Category: Technology

What indie tech writers get wrong about API tracking

Doug AlexanderLeave a comment

I’ve been reading a lot of indie tech writing lately—mostly good stuff, thoughtfully reported—but there’s this recurring blind spot about API tracking that’s bugging me. A lot of writers treat APIs like they’re some kind of secret back door that companies use to circumvent your privacy settings. The reality’s weirder and more interesting than that.

Here’s what I mean. Last month I was debugging a tracking issue on a site I was auditing, and I found myself explaining to a colleague why the API call itself isn’t the problem. The API is just the mechanism. It’s like saying “telephone lines are how companies spy on you”—technically true, but it misses the entire point. What matters is what data gets passed through that API, who can access it, and whether you consented to it. I’ve seen writers describe a perfectly innocent API integration as “shadowy data exfiltration” when really it’s just a newsletter signup service doing what it’s supposed to do. The company should definitely be transparent about it, sure. But calling it tracking when it’s not is just sloppy analysis.

The other thing that gets me is the assumption that indie tracking and corporate tracking are fundamentally different beasts. They’re not. I ran into this when I was looking at how smaller publishers were using data—turns out they were making identical architectural decisions as the big players, except with less engineering resources and zero compliance infrastructure. That’s actually more dangerous in some ways. A massive ad network at least has lawyers screaming at them. A scrappy startup with an API just shrugs and ships.

So when you’re reading about API tracking, ask yourself: what’s actually being sent? Who’s receiving it? Did someone opt in? Those are the real questions. The API itself is just plumbing. Don’t mistake the pipes for the problem.

Browser Fingerprinting Has Made the Cookie Wars Irrelevant

dougalexanderLeave a comment

The years of argument about third-party cookies — Google’s deprecation timeline, the privacy advocates, the ad industry’s resistance — have always had a slightly unreal quality to me, because the underlying tracking capability that cookies enabled was already being replicated by other means before the cookie conversation started.

Browser fingerprinting is the main one. Your browser, in the course of normal operation, exposes enough information to identify you with high reliability: the combination of your browser version, operating system, screen resolution, installed fonts, timezone, language settings, hardware capabilities reported through WebGL and Canvas, and dozens of other signals produces a fingerprint that is, in practice, unique for most users. Unlike a cookie, it requires no storage on your device and leaves no trace you can delete. You can’t opt out of it in any meaningful way using standard browser controls.

The techniques are well documented and have been for years. The Electronic Frontier Foundation’s Cover Your Tracks tool will show you your fingerprint and how unique it is. For most users on most browsers, the answer is: very unique.

The practical implication is that the privacy gains from blocking third-party cookies are real but limited. The tracking infrastructure that uses fingerprinting — and that uses first-party cookies set on third-party domains through redirect chains, and that uses device graph matching across logged-in services — doesn’t need third-party cookies to function. Deprecating them raises the cost of tracking slightly and changes which companies can do it effectively, but it doesn’t change the underlying dynamic.

This isn’t an argument for fatalism. Tor Browser and Firefox with the right configuration do meaningfully reduce fingerprinting surface. The point is that single-mechanism solutions to a multi-mechanism problem tend to shift the problem rather than solve it.