  Trackers have recently started to mix tracking and functional resources to
circumvent privacy-enhancing content blocking tools. Such mixed web resources
put content blockers in a bind: risk breaking legitimate functionality if they
act and risk missing privacy-invasive advertising and tracking if they do not.
In this paper, we propose TrackerSift to progressively classify and untangle
mixed web resources (that combine tracking and legitimate functionality) at
multiple granularities of analysis (domain, hostname, script, and method).
Using TrackerSift, we conduct a large-scale measurement study of such mixed
resources on 100K websites. We find that more than 17% domains, 48% hostnames,
6% scripts, and 9% methods observed in our crawls combine tracking and
legitimate functionality. While mixed web resources are prevalent across all
granularities, TrackerSift is able to attribute 98% of the script-initiated
network requests to either tracking or functional resources at the finest
method-level granularity. Our analysis shows that mixed resources at different
granularities are typically served from CDNs or as inlined and bundled scripts,
and that blocking them indeed results in breakage of legitimate functionality.
Our results highlight opportunities for finer-grained content blocking to
remove mixed resources without breaking legitimate functionality.
