Government web sites are not necessarily places that we expect to track us. There was a fascinating read over on The Markup on the high cost of free web sites. It looked at a number of sites – non-profits and government – and found trackers and browser fingerprinting. In some cases, old code had been left behind so the trackers weren’t being used by the web site owner. That didn’t stop the tracking, though. I decided to take a look at some legal information sites to get an idea of what tracking they are doing.

I’ve posted before on trackers, and using an extension from Mozilla called Lightbeam. The interesting thing about Lightbeam, no longer supported by Mozilla, was that you could see the connections between sites as you moved across them. Some of them were gathering so much data it was hard to see how the publisher could use it.

TL;DR: the larger government sites Iooked at are using a fractured set of analytics tools. But few are using the invasive trackers mentioned in the article or that are common on commercial publisher sites.

I didn’t expect to see anything like that. What I did expect to see was a lot of use of Google Analytics and its commercial cousin, Doubleclick. And that was confirmed on my first stop, the Ontario Courts.

Ontario: You’re to Be Discovered

Mozilla sunsetted the Lightbeam extension in part because it has now put a lot of tracking control inside the Firefox web browser. There’s no visualization but you can see what the browser is allowing and blocking.

The Ontario Courts are connecting to some Google services: analytics through Doubleclick and Youtube. Because each site you visit that also uses Google or Doubleclick analytics reports back, web browser developers are looking for ways to make your access more private. Apple has included functionality in Safari that will monitor for cross-site tracking.

A screenshot of the Location bar in Firefox after clicking on the Tracker Protection shield. It shows that the Ontariocourts.ca web site uses Doubleclick analytics tracking.

A visit to the Attorney General’s site gives you the perfect result: no trackers. But that’s only if, like me, you keep javascript turned off by default when surfing the web. When you turn javascript back on, the Attorney General is using Google Analytics.

A screenshot of the Location Bar in Firefox showing no trackers detected on the Attorney General’s web site. But this is without javascript turned on.

In some cases, having javascript turned off will not stop the tracking. It is common to use a <noscript> tag, with a transparent 1 pixel image, to send back visitor information in cases where javascript isn’t available. This is similar to how email marketing tracking works. It is good to know the Attorney General’s site doesn’t have that turned on, although it may just be an oversight.

I realize that different branches of the government use different systems. But I do wonder why the government wouldn’t roll its own version of open source Matomo analytics. That way it could accomplish whatever measurement it is hoping to do while creating a more private experience.

Federal Canada

I’m actually pretty impressed with how little tracking I’ve come across so far. I mean, not that I’ve dug too deep. One thing I’m struck by is that each agency or court seems to be doing its own thing. So there isn’t necessarily any solace for visitors to know that their experience across the Federal or provincial government is uniform.

The Federal Courts kick it up a notch. Their home page has a Twitter tracker and their entire site is using Google Tag Manager. I was a bit surprised at that. There’s no other analytics code and Tag Manager has always struck me as a more overt advertising tool.

A screenshot of the social media tracking on the Canadian Federal Court web site. Google Tag manager is also incorporated into the site.

In fact, I not only block Tag Manager in my browser, its one of the advertising sites I block in my hosts file so that my computer can’t even communicate with it. It would be interesting to know why the Court feels it needs the resource.

Another source I block everywhere is the AdobeDTM visitor API. The last thing I want is Adobe tracking me across the internet. They can’t even keep their own passwords secure. I was a little surprised to see it in the Immigration and Citizenship page on Canada.ca. When you visit the site, you load up the Adobe visitor javascript (so you can block it if you want) and the tracking begins. This may be an attempt by Canada.ca to track you across all departments.

The Immigration and Citizenship page also uses a technical tracker. The intent is less for analytics than for developers to understand site use. In this case, you’d just have to rely on the agency to know how the compiled data was being used.

A screenshot from Canada.ca showing a tracker from go-mpulse.

Global Affairs Canada (similar to the U.S. State Department) was the most egregious site for gathering information. A visitor to that site is potentially being tracked by three services: Adobe, Google Analytics, and Webtrends.

A screenshot from Global Affairs Canada’s site showing analytics trackers from Google and Webtrends. Adobe is blocked elsewhere by the browser.

I think it is reasonable to hope that a government agency can get enough data from a single service. Webtrends has done a good job of eking out business in the face of javascript based services like Google and Adobe. An organization might choose Webtrends if only because there is less likelihood of cross-site tracking and aggregation. I think three services is probably an unnecessary gathering of data.

Municipalities

I was curious about how towns and cities were different. Someone looking for a by-law may end up at a municipality that wants a web presence but can’t afford much. These may be more likely to have trackers – intentionally or not – because they are smaller and may need to outsource more. As the article linked at the top of this post found, sometimes organizations with few resources find free web sites come with strings attached.

I was impressed at first by Toronto, which appeared to have no trackers. But it is using Oracle Infinity for analytics. It’s a good example of when the browser does not recognize the tracker and so doesn’t warn you about it. If I hadn’t been using a javascript blocker, I might not have noticed it was trying to load its analytics script.

A screenshot of the Toronto city web site showing no trackers. But Firefox missed the one from Oracle.

My own town wins for the most trackers. The hosted search engine from Cludo sets a tracking cookie, which I’m guessing is to look at search statistics. There’s Facebook, just as you’d expect. And one for a sketchy service called GetClicky. I mean, if you saw an app try to install itself on your computer called GetClicky, you’d probably block it. And, naturally, Google Analytics. Like Global Affairs, it is questionable why they’d need both analytics from Clicky and from Google Analytics.

In my case, GetClicky is another of those marketing sites that I’m blocking across the computer. And Facebook is, of course, an auto-block. To my town, I’m invisible.

All in all, this is pretty good to know. Most of the government sites are doing the bare minimum of analytics gathering. It’s still not clear to me that any of them need commercial products. I’d be concerned about cross-site tracking and segmentation of my identity. As browser developers – who also unfortunately happen to be ad companies and analytics vendors – move away from tracking tools like cookies, we may have to start looking for other tracking tools in our legal research work.