135

Yesterday I was searching DuckDuckGo for booking a vacation. I ended up reading a lot on one specific website. Today multiple websites show me Google banners from this specific website. Normally, I never look up websites for booking a vacation. I use DuckDuckGo on purpose, to prevent these kind of things. My question therefore is: how is this possible?

I'm 100% certain that I didn't accidentally Google something.

The website I was reading was this, if that helps.

P.Yntema
  • 1,047
  • 2
  • 8
  • 13
  • 12
    I think some sites uses banner provided by google so that when you login with your google account google fetch your search history and replace banners llnks according to your search. – TAHA SULTAN TEMURI Oct 11 '17 at 11:28
  • 6
    most web sites share notes with google about where you go and what you do, and google knows how you (likely) got there even if they don't use google webmaster tools like ads or analytics. – dandavis Oct 11 '17 at 11:29
  • 7
    I use an add blocker and a cookie/tracker eraser on my browser and I have never recieved anounces regarding previous searches or pages I have visited. They should be configurable so you can whitelist pages where you want your cookies kept after closing the tab. – YoMismo Oct 11 '17 at 11:44
  • 100
    DuckDuckGo protects *searches*, but it does not protect you when you visit the sites it returns. You need another layer of technology to protect you once you move on. – schroeder Oct 11 '17 at 12:04
  • 1
    @YoMismo I also use adblocker, but I turned it off for 1 site and got this ad. As it seems from different comments, adblocker doesn't protect you from Google knowing what sites you visit. – P.Yntema Oct 11 '17 at 12:50
  • 1
    @P.Yntema The adbloker should avoid adds, the cookie/tracker eraser is the one that cleans the information that can be used to show personalized ads according to previous visited web pages. – YoMismo Oct 11 '17 at 13:23
  • 4
    See [beacons](https://en.wikipedia.org/wiki/Web_beacon). They track people's behaviour online. You can get plugins to block them (I used to have a plugin called Ghostery back when I used Chrome which did just that). – Pharap Oct 11 '17 at 15:56
  • 2
    Why bother, Google can track your every move anyway. There is no way you can stop them. DuckDuckGo does not improve a single thing, you hit their scripts from DuckDuckGo and they still know where you were looking for. – Viezevingertjes Oct 11 '17 at 19:15
  • 1
    @Viezevingertjes Yes well, thats what I discover just today. Sadly it is the case. – P.Yntema Oct 11 '17 at 20:47
  • 1
    If you're willing to spend about half a minute to unbreak each new site you go to, you should use a content blocker in block-all-allow-exceptionally mode to block any tracking scripts that haven't made it onto privacy lists yet. You should also look at Decentraleyes, and referrer/UA spoofing extensions like uMatrix. – timuzhti Oct 12 '17 at 01:34
  • DuckDuckGo and an Incognito window should work as well, and is super simple. However when you do that, you will lose out on things that might be to your advantage. Just make sure you don't log into any google product with your incognito window or they'll know who you are everywhere else. – boatcoder Oct 12 '17 at 18:21
  • try Brave browser – Walrus the Cat Oct 13 '17 at 21:10

7 Answers7

194

Loading that page loads

https://www.googleadservices.com/pagead/conversion.js
https://www.googletagmanager.com/gtm.js?id=GTM-WPPRGM
https://stats.g.doubleclick.net/dc.js

The reason Google can track you is that the website shares details of your visit with them - in this case via loading Google JavaScript code for their ads service.

*To expand on this -

The Google ad code will use a cookie to track you. But even if it didn't there are browser fingerprinting mechanisms which in most cases can correctly identify a user's machine even after a full browser cache / history clear.

When you visit a site with ads a request is made to the ad providers server. This sends the ID associated with you to say "an ad on [x website] for [user y] is available. The ad providers nowadays often then real-time auction off the slot in 1/100th of a second - where potential advertisers computers can bid for the advert space.

The site you visited is djoser. Since djoser knows you looked at products on their site yesterday they know there is a reasonable chance you are considering buying something from them. So when you visit another site somewhere else, the ad slot on that other site is more valuable to djoser, and they bid higher than anyone else - hence why you keep seeing them.

Peter Mortensen
  • 885
  • 5
  • 10
Hector
  • 10,923
  • 3
  • 41
  • 44
  • 2
    Oh okay so the moment I actually visit the website its already bad. Thanks. – P.Yntema Oct 11 '17 at 11:36
  • 85
    I'd suggest on top of DuckDuckGo using a well regarded ad blocker (I use u-block origin personally) and a privacy add-on like the EFF's Privicy Badger. This will stop 99% of tracking. – Hector Oct 11 '17 at 11:43
  • 2
    Firefox has an option to automatically delete cookies when closing the browser. – S.L. Barth Oct 11 '17 at 11:45
  • 1
    Will blocking `googleadservices.com` with RequestPolicy help? – 12431234123412341234123 Oct 11 '17 at 12:37
  • 3
    Somewhat As would *.doubleclick.net. An ad blocker would handle all of this for you. – Hector Oct 11 '17 at 12:40
  • 2
    "But even if it didn't there are browser fingerprinting mechanisms which in most cases can correctly identify a users machine even after a full browser cache / history clear." You mean Evercookie(s)? – Yates Oct 11 '17 at 13:14
  • If you want more control over what scripts run on pages, you can use plugins like Noscript or uMatrix, which can block these domains' scripts from running, assuming that your Adblocker (I recommend uBlock Origin like Hector suggested) doesn't block them in the first place. – Sonickyle27 Oct 11 '17 at 13:14
  • 61
    @ThomasYates - Nope. You can fingerprint browsers by pulling lists of installed fonts, add-ins etc. It works out to be surprisingly unique - have a look at https://amiunique.org/fp – Hector Oct 11 '17 at 13:47
  • 21
    @S.L.Barth: This is also known as the "I love phishing" option, since constantly having to login to every site you use will condition you as a perfect victim for phishing. – R.. GitHub STOP HELPING ICE Oct 11 '17 at 19:15
  • 2
    Phishing is easily avoided by checking the URL you've landed on through a link or visiting a site directly through Google, and chances are someone posting to infosec.SE is aware of this. – Hashim Aziz Oct 11 '17 at 20:44
  • 6
    @Hashim Yeah but you get a lot more chances to screw that up. – user253751 Oct 11 '17 at 20:55
  • Would using [NoScript](http://en.wikipedia.org/wiki/NoScript) (JavaScript whitelisting) prevent this? – Peter Mortensen Oct 11 '17 at 22:07
  • 1
    Note that uBlock Origin has many filter lists that are not enabled by default, but can be enabled in the settings through a checkbox, such as certain social network type tracker blocking lists (like Fanboy's), some malicious script blocking lists and the Multipurpose (like MVPS HOSTS) lists. Of course, you can always add lists through URL as well, like with other blockers. – timuzhti Oct 12 '17 at 01:09
  • 2
    This is a common online marketing tactic called [retargeting](https://en.wikipedia.org/wiki/Behavioral_retargeting). – David Ehrmann Oct 12 '17 at 05:02
  • 1
    @R.. With that option, you can whitelist sites so that their cookies are not deleted when the browser closes. (Incidentally, an add-on with a better UI to do the same thing is [Self-destructing Cookies](https://addons.mozilla.org/en-US/firefox/addon/self-destructing-cookies/)). – Federico Poloni Oct 12 '17 at 14:32
  • Would disabling 3rd party cookies will help to avoid this tracking mechanism? – sampathsris Oct 12 '17 at 14:40
  • @Hector It's technically possible, but are companies such as Google actually using that? By just blocking a whole bunch of those trackers in /etc/hosts I don't have the "persistent banners from website I once visited"-effect that the OP describes. – Martin Tournoij Oct 13 '17 at 01:11
  • 1
    I would be highly surprised if the major internet advertising firms are not using browser fingerprinting. Although even if they aren't a huge number of people sign back into google services re-linking the two sessions shortly after a cache clear. It depends why you care. Do you care about seeing the banners? Or that they are tracking you in the first place? There have been issues of automated ad targeting systems identifying someones father had died and plastering her browsers with related material. And a woman who was profiled as pregnant by trackers before she even knew herself! – Hector Oct 13 '17 at 07:02
  • 2
    Firefox has a built-in mechanism to resist fingerprinting: in about:config, enable privacy.resistFingerprinting. Looks like it's a feature originally from the Tor browser, see https://wiki.mozilla.org/Security/Fingerprinting – Spacedog Oct 13 '17 at 20:17
  • @Carpetsmoker - there's no reason to believe that they are not using it, even if they aren't doing browser fingerprinting the privacy for `googlefonts` says it collects data that is presented to sites via google analytics. There's no reason that wouldn't apply to other google services, especially 'googleapis' which is virtually impossible to avoid while maintaining a "full" web experience. – James Snell Oct 15 '17 at 21:29
  • Just block third party cookies before using an ad blocker. Blocking cookies will likely display generic ads on websites because they won't know (except for IP address) that `it's you`. As highlighted above no-third-party-cookies won't prevent fingerprinting or other techniques. But at least cookies are how 90% of AD industry works – usr-local-ΕΨΗΕΛΩΝ Oct 16 '17 at 11:36
19

While Hector's answer correctly explains how Google got to know the page you visited, the real answer to the OP:

How did Google know I looked something up?

Is

They Don't

In fact, no one is telling Google what your search was: only the destination page is sharing information about your visit, which does not include your search query (because DuckDuckGo hides that).

Of course, Google's advertising services still target you with content that is relevant to the website you visited (to avoid that, follow Hector's good advices), but they don't know what you looked up on DuckDuckGo.

Also, please know that Google do get informed of the fact that DuckDuckGo sent you there (while, sorry for the repetition, they don't get to know what you searched for)

Mario Trucco
  • 1,559
  • 2
  • 11
  • 25
  • 7
    They may not know the exact search term. But they know that you came from a search on DuckDuckGo - on a search for "test" and clicking the test.com result I see in the request header "Cookie:DOAAuthReferrer=https%3A//duckduckgo.com/; DO.." – Hector Oct 12 '17 at 08:03
  • @Hector true, I'll add that – Mario Trucco Oct 12 '17 at 08:04
15

It is most likely due to the website using Google tools.

Many website uses Google analytics or advertisement service, with whom they can get information on who's visiting their website etc.

Hence, Google is informed of your visit of this website.

M'vy
  • 13,053
  • 3
  • 48
  • 69
  • 1
    And how can I prevent this? Because then using DuckDuckGo doesn't even make sense. – P.Yntema Oct 11 '17 at 11:34
  • 7
    See my answer. Using DuckDuckGo helps with sites that don't have advertising arrangements. Ultimately the only way to stop yourself being tracked is to use an ad-on that wipes all local storage on leaving a site and does things like randomise lists of presented fonts/add-ons to confuse fingerprinting attempts. – Hector Oct 11 '17 at 11:37
  • " wipes all local storage on leaving a site " is completely unrelated to analytics tracking. – Mooing Duck Oct 11 '17 at 23:03
  • 2
    Google *Analytics* tends to be much more privacy-conscious. This is from several years ago, but the cookies it drops off are actually for the non-Google domain. Anything Doubleclick or Adwords related is a different story. – David Ehrmann Oct 12 '17 at 05:01
  • 1
    @MooingDuck - not at all. Look up EverCookie - any local storage available to a site an be used to store information to identify you for tracking purposes. – Hector Oct 12 '17 at 07:59
  • 3
    @P.Yntema Using DuckDuckGo does make sense, because DuckDuckGo doesn't keep track of who you are and what you have *been searching for* - as Google does. Just searching for something with Google, may result in customized ads (from Google) later... But more importantly, Google will make a profile over you, containing everything you've searched for. However using DDG doesn't mean your surfing anonymously - nor does it mean that the sites listed by DDG all will respect your privacy or that they don't contain ads with trackers. – Baard Kopperud Oct 15 '17 at 18:57
6

HOW GOOGLE KNOWS?

@Hector already mentioned the reasons how it is showing related pages of your searched for last time. I would like add few more points. Well this is part of targeted marketing and their are many companies which are adding these google tags or other DMP tags like AdeX, KRUX, Salesforce, etc to the websites. So not only google is targeting you but also all these trackers from other DSPs(Demand Side Platform) or DMPs(Data Management Platform).

HOW TO BLOCK THESE TRACKERS?

If you want to check on a website what trackers are present and if you want to manage them then you can use chrome extension called Ghostery or alternate softwares like Ghostery. You can block a specific tracker if you don't want to share your information with them. This is going to greatly reduce the advertisements related to your search.

By Ghostery, block all trackers you want to

Actung
  • 161
  • 3
  • thanks for adding alternates to a specific extension - it sort of looked like an ad for Ghostery – schroeder Oct 13 '17 at 13:27
  • @schroeder Yes thats what I realised and gave alternatives – Actung Oct 13 '17 at 13:48
  • 7
    Ghostery itself is a tracker.. If not disabled then, among other things, this information is collected: _standard web server log information like your web request, the data sent in response to that request, a timestamp for the request, page_ And this information is always collected: _web browser, operating systems, and opt-in settings to share Tracker information with the Company, when an installation, upgrade, or uninstallation occurs, and whether the GBE is active or engaged by you._ (VI + VII in the [privacy policy](https://www.ghostery.com/about-ghostery/browser-extension-privacy-policy/)) – Andreas Oct 14 '17 at 15:42
  • 2
    Upvoted for good explanation of third-party tracking and how users can protect themselves. I had been using Ghostery for a couple of years but due to privacy concerns, I switched to the EFF's Privacy Badger. Instead of using a preset list of trackers, it continuously analyses third-party requests to determine whether or not they're tracking you. It's been working well for about 18 months and encouraged me to donate to the EFF. – Anthony Geoghegan Oct 16 '17 at 12:24
2

This sounds like a remarketing cookie to me. Google, Facebook, and many other sites use "retargeting" (which Google calls remarketing) which gives advertisers the ability to target you specifically, on other unrelated sites that also serve ads in the same network.

So you visit site A about travel, and you read a few pages. Even if that site displays not a single ad, they can hit you with a retargeting/remarketing cookie. Now you go to site B, which is utterly unrelated to travel - say it's a TV show site - and they advertise using Google's Adsense program. If Google's algorithms determine that it is likely to be more profitable for them to show you ads for the travel site you visited previously, than to show you other ads for other things, then they will show you the travel ads.

JVC
  • 129
  • 2
-1

Another possibility: https://superuser.com/questions/1250944/how-can-this-website-reidentify-me-even-after-deleting-all-of-my-browsers-histo

There is a little known area where sites can store informations in Firefox: the IndexedDB

To paraphrase the top answer from @arjan : They can store information inside IndexedDB (which is NOT cleared when you clear cookies, history, etc). To clear it you need to do something specific: either go to: about:permissions, or if it does not work (ex: Firefox 55), going into Tools, Page Info, Permissions to get the button "Clear Storage"

Olivier Dulac
  • 405
  • 1
  • 4
  • 11
  • 1
    IndexedDB is in most major browsers these days and is normally part of a "clear application data" option in the clear history checkboxes. Its also not little known - its regularly used by web applications. – Hector Oct 12 '17 at 15:24
-1

If your travel site sets a third-party cookie on behalf of an ad network the ad network can follow you around the Internet with knowledge of your previous behavior. Disabling third-party cookies can protect your privacy and prevent ad networks from collecting broad information about your behavior. With third-party cookies blocked, sites cannot set or read cookies on behalf of others and only the site that sets the cookie will have access to it.

You can this in Firefox under: Preferences - > Privacy and Security -> History -> Use custom settings for history -> Accept third-party cookies -> Never

Anyone who cares about online privacy should make this change in all their browsers on all their devices.

jorfus
  • 441
  • 3
  • 6