Carnegie Mellon University
September 30, 2020

Websites containing COVID info are tracking you

It’s not just news sites; government, academic sites do too

By Daniel Tkacik

If you search online for information about COVID-19, many third-party companies, including advertisers, will know you did so. That shouldn’t be too surprising, because most popular websites track you, according to a new study co-authored by ISR and CyLab’s Tim Libert.

“You have a right to privacy, and this violates that right,” says Libert, special faculty in the Institute for Software ResearchOpens in new window in Carnegie Mellon’s School of Computer ScienceOpens in new window.

In a new studyOpens in new window in collaboration with researchers at the University of Pennsylvania, Libert showed that 99 percent of websites that contained information regarding COVID-19 also contained code that shares user activity data with third parties, including advertisers.

“This practice, known as ‘web tracking,’ can reveal sensitive information about individuals’ health conditions and concerns to parties who wish to profit from it,” the authors wrote in a research letterOpens in new window to the Journal of the American Medical Association earlier this month.

To create a database of websites that users may visit when searching for COVID-19 related information, the researchers used Google Trends to determine the top 25 search queries related to COVID and coronavirus and then retrieved the top 20 URLs for each query. They then visited each URL using webXrayOpens in new window, a tool created by Libert in 2015 that automatically detects third-party tracking on websites.

Many of the top search results in their dataset were news websites, which Libert and others have shown previously are known for data tracking for ad revenue purposes.

“Getting COVID information from news websites isn’t a bad thing—you can get good information from the news,” says Libert. “But you do wade into the deep end of creepy web trackers in doing so.”

Web tracking was less common but still prevalent on government and academic sites, where visitors may visit with a higher expectation of privacy. The people running these websites may be unaware of trackers on these sites, the researchers say in the study, because they may not realize that the tools they use to measure web traffic also send visitor data to third parties. 

What are Internet consumers supposed to do with this information? Libert says there are two parts to that answer. 

“On a practical level, you could install some privacy add-ons and adjust your privacy settings,” he says. “But I’m philosophically opposed to the whole idea that users should be doing anything about this; it’s the responsibility of legislators. What you really need to be doing is supporting politicians who are going to take on big tech.”