Data Siphoning Across Borders: The Role of Internet Tracking

We investigate the role of Internet tracking in siphoning users' personal data from one country to another. We use the term "siphon" to indicate a one-way channel that once set up will result in a continuous flow of personal information from the source to the destination. We conduct a web privacy measurement study using a Germany-Russia scenario; we collect and analyze tracker data from 12 mainstream news sites in Germany, 1000 top sites in Germany and Russia, and 1000000 top sites in the world. We identify five tracking patterns that can siphon data from users in Germany to Russia; two key parameters of the tracking patterns, distance-to-data and type-of-control, determine timeliness, accuracy and granularity of siphoned data. Results show that Russian trackers are widespread on German news sites. Lastly, we discuss the impact of data siphoning on General Data Protection Regulation (GDPR). Analyses show that tracking patterns can facilitate siphoning of personal data across borders while subverting requirements of GDPR.