  Thanks to HTML5, users can now view videos on Web browsers without installing
plug-ins or relying on specific devices. In 2017, W3C published Encrypted Media
Extensions (EME) as the first official Web standard for Digital Rights
Management (DRM), with the overarching goal of allowing seamless integration of
DRM systems on browsers. EME has prompted numerous voices of dissent with
respect to the inadequate protection of users. Of particular interest, privacy
concerns were articulated, especially that DRM systems inherently require
uniquely identifying information on users' devices to control content
distribution better. Despite this anecdotal evidence, we lack a comprehensive
overview of how browsers have supported EME in practice and what privacy
implications are caused by their implementations. In this paper, we fill this
gap by investigating privacy leakage caused by EME relying on proprietary and
closed-source DRM systems. We focus on Google Widevine because of its
versatility and wide adoption. We conduct empirical experiments to show that
browsers diverge when complying EME privacy guidelines, which might undermine
users' privacy. For instance, we find that many browsers gladly give away the
identifying Widevine Client ID with no or little explicit consent from users.
Moreover, we characterize the privacy risks of users tracking when browsers
miss applying EME guidelines regarding privacy. Because of being closed-source,
our work involves reverse engineering to dissect the contents of EME messages
as instantiated by Widevine. Finally, we implement EME Track, a tool that
automatically exploits bad Widevine-based implementations to break privacy.
