The Third Party

Start Here

Mon, 01 Jan 0001 00:00:00 +0000

This site argues that the web you use is not quite the web you think you're using, and that the difference is measurable rather than a matter of opinion. It is not a demand that you change your life. It's a set of explanations, each of which ends with something you could do about it, and none of which requires you to do anything.

If you take one thing from this page, take this: the honest answer to "should I care about all of this?" is no, not all of it. Pick one thing. That's the design.

One Page Load

Mon, 01 Jan 0001 00:00:00 +0000

You opened a page. You didn't type anything, log in, click anything, or agree to anything. You just arrived, and the page loaded.

What follows is a reconstruction of what happens next on a typical commercial site, the kind with advertising, analytics, and a social embed or two. It is not a capture of your session; this page has no idea who you are and collects nothing. It's assembled from the published documentation of the systems involved, which is the useful part: none of this is secret, and most of it is described by the companies doing it, in their own developer guides, to the people they're selling to.

What Leaves Your Browser

Mon, 01 Jan 0001 00:00:00 +0000

A page takes about a second to load. In that second (before you type anything, log in, click anything, or agree to anything), a request has already left your device carrying a numeric address that identifies your network, a string describing your browser and operating system, the address of the page that sent you there, and whatever your browser volunteered about its own screen, language, timezone, and capabilities.

That is before any cookie. Before any account. Before you have been asked anything, because you have not been asked yet.

Nine Things People Say

Mon, 01 Jan 0001 00:00:00 +0000

In August 2006, AOL published a file it believed was anonymous.

It held around 20 million search queries from roughly 658,000 users, each person replaced by a number. No names, no addresses, nothing that identified anybody: by the standards of the day, a model release.

Within days, two reporters had identified user 4417749 as Thelma Arnold, a 62-year-old widow in Lilburn, Georgia. They worked it out from her searches: the surnames of people she knew, a landscaper she was considering, a three-digit number she looked up again and again, and the phrase numb fingers, which described her own symptoms. "We all have our moments of weakness," she said, when they called. ¹

Seven Things That Aren't True

Mon, 01 Jan 0001 00:00:00 +0000

Privacy advice is full of sentences that are almost true, which is worse than being false, because almost-true things survive scrutiny long enough to become habits. Each myth below comes with a way to check it in a browser rather than taking my word for it. Where a check needs more than a minute, I've said so.

The Dark Patterns Field Guide

Mon, 01 Jan 0001 00:00:00 +0000

You have almost certainly been manipulated by a piece of interface design today. Not persuaded, manipulated, which is a different thing: the interface was arranged so that the option you'd have chosen with full attention is harder to choose than the option that profits someone else.

The term was coined in 2010 by the user-experience designer Harry Brignull, who catalogued these practices and gave them names. ³ He has since argued that "dark patterns" is too soft a phrase for what's happening, and now prefers deceptive design, because "dark" sounds like an aesthetic, and the practice is a form of deception. This site uses both, with a preference for the accurate one.

Consent Theatre

Mon, 01 Jan 0001 00:00:00 +0000

There is a specific kind of tired you only get from a cookie banner.

Receipts

Mon, 01 Jan 0001 00:00:00 +0000

Every other page here asks you to check its sources. This one turns the same standard on the site itself, and it is deliberately nothing but numbers: what a page load costs, what the host sends, what could not be measured, what is broken, and what it emits.

How these numbers were taken

The site is built with sh scripts/build.sh, which runs four checks and then renders public/. The figures below were read out of that built directory rather than estimated, except those under "What the host sends", which were taken from the live site with curl. The served sizes are always a little larger than the local ones, because the host compresses at a looser setting, so the local gzip -9 figures are the ones you can rebuild and check.

You Don't Need Google Analytics

Mon, 01 Jan 0001 00:00:00 +0000

Open your analytics dashboard and try to remember the last time you looked at anything other than the same three or four numbers.

Most site owners can't. And that's not a failure of discipline. It's what the tool is for. The overwhelming majority of what a full-featured analytics platform measures exists to serve the business model of the company that gives it away, not to answer the questions of the person running the site.

The Swap Shop

Mon, 01 Jan 0001 00:00:00 +0000

Every page like this one turns into an advertisement, because the natural way to write it is a list of better products. So this page has a rule:

Every swap states what you give up. Not as a formality, as the most useful field on the page. A recommendation that doesn't tell you its cost isn't a recommendation, it's marketing, and you have no way to decide whether it applies to you.

Sources

Mon, 01 Jan 0001 00:00:00 +0000

A site that tells you to check things had better be checkable itself. So this page is the whole apparatus: every source this site rests on, what each one is used for, what each one is bad at, and the ones I could not confirm.

There is no short version. A bibliography that lists titles and nothing else is a decoration.

How a source gets in

Every factual claim gets a dated, linked source. If a claim cannot be sourced, it is not stated. That rule has already cost this site two sentences, both deliberately: a widely repeated fingerprintability percentage was left out rather than guessed, and the Web Almanac's numbers are pointed at rather than quoted, because today's figures will not be next year's.
Primary sources first: the ruling, the study, the regulator's decision, the project's own documentation. News coverage only when it is the only record of something, and the entry says so when it is.
Two kinds of link, kept apart. A citation is a claim and is recorded below. A plain link ("here is the project's website") is a pointer, and is not. Blurring the two is how a bibliography turns into a link dump.
Every source records what it is bad at. That is the difference between a bibliography and a decoration, and it is the field I would defend hardest. A source with no weakness is a source I have not read carefully.
Anything legal or policy carries a date, on the page and in the entry, because enforcement positions move and a legal claim without a date is a claim about the past pretending to be about now.

What "verified" means, and what it does not

Verified means one thing: on the date recorded, a person opened the link and confirmed that the page exists and carries the claim attached to it.