How Presidential Candidates Track You & Their Digital Advertising Partnerships

Motivation

I did some in-depth research on three of the top U.S presidential candidates’ campaign websites. I started a fresh session on each site and recorded the HTTP Archive and all the network request/response data (I only did 3 in the interest of time).

TLDR; Kamala Harris’ site (33 trackers and advertising partners) tracks everything it possibly can and syncs it with the major social media sites and works with major advertising companies . Joe Biden’s site (14 trackers and advertisers) is much less intrusive but still syncs with a couple social media platforms and has the standard advertising partners including Outbrain…Lastly, Elizabeth Warren’s site (24 trackers and advertisers)is just as intrusive as Kamala’s site, if not even more!

Kamala Harris

KamalaHarris.org (168 Requests — 5.5MB transferred)

Detailed Analysis

1. Facebook: Relaying analytics data to Facebook fbevents.js, such as page-view attribution, time on site, device-type, etc. facebook.com/tr.
2. Twitter: Relaying analytics to analytics.twitter.com, probably trying to do a user sync. Also using static.ads-twitter.com to fire iframe pixel, oct.js.
3. Snapchat: Syncing with TapAd, SkimResources, AdSrvr.org, RLCdn.com
4. ATDMT: Tracking cookie served by Facebook subsidiary Atlas Solutions
5. AddThis: Simple widget to share content to social media platforms. Guess what? They track you too! No surprise there.
6. DoubleClick (Google): World’s largest digital advertising service
7. Y-IMG (Yahoo): Yahoo’s tracking pixel that does a TON of stuff. Check out the code here: https://s.yimg.com/wi/ytc.js
8. Reddit: Fires tracking pixel from redditstatic.com/ads. You can checkout the code here. https://www.redditstatic.com/ads/pixel.js. Also fire a .gif tracker to count Page Visit events.
9. AppNexus: A bit strange how they are involved. AppNexus pixel is introduced into the site through RhythmOne’s rp.gwallet.com loaded iframe.
10. Yahoo: In addition to firing the yimg.com pixel, data is pushed to analytics.yahoo.com to capture event data most likely. Also the ads.yahoo.com redirects to rp.gwallet.com/r1 where gwallet sets a cookie without a same-site restriction.
11. SC-Static (Snapchat): I encourage you to checkout this tracking script because it’s quite blatantly verbose in what information they sync, including IP ADDRESS, PAYMENT INFORMATION, ZIP CODE, LAT/LON, DEVICE, etc. Check out all the parameters they capture here.
    NOTE: I did a thorough test to see what data the sc-static pixel is actually sending and it only sends a SHA256 hash of information. It fires when the user submits the donation form. It’s not be nefarious, just greedy.
12. MediaIQDigital: AppNexus fires this request to mediaiqdigital. They specialize in a variety of things
13. Tapad: Takes the tr.snapchat.com pixel information and tries to sync the user with The Trade Desk by relaying the `ttd_puid` Partner ID to adsrvr.match.org.
14. AdSrvr (The Trade Desk): This is The Trade Desks user matching tracking request. Mentioned above, it’s trying to identify the user. This was introduced due to the connection to Snapchat.
15. LinkedIn: Fires both a tracking and advertising pixel. It fires a user sync.
16. GWallet (RhythmOne) : This is certainly the most interesting pixel on the page. GWallet renders an iframe which makes requests out to all the advertising parties: DoubleClick, OpenX, Yahoo, Rubicon, AppNexus, GWallet Pixels.
17. ScorecardSearch (Comscore Inc): “Uses a combination of web tags and cookies to help websites count users who have visited and seen a page or various parts of a page”
18. Univide: Fires a .gif tracker which then loads another AddThis .gif tracker. Hard to say what they’re doing exactly.
    https://p.univide.com/t.gif → https://cw.addthis.com/t.gif
19. Bluekai (Oracle): A DMP (Data Management Platform) that centrally organizes a company’s customer and audience data in the cloud. Bluekai runs the world’s largest 3rd party data marketplace to augment a customer’s proprietary data with actionable information on more than 700 million profiles.
20. Demdex (Adobe) — Captures behavioral data on behalf of websites and advertisers and stores it in a “behavioral data bank.”
21. OpenX — https://us-u.openx.net/w/1.0/sd?id=537072983&val=%3C!--
22. Rubicon: This PHP pixel is loaded from GWallet. Can’t really tell what it is doing, but I assume it’s just doing a user sync like the many of the other pixels. Rubicon is a well known advertising tech company, currently quite dominant in header-bidding technology.
23. Sync 1RX (RhythmOne): Like most of the of the other fired pixels, the sync.1rx.io pixel does a user sync to first try and identify the user so they can better target you for ads.
24. amplifypixel.outbrain.com // Saw this once but could not reproduce

High Level Summary

• 24 Advertising Trackers: AddThis, Google AdWords Conversion, Yahoo DOT tag, Snapchat For Business, Twitter Advertising, AppNexus, Google Dynamic Remarketing, DoubleClick, Twitter Conversion Tracking, Facebook Custom Audience, SkimLinks, Tapad, LiveRamp, TradeDesk, Atlas, LinkedIn Ads, RadiumOne, Adobe Audience Manager, Univide, BlueKai, OpenX, Rubicon, Yahoo Ad Exchange, Rhythmone Beacon
• 2 Essential Trackers: Typekit by Adobe, Google Tag Manager
• 6 Site Analytics Trackers: Google Analytics, LinkedIn Analytics, Hotjar, Yahoo Analytics, Twitter Analytics, ScoreCard Research Beacon
• 2 Social Media Trackers: Facebook Connect, Po.st

Joe Biden

https://joebiden.com/ (84 Requests — 4.5MB transferred)

Detailed Analysis

1. Google Analytics: Track a bunch of client side properties. Typical statistics like page-view, geo location, device type, etc.
2. Facebook Events: Pretty much the same as Google Analytics tracker, except they additionally will try to associate to some known Facebook user.
3. Outbrain Pixel: So my own biased opinion on Outbrain is not very positive. From what I can tell they bloat their numbers and stats with nifty JavaScript tricks. Besides that, this pixel is similar to the other analytics pixels in identifying a bunch of characteristics about the client (device, location, etc).
4. NewRelic: This tag is pretty redundant given the Google Analytics and Facebook pixel. Tracks basic characteristics about the user. NewRelic has a stronger focus on security though.
5. Google Dynamic Remarketing: This fires so Google can try build a target for the user. It’s how they show ads tailored to your site visitors.
6. DoubleClick (Google): World’s largest digital advertising service
7. Facebook Custom Audience (FAN): Facebook Audience Network is large and somewhat notorious ad network due to their composition of questionable publishers, especially the Android Apps that suck billions of untraceable impressions. Anyways, this pixel is typically in charge of initiating a bidding event and eventually display a targeted advertisement.
8. Google Adwords: This indicates that Biden’s people are doing some type of paid ad search with Google, then fire the pixel to determine attribution. (Not exactly100% about the paid search part. Thoughts?)

High Level Summary

• 8 Advertising Trackers: Twitter Advertising, Outbrain Amplify, Google AdWords Conversion, Outbrain Pixel, Twitter Conversion Tracking, DoubleClick, Google Dynamic Remarketing, Facebook Custom Audience
• 2 Essential Trackers: Typekit by Adobe, Google Tag Manager
• 3 Site Analytics Trackers: Google Analytics, New Relic, Twitter Analytics
• 1 Social Media Tracker: Facebook Connect

Elizabeth Warren

https://elizabethwarren.com (131 Requests — 5.3MB transferred)

Summary: Overall, her site tracks everything about the client possible and syncs with major social media platforms and advertising exchanges. In the interest of time I am not going to do the pixel by pixel detailed analysis of Elizabeth Warren’s site, but I provided a High Level Summary below.

There is a lot going on, even more than Kamala’s site. It’s actually very similar to Kamala’s site’s advertising partners and trackers. Main difference is Elizabeth’s site uses Outbrain Amplify and Heap Analytics. In my own biased opinion, Outbrain does a fine job in targeting but inflates their impressions with nifty JavaScript and browser tricks, the value of their impressions should be taken with a grain of salt (do your research). Heap Analytics is something new to me, but after looking at their code I can see that they are tracking IP based location (lat/lon, country, state). Warren’s site also includes all the same Snapchat shenanigans as Kamala’s site.

High Level Summary

• 16 Advertising Trackers: Google AdWords Conversion, Twitter Advertising, Marin Search Marketer, DoubleClick Floodlight, Snapchat For Business, Outbrain Amplify, Google Dynamic Remarketing, Twitter Conversion Tracking, Outbrain Pixel, Facebook Custom Audience, DoubleClick, TradeDesk, SkimLinks, Tapad, LiveRamp, Atlas
• 1 Essential Trackers: Google Tag Manager
• 5 Site Analytics Trackers: AB Tasty, Google Analytics, Heap, GA Audiences, Twitter Analytics
• 1 Social Media Tracker: Facebook Connect

Conclusion

Kamala Harris’ site tracks everything it possibly can and syncs it with every major social media site and works with some major advertising companies. Joe Biden’s site is much less intrusive but still syncs with a couple social media platforms and has the standard advertising partners including Outbrain (Yikesss). Lastly, Elizabeth Warren’s site is just as intrusive as Kamala’s site, if not even more!

Cheers! Make sure to turn your ad and tracker blockers if you’re concerned about being tracked!