Earlier this year, an editor working on The Times’s Privacy Project asked me whether I’d be interested in having all my digital activity tracked, examined in meticulous detail and then published — you know, for journalism. “Hahaha,” I said, and then I think I made an “at least buy me dinner first” joke, but it turned out he was serious. What could I say? I’m new here, I like to help, and, conveniently, I have nothing whatsoever at all to hide.
Like a colonoscopy, the project involved some special prep. I had to install a version of the Firefox web browser that was created by privacy researchers to monitor how websites track users’ data. For several days this spring, I lived my life through this Invasive Firefox, which logged every site I visited, all the advertising tracking servers that were watching my surfing and all the data they obtained. Then I uploaded the data to my colleagues at The Times, who reconstructed my web sessions into the gloriously invasive picture of my digital life you see here. (The project brought us all very close; among other things, they could see my physical location and my passwords, which I’ve since changed.)
What did we find? The big story is as you’d expect: that everything you do online is logged in obscene detail, that you have no privacy. And yet, even expecting this, I was bowled over by the scale and detail of the tracking; even for short stints on the web, when I logged into Invasive Firefox just to check facts and catch up on the news, the amount of information collected about my endeavors was staggering.
Tracking Resources
Each dot represents one tracking resource (like a script, tracking pixel or image), which would be blocked by an ad-blocker
Amazon
Collects my latitude and longitude
Trackers sharing unique ID
Start of the day
11:56AM
Google.com/search
11:56AM
News.google.com
11:58AM
News.google.com
12:24PM
Google.com/search
12:24PM
12:24PM
Go.peteforamerica.com
Google.com/search
11:58AM
12:23PM
Huffpost.com
Washingtonpost.com
11:58AM
News.google.com
12:24PM
Peteforamerica.com
11:58AM
12:24PM
Freebeacon.com
Peteforamerica.com
12:23PM
12:27PM
Medium.com
Google.com/search
Twitter tracking script
11:59AM
12:23PM
12:37PM
Google.com/search
Google.com/search
Google.com/search
12:37PM
Google.com/search
12:22PM
Vanityfair.com
12:37PM
Youtube.com
12:51PM
12:22PM
Google.com/search
Google.com/search
12:22PM
Google.com/search
12:51PM
12:07PM
Nytimes.com
Google.com/search
11:59AM
Washingtonpost.com
12:52PM
My unique identifier
shared across sites
Nytimes.com
03:15PM
12:52PM
Medium.com
Nytimes.com
01:36PM
Stratechery.com
03:15PM
Medium.com
12:53PM
01:35PM
Washingtonpost.com
Techmeme.com
01:00PM
Google.com/search
03:16PM
Elizabethwarren.com
01:13PM
Google.com/search
01:01PM
Huffpost.com
01:13PM
03:16PM
Google.com/search
Elizabethwarren.com
01:12PM
Google.com/search
End of the day
01:04PM
Google.com/search
03:17PM
Elizabethwarren.com
Tracker with browser details
01:11PM
Time.com
01:11PM
01:04PM
Google.com/search
Washingtonpost.com
01:06PM
01:06PM
Medium.com
Google.com/search
Tracking Resources
Amazon
Collects my location
Trackers sharing unique ID
Each dot represents one tracking resource (like a script, tracking pixel or image), which would be blocked by an ad-blocker
Start of the day
11:56AM
Google.com/search
11:56AM
News.google.com
11:58AM
News.google.com
11:58AM
Huffpost.com
Tracker with location
11:58AM
News.google.com
11:58AM
Freebeacon.com
Twitter tracking script
11:59AM
11:59AM
Washingtonpost.com
12:07PM
Google.com/search
12:22PM
My unique identifier shared across sites
12:22PM
12:22PM
Vanityfair.com
12:23PM
Google.com/search
12:23PM
Medium.com
12:23PM
Washingtonpost.com
12:24PM
Google.com/search
12:24PM
Google.com/search
12:24PM
Go.peteforamerica.com
12:24PM
Peteforamerica.com
12:24PM
Peteforamerica.com
12:27PM
12:37PM
Google.com/search
12:37PM
12:37PM
Youtube.com
12:51PM
Google.com/search
12:51PM
Nytimes.com
12:52PM
Nytimes.com
12:52PM
Nytimes.com
12:53PM
Washingtonpost.com
01:00PM
Google.com/search
01:01PM
Huffpost.com
01:04PM
Google.com/search
01:04PM
Washingtonpost.com
Tracker with browser details
01:06PM
Google.com/search
01:06PM
Medium.com
01:11PM
Google.com/search
01:11PM
Time.com
01:12PM
Google.com/search
01:13PM
01:13PM
01:35PM
Techmeme.com
01:36PM
Stratechery.com
03:15PM
Medium.com
03:15PM
Medium.com
03:16PM
Elizabethwarren.com
03:16PM
Elizabethwarren.com
End of the day
03:17PM
Elizabethwarren.com
Tracking Resources
Amazon
Collects my latitude and longitude
Trackers sharing unique ID
Start of the day
11:56AM
Google.com/search
11:56AM
News.google.com
11:58AM
Tracker with location
News.google.com
Each dot represents one tracking resource (like a script, tracking pixel or image), which would be blocked by an ad-blocker
11:58AM
News.google.com
11:58AM
Huffpost.com
12:22PM
Vanityfair.com
11:58AM
Freebeacon.com
12:23PM
Google.com/search
Twitter tracking script
12:23PM
Medium.com
11:59AM
12:22PM
Google.com/search
12:22PM
12:23PM
12:07PM
Washingtonpost.com
11:59AM
12:24PM
Washingtonpost.com
Google.com/search
12:24PM
Google.com/search
12:24PM
Go.peteforamerica.com
12:24PM
Peteforamerica.com
12:27PM
12:24PM
Peteforamerica.com
12:37PM
Google.com/search
My unique identifier shared across sites
12:37PM
01:01PM
Huffpost.com
12:37PM
Youtube.com
01:00PM
Google.com/search
12:51PM
12:53PM
Google.com/search
Washingtonpost.com
12:51PM
01:04PM
Nytimes.com
Google.com/search
12:52PM
Nytimes.com
01:04PM
Washingtonpost.com
12:52PM
Nytimes.com
Tracker with browser details
01:06PM
Google.com/search
01:06PM
Medium.com
01:11PM
Google.com/search
01:12PM
01:13PM
Google.com/search
01:11PM
Time.com
01:13PM
01:35PM
Techmeme.com
End of the day
01:36PM
Stratechery.com
03:17PM
Elizabethwarren.com
03:15PM
Medium.com
03:16PM
Elizabethwarren.com
03:15PM
Medium.com
03:16PM
Elizabethwarren.com
The session documented here took place on a weekday in June. At the time, I was writing a column about Elizabeth Warren’s policy-heavy political strategy, which involved a lot of Google searches, a lot of YouTube videos, and lots of visits to news sites and sites of the candidates themselves. As soon as I logged on that day, I was swarmed — ad trackers surrounded me, and, identifying me by a 19-digit number I think of as a prisoner tag, they followed me from page to page as I traipsed across the web.
Looking at this picture of just a few hours online, what stands out to me now is how ordinary a scene it depicts: I didn’t have to visit any shady sites or make any untoward searches — I just had to venture somewhere, anywhere, and I was watched. This is happening every day, all the time, and the only reason we’re O.K. with it is that it’s happening behind the scenes, in the comfortable shadows. If we all had pictures like this, we might revolt.
Trackers sharing unique ID
Approximate
location tracker
11:58AM
Huffpost.com
Where I live
This tracker for Advertising.com received my almost exact location as latitude and longitude — about a quarter mile off from my actual location. Several other trackers gathered information about where I was, including my city, state, country and zip code. They base this off my IP address, so I had no chance to opt-out. They use the data to conduct targeted advertising but can also use it to track where I’m moving and build a more detailed picture of my interests and activities.
Widgets or trackers?
Tracking scripts like this one for Twitter allow websites to add useful features like share buttons. But the scripts often double as trackers meant to record site visits and build profiles about users. In this case, Twitter can use the information about this page to suggest new followers or sell more targeted advertising on its platform.
12:22PM
11:58AM
11:58AM
11:59AM
Vanityfair.com
Huffpost.com
Freebeacon.com
Washingtonpost.com
My unique identifier
shared across sites
01:01PM
12:53PM
12:52PM
12:23PM
Huffpost.com
Washingtonpost.com
Nytimes.com
Washingtonpost.com
11:58AM
Huffpost.com
11:58AM
Freebeacon.com
11:59AM
Washingtonpost.com
12:22PM
Vanityfair.com
12:23PM
Washingtonpost.com
12:52PM
Nytimes.com
12:53PM
Washingtonpost.com
My unique identifier
shared across sites
01:01PM
Huffpost.com
My unique identifier: 5535203407606041218
The internet wasn’t built to track people across websites. But that didn’t stop advertisers. They developed technology to share identifiers among websites. This line connects all trackers that were sharing one of my unique IDs, created by the advertising company AppNexus as I browsed the internet and then stored on my browser for others to use. I had about a dozen IDs shared among sites I visited, but this one was present on eight different pages, shared with nearly a dozen trackers and advertisers including Amazon, Yahoo, Google and lesser-known companies like SpotX and Quantcast.
Tracker with browser details
01:11PM
Time.com
Fingerprinting
Even when companies don’t have an ID to track me, they can use signals from my computer to guess who I am across sites. That’s partly why trackers like this one received more information about my computer than you could imagine being useful, like my precise screen size. Other trackers received my screen resolution, browser information, operating system details, and more.
12:24PM
12:24PM
12:24PM
Peteforamerica.com
03:16PM
03:16PM
03:17PM
Elizabethwarren.com
Election tracking
Websites for Democratic presidential candidates Elizabeth Warren and Pete Buttigieg were also participating in aggressive online tracking. Their sites sent data to Facebook, Twitter, Google, Amazon and about a dozen other third-party trackers. Warren’s site also sent my latitude and longitude to Heap Analytics along with a field indicating whether I was living in an early-primary state (I wasn’t).
News sites were the worst
Among all the sites I visited, news sites, including The New York Times and The Washington Post, had the most tracking resources. This is partly because the sites serve more ads, which load more resources and additional trackers. But news sites often engage in more tracking than other industries, according to a study from Princeton.
Google, Google, everywhere
Google’s own domains don’t contain that many trackers. The same is true for Facebook. But that’s because they place most of their trackers on other websites. Google was present on every site I visited, collecting information on where I live, the device I used and everything I looked at.
Additional reporting and design by Stuart A. Thompson, Jessia Ma and Aaron Krolik. Illustration by Jessia Ma.
Like other media companies, The Times collects data on its visitors when they read stories like this one. For more detail please see our privacy policy and our publisher’s description of The Times’s practices and continued steps to increase transparency and protections.
Follow @privacyproject on Twitter and The New York Times Opinion Section on Facebook and Instagram.
Farhad Manjoo became an opinion columnist for The Times in 2018. Before that, they wrote the State of the Art column. They are the author of “True Enough: Learning to Live in a Post-Fact Society.” @fmanjoo • Facebook
Nadieh Bremer is an award-winning data visualization designer working under the name Visual Cinnamon.