This is the second in a series of articles looking at the tracking, advertising, and fingerprinting practices from popular web sites. In article one, I looked at the New Yorker site and gave a broad overview of the tracking content on their main page. That article can be found here:
Tracker Horror #1 - The New Yorker
In this article, I’ll take a look at one of the individual trackers, BounceX, in more detail. As a reminder, all tracking and advertising content detailed in these articles is being displayed while I am logged into the New Yorker site as a paid subscriber.
When loading the New Yorker home page with all of my extensions and tracking protection turned off, Firefox detects 3 Bounce Exchange domains listed as conducting fingerprinting:
So first of all, what does Bounce Exchange do as a company? According to the about page on the company’s home page:
“We unlock the power of one. The power of one-offs and one-of-a-kinds. The freedom of individuals to choose the kind of internet they want. An internet that can bring brands and people closer together. Where ‘web traffic’ becomes living, breathing customers whose wants and needs can be met with unique experiences. Let’s unleash the power of one-to-one.”[1]
Alright so that’s a bunch of marketing nonsense, and we still don’t know anything.
Let’s try Wikipedia instead. Unfortunately, there does not seem to be a Wikipedia entry for BounceX, Bounce Exchange, or the newest name, Wunderkind. This is a bit strange given that apparently this is a company with a “post-money valuation in the range of $100M to $500M as of May 3, 2018, according to PrivCo.” [2]. As early as 2016, they had “about a dozen Fortune 500 companies as customers, as well as dozens of popular internet retailers and eight of the world’s 10 largest publishers.” [3]
Ok so we have a relatively large operation with no Wikipedia entry and only vague notions of what they concretely do on the main pages of their own web site. So we’ll resort to other 3rd party sources to get a good idea.
Inc. Magazine wrote an article about the company in 2016 and describes their service as follows:
“What Bounce Exchange does specifically is monitor where site traffic comes from - examples being ads, Google searches, and social media - and what customers do on websites. Someone who stays on a news site for an extended period reading multiple articles may be prompted to share his or her email address or pitched a paid subscription, for example, while someone who reads half of one story and then leaves might simply be served an ad.”[3]
Here is another description from a 2017 Forbes article about BounceX:
“The BounceX platform gathers and analyzes the behavioral data of every individual that arrives on a website, creating a digital footprint for them in real-time. Based on that information, brands can create more relevant, targeted marketing experiences that resonate and respond to the individual in question.”[4]
So the idea of the company is to personally identify anonymous users on a company’s website, predict how long they will stay on the website before they “bounce” (leave the site) and then decide how to properly market the company to that person. Or if they won’t be able to sell that person a product, at least extract maximum value from them by serving advertisements. They use a variety of techniques such as javascript pop-ups to try to capture a user’s e-mail address or simply capturing the time it takes for a user to close the popup to help determine the user’s future behavior on the site.
So in essence, the company offers a set of tools to identify, track, and market to users to extract the most possible value from their visits to the company’s site. They market their products as being consumer-friendly because they can give users the experience that they want from the site they are visiting. Bullshit. This is just another marketing company that provides no consumer value, tracks individuals without their consent, and tries to extract value from people with targeted advertisements and product marketing. They are the epitome of deceptive, disgusting, and opaque internet marketing that makes the modern web a terrible experience.
So let’s look at the Firefox developer’s console to see if we can figure out what BounceX is specifically doing. The first thing we find when loading the New Yorker home page with all tracker blocking disabled is a cookie from assets.bounceexchange.com which is storing data about the session. We can see that this is not a session cookie that expires whenever we leave the site. This is a permanent cookie with a hard-set expiration time which will stick around after leaving the page until the set cookie expiration date. Aside from this detail, this is a standard cookie using a unique identifier to track our behavior across the website so BounceX knows that all of the activity comes from a single user.
Next, looking at the debugger in the Firefox console, we can look at the javascript file (init1.js) loaded from the api.bounceexchange.com domain during the initial load of the home page. This script has run and returned identifying information about us which can be viewed in bouncex.init1Response at the bottom of the file. The following information about my visit to the site is listed here, so all of the following is being gathered by the BounceX API:
Also note that if I am not signed into the site and reload the page, there are even more calls to the api.bounceexchange.com domain. There is so much “content” from outside domains that the site takes nearly 10 seconds to fully load everything, and the vast majority of the data transfer is not used for actual New Yorker content. It’s just an enormous, bloated mess of advertisements and trackers, and BounceX is but one contributor.
So just from the info discussed above, all I have to do is load the home page of the New Yorker for the third-party company BounceX to be given all of the information above. They can then store all of that information and track me across the New Yorker’s site (at a minimum) and associate every mouse move, every scroll, and every action duration (among other things) I take on the site. They can then record all of that info and, especially if I am signed into the site or have shared my e-mail address anywhere on the site, tie all of this behavior to my personal identity quite trivially. I do not know the full extent of what BounceX is doing with all this personal data, but it is very clearly being collected and sold as a service.
As mentioned in my last article, BounceX is one of 121 domains being called for a single page load of the New Yorker front page. BounceX is the first one that I looked at in any detail, but there are dozens more that are being called specifically for the purpose of tracking, advertising, fingerprinting, or other marketing. Facebook, Google, Snapchat, Tiktok, Amazon, KeyWee, LinkedIn, Pinterest, Yahoo, and Twitter are all there, and that’s just the easily recognizable domains.
Next article I’ll likely pick another one of these trackers and go into a bit more technical depth to examine exactly how data is being collected and used.
1. Wunderkind: About Us Retrieved 12/24/2020.
2. Crunchbase - Bounce Exchange Company Financials Retrieved 12/24/2020.
3. Inc. - Bounced Exchange Retrieved 12/24/2020.
4. Forbes - The Dirty Little Secret Retrieved 12/24/2020.
