Princeton's OpenWPM crawled 1M sites and quantified tracking and fingerprinting

By 2016 the debate over online tracking ran on anecdotes and small samples. A 2014 collaboration had shown websites drawing invisible images to fingerprint devices, but no one had measured the tracking ecosystem at scale: how many third parties really exist, how tracking shifts toward stateless fingerprinting, or whether privacy tools actually work.

The usual ways to study the problem could not see it. Inspecting HTML without executing it misses code that only runs inside a browser; hand-checking a few hundred popular sites hides the long tail of trackers; and blocklists and privacy extensions were defended and attacked without an evidence base. Fingerprinting in particular is invisible unless a page is really loaded.

Princeton researchers Steven Englehardt and Arvind Narayanan built OpenWPM, an automated crawler that drives a fully instrumented Firefox browser, and ran it across the top 1 million sites in January 2016, making over 90 million requests. Separate stateful and stateless crawls distinguished cookie-based tracking from fingerprinting, and two 55,000-site crawls with Ghostery and with Firefox's third-party cookie blocking quantified each tool's effect.

The scale turned measurement into structure: over 81,000 third parties exist but only 123 appear on more than 1% of sites, all of the top 5 and 12 of the top 20 are Google-owned, and Google, Facebook, and Twitter are the only entities present on over 10% of sites. Canvas fingerprinting appeared on 14,371 sites, three never-before-measured techniques — AudioContext, canvas-font, and WebRTC — were documented, and 54% of third parties were found to load only over HTTP, a blocker to HTTPS adoption.

Instrument the browser itself, then watch a million sites

Executing full pages in an instrumented browser catches JavaScript-driven fingerprinting that static analysis and blocklists cannot see

Separate stateful and stateless crawls attributed tracking to cookies versus device fingerprints, so each technique could be measured cleanly

Million-site scale exposed the structure of the market: a steep long tail with Google, Facebook, and Twitter as the only entities over 10% of sites

Side-by-side blocked crawls produced the first hard numbers on privacy tools — Ghostery cut third-party includes from 17.7 to 3.3 per site

Releasing OpenWPM and the datasets turned one study into shared infrastructure other researchers could verify and build on

When the phenomenon lives only inside client-side execution, don't argue from blocklists or samples — instrument the runtime, measure at full scale, and release the tool and data for verification.

The January 2016 crawl's datasets were published as PostgreSQL dumps and OpenWPM as an open platform; the Princeton WebTAP project lists studies built on it, and the OpenWPM repository now reports over 75 studies using the framework. The census also documented how fingerprinting had evolved since the 2014 canvas study: the most prominent trackers largely stopped using canvas fingerprinting after public backlash, while the number of domains deploying it grew and its use shifted from behavioral tracking toward fraud detection.