← Back to release summary

Bounce Tracking Mitigations on HTTP Cache

Category
Miscellaneous
Type
New or changed feature
Status
Enabled by default (Chrome 134)
Intent stage
None

Summary

Bounce tracking mitigations for the HTTP cache is an extension to existing anti-bounce-tracking behavior. It removes the requirement that a suspected tracking site must have performed storage access in order to activate bounce tracking mitigations. Chrome's initially proposed bounce tracking mitigation solution triggers when a site accesses browser storage (e.g. cookies) during a redirect flow. However, bounce trackers can systematically circumvent such mitigations by using the HTTP cache to preserve data. By relaxing the triggering conditions for bounce tracking mitigations, the browser should be able to catch bounce trackers using the HTTP cache.

Motivation

It's possible to craft a bounce tracker that does not require cookie access and instead uses only the HTTP cache. As a result, there exists a class of bounce trackers that can systematically evade the initially-proposed bounce tracking mitigations. In the scenario where a redirect chain bounces to a stateless tracker that leverages the HTTP cache, the tracker can be caught after the proposed change of dropping the storage access triggering condition.

Standards & signals

Explainers: https://github.com/privacycg/nav-tracking-mitigations/blob/main/explainers/stateless-btm.md

View on chromestatus.com