  Over the past years, advertisement companies have used various tracking
methods to persistently track users across the web. Such tracking methods
usually include first and third-party cookies, cookie synchronization, as well
as a variety of fingerprinting mechanisms. Facebook (FB) recently introduced a
new tagging mechanism that attaches a one-time tag as a URL parameter (FBCLID)
on outgoing links to other websites. Although such a tag does not seem to have
enough information to persistently track users, we demonstrate that despite its
ephemeral nature, when combined with FB Pixel, it can aid in persistently
monitoring user browsing behavior across i) different websites, ii) different
actions on each website, iii) time, i.e., both in the past as well as in the
future. We refer to this online monitoring of users as FB web tracking. We find
that FB Pixel tracks a wide range of user activities on websites with alarming
detail, especially on websites classified as sensitive categories under GDPR.
Also, we show how the FBCLID tag can be used to match, and thus de-anonymize,
activities of online users performed in the distant past (even before those
users had a FB account) tracked by FB Pixel. In fact, by combining this tag
with cookies that have rolling expiration dates, FB can also keep track of
users' browsing activities in the future as well. Our experimental results
suggest that 23% of the 10k most popular websites have adopted this technology,
and can contribute to this activity tracking on the web. Furthermore, our
longitudinal study shows that this type of user activity tracking can go as far
back as 2015. Simply said, if a user creates for the first time a FB account
today, FB could, under some conditions, match their anonymously collected past
web browsing activity to their newly created FB profile, from as far back as
2015 and continue tracking their activity in the future.
