More madness stopped: beacons

April 17 2019 by Jeff Johnson

My blog post Safari link tracking can no longer be disabled generated a lot of discussion and controversy. Eventually the WebKit project itself felt compelled to respond publicly with their own blog post. I won't respond to their blog post here, because I feel that my follow-up blog post Some thoughts on anchor ping already anticipated and addressed the arguments they made. I do want to talk about an additional form of tracking technology mentioned in the WebKit article: the Beacon API. Both WebKit and Mozilla admit that beacons were designed for tracking and analytics. Unlike anchor "ping", there was never a way to disable beacons in Safari… until today!

I've just released StopTheMadness version 6.1 in the Mac App Store. StopTheMadness 6.1 includes a new "Privacy" website protection. With the Privacy protection enabled (as it is by default), StopTheMadness 6.1 stops the Beacon API! Beacons will no longer be sent at all, and one more method of tracking you online has been eliminated. The Privacy protection also removes any anchor "ping" attribute on link clicks. (In StopTheMadness 6.0, anchor "ping" removal was included with the "⌘-Click" protection simply because I didn't have a good place for it at the time; now I have a specific category for it.) And that's not all: the Privacy protection strips tracking tags such as utm_source (Urchin Tracking Module), gclid (Google Click ID), and fbclid (Facebook Click ID) from the URL when you click a link. I'm expanding the mission of StopTheMadness to protect your privacy on the web in addition to what my extension has always done, stop website annoyances. The web is for the users, not the advertisers.

Since version 5.0, StopTheMadness has included a Firefox Add-on. StopTheMadness 6.1 adds the new Privacy protection for both Safari and Firefox! This includes stopping beacons and stripping URL tracking tags. I should note that Firefox is the one browser that already had a way to disable the Beacon API. If you open about:config in Firefox, there's a preference beacon.enable that's enabled by default. If you double-click that preference, then beacons are disabled. Nonetheless, I chose to include my beacon feature in StopTheMadness for Firefox, because beacons are still enabled by default in Firefox, and most people don't even know about this hidden Firefox preference. When you install StopTheMadness for Firefox, you're automatically protected from beacons whether you know it or not!

If you'd like to see how beacons work, I've created a little test page where you can try for yourself. The full instructions are on the page. You can run your own simple localhost server on your computer, and then you can watch how pressing the button sends a beacon to your localhost server. The button is only for illustration; for tracking purposes, a web site will usually send a beacon invisibly when the page is about to unload.