Invisible User Tracking by HTML5’s New ‘Ping’ Attribute for Links ⇥ lapcatsoftware.com

Jeff Johnson:

This is a follow-up to my recent article Safari link tracking can no longer be disabled. I’m quite surprised that my complaining about a hidden preference in Safari has generated so much discussion on the internet. I’m also quite pleased, because I think it’s important to draw attention to the privacy implications of the HTML anchor ping attribute and have a public debate about it. I’ve heard so many people say that they weren’t even aware that anchor ping existed until they saw my article, so I’m glad to raise awareness.

[…]

Anchor ping was supposed to be transparent as in easily perceived by the user. Instead, anchor ping has become “transparent” as in invisible to the user. The browsers never informed the user about the ping notifications. And now browsers such as Safari and Chrome are removing the ability of the user to disable the notifications. As far as privacy is concerned, this is not “a wash” compared to previous tracking methods. It’s a cover-up.

Ever since Johnson posted his first article on the subject, I still can’t figure out what users gain by not being informed of both the target URL and the ping. When links are being used for tracking purposes, it makes sense to show the contents of the href so that users aren’t misled; but, if we start assuming all browser features will be used maliciously, it is easy to see why the ping attribute should also be visible to the user. That’s understandable for anyone who has ever followed a bit.ly link to a phishing attempt, shock website, or catchy 1980s music video — hey, remember when the internet was kind of jokey?