic practices
• Link to credible reporting that covers these issues
• Flesh out the article with relevant information

This notice will be removed once the article is sufficiently developed. Once you believe the article is ready to have its notice removed, please visit the Moderator's noticeboard, or the Discord (join here) and post to the #appeals channel, or mention its status on the article's talk page.

CSS-based tracking and CSS fingerprinting, consist on abusing the semantics of CSS, in order to trick web-browsers to send data to servers.

How it works

CSS can declare that certain resources/assets be used if certain conditions are met. Since browsers implement lazy-loading, this means that assets will only be requested when the conditions are met. This effectively allows pinging arbitrary URLs when a client-side event happens. Instead of referencing a single endpoint for all events, each event can be associated to a different URL, allowing the tracking-"server" to gather more data about user behavior.

Traditionally, CSS tracking was (and still is) implemented as a limited fingerprinter, typically by enumerating installed fonts and checking window dimensions.^{[citation needed]}

Either way, the attack has limitations, as caching avoids (no guarantee) repeated requests from happening.

Why it is a problem

This is an insidious practice, as CSS is widely believed to be "just a declarative styling language", even though it's practically Turing-complete. Even privacy-minded users have this misconception, which makes them equally vulnerable to this class of tracking.^{[citation needed]} Most people believe that simply disabling Javascript is enough. This attack breaks the expectation that HTML and CSS can only be used to make static/passive documents.

Examples

Some examples of CSS tracking include:

*
*
*

---

Add your text below this box. Once this section is complete, delete this box by clicking on it and pressing backspace.