The Hitchhiker's Guide to Facebook Web Tracking with Invisible Pixels and Click IDs

Over the past years, advertisement companies have used a variety of tracking methods to persistently track users across the web. Such tracking methods usually include (first-party) cookies, third-party cookies, cookie synchronisation, as well as a variety of fingerprinting mechanisms. To complement these tracking approaches, Facebook recently introduced a new tracking method that attaches a one-time tag as a URL parameter (namely FBCLID) on outgoing links to other websites. Although one-time tags do not seem to have enough information to persistently track users, we demonstrate that this tag, despite its ephemeral nature, when combined with Facebook Pixel, can aid in persistent tracking of users across space (i.e., different websites) and time (i.e., both in the past as well as in the future). We show that this tag can be used to track web users' activity in the distant past -- even before those users had a Facebook account. In addition, by combining this tag with cookies that have rolling expiration dates, Facebook can also track users' browsing activities in the far future as well. Our experimental results suggest that more than 20% of the popular websites out there have adopted this technology, and thus can contribute to this kind of user tracking on the web. Our longitudinal study shows that user tracking can go as back as 2015, or even as 2013 (when the precursor of this technology was first introduced by Facebook). To put it simply, if a user creates for the first time a Facebook account today, Facebook could track her web browsing activity as far back as 2015.