Data processing systems and methods for automatically blocking the use of tracking tools
Data processing systems and methods, according to various embodiments, are adapted for determining a categorization for each tracking tool that executes on a particular webpage based on a variety of criteria, such as the purpose of the tracking tool and its source script. The system may compare the characteristics of tracking tools on a webpage to a database of known tracking tools to determine the appropriate categorization. When a user visits the webpage, the system analyzes these categories and determines whether the tracking tool should be permitted to run based on the categories and/or other criteria, such as whether the user has consented to the use of that type of tracking tool.
1. A method comprising:
scanning, by computing hardware, a webpage to identify a tracking tool that is associated with the webpage;
identifying, by the computing hardware, a source script executed during loading of the webpage, wherein the source script invokes the tracking tool;
determining, by the computing hardware, a category for the tracking tool by comparing data associated with at least one of the tracking tool or the source script to known tracking tool data;
generating, by the computing hardware, a data set, wherein the data set associates the source script with the tracking tool and the category;
generating, by the computing hardware, program code, wherein the program code is configured to, during a loading of the webpage to be viewed by a user via a browser and prior to execution of the source script:
detect that the source script is attempting to execute,
identify, based on the source script, the category from the data set;
determine that the category has not been authorized by the user; and
responsive to determining that the category has not been authorized by the user, block the source script from executing to invoke the tracking tool.
2. The method of claim 1 , wherein the data associated with the tracking tool comprises at least one of a source of the tracking tool, a purpose of the tracking tool, a type of personal data collected by the tracking tool, or a host of the tracking tool.
3. The method of claim 1 , wherein the program code comprises a script that is run first on the webpage when the webpage is being loaded by the browser.
4. The method of claim 1 , wherein the program code is further configured to, responsive to determining that the category has not been authorized by the user:
generate a prompt requesting consent from the user to authorize the category,
receive the consent from the user, and
responsive to receiving the consent, allow the source script to execute to invoke the tracking tool.
5. The method of claim 1 , wherein generating the program code comprises embedding the data set in the program code.
6. The method of claim 1 , wherein identifying the source script comprises:
reviewing, by the computing hardware, a response header sent by a host server associated with the tracking tool in response to the host server receiving a Hyper Transfer Protocol (HTTP) request to identify the host server; and
matching, by the computing hardware and based on the host server, the source script with the tracking tool.
7. The method of claim 1 , wherein the category comprises at least one of a functionality cookie type, a performance cookie type, a targeting cookie type, or a strictly necessary cookie type.
8. A system comprising:
a server comprising
a non-transitory computer-readable medium storing instructions; and
a processing device communicatively coupled to the non-transitory computer-readable medium,
wherein, the processing device is configured to execute the instructions and thereby perform operations comprising:
receiving a Hypertext Transfer Protocol (HTTP) request to render a webpage; and
responsive to receiving the HTTP request, sending a HTTP response comprising a script to a computing device associated with a user; and
the computing device, wherein the computing device is configured to execute, within a browser and during a loading of the webpage prior to execution of a source script, the script to perform additional operations comprising:
identifying the source script attempting to execute;
identifying the source script is configured to invoke a tracking tool based on information on the tracking tool found in a data set embedded in the script;
identifying a category associated with the tracking tool based on the information on the tracking tool found in the data set;
determining that the category has not been authorized by the user; and
responsive to determining that the category has not been authorized by the user, blocking the source script from executing to invoke the tracking tool.
9. The system of claim 8 , wherein the computing device is configured to execute the script to perform additional operations comprising, responsive to determining that the category has not been authorized by the user:
generate a prompt requesting consent from the user to authorize the category;
receive the consent from the user; and
responsive to receiving the consent, allow the source script to execute to invoke the tracking tool.
10. The system of claim 9 , wherein the computing device is configured to execute the script to perform additional operations comprising recording the consent in a remote consent data structure indicating the user has granted the consent authorizing the category.
11. The system of claim 8 , wherein blocking the source script from executing comprises:
prompting the user for consent for authorization for the category;
receiving a denial of the consent; and
responsive to receiving the denial, preventing the source script.
12. The system of claim 8 , wherein the computing device is configured to execute the script to perform additional operations comprising:
identifying a second source script attempting to execute;
identifying the second source script is configured to invoke a second tracking tool based on additional information on the second tracking tool found in the data set embedded in the script;
identifying a second category associated with the second tracking tool based on the additional information on the second tracking tool found in the data set;
determining that the second category has been authorized by the user; and
responsive to determining that the second category not been authorized by the user, allowing the second source script to execute to invoke the second tracking tool.
13. The system of claim 12 , wherein determining that the second category has been authorized by the user comprises accessing a remote consent data structure that indicates the user had previously granted consent authorizing the second category.
14. The system of claim 8 , wherein the category comprises at least one of a functionality cookie type, a performance cookie type, a targeting cookie type, or a strictly necessary cookie type.
15. A non-transitory computer-readable medium having program code that is stored thereon, the program code executable by one or more processing devices for performing operations comprising:
loading a webpage;
during the loading of the webpage:
identifying a tracking tool associated with the webpage;
identifying a source script executed, wherein the source script invokes the tracking tool during the loading of the webpage;
determining a category for the tracking tool by comparing data associated with at least one of the tracking tool or the source script to known tracking tool data;
generating a data set, wherein the data set associates the source script with the tracking tool and the category;
generating program code, wherein the program code is configured to, during the loading of the webpage to be viewed by a user and prior to execution of the source script:
detect that the source script is attempting to execute,
identify, based on the source script, the category from the data set;
determine that the category has not been authorized by the user; and
responsive to determining that the category has not been authorized by the user, block the source script from executing to invoke the tracking tool.
16. The non-transitory computer-readable medium of claim 15 , wherein the data associated with the tracking tool comprises at least one of a source of the tracking tool, a purpose of the tracking tool, a type of personal data collected by the tracking tool, or a host of the tracking tool.
17. The non-transitory computer-readable medium of claim 15 , wherein the program code comprises a script that is run first on the webpage when the webpage is being loaded.
18. The non-transitory computer-readable medium of claim 15 , wherein the program code is further configured to, responsive to determining that the category has not been authorized by the user:
generate a prompt requesting consent from the user to authorize the category,
receive the consent from the user, and
responsive to receiving the consent, allow the source script to execute to invoke the tracking tool.
19. The non-transitory computer-readable medium of claim 15 , wherein generating the program code comprises embedding the data set in the program code.
20. The non-transitory computer-readable medium of claim 15 , wherein identifying the source script comprises:
reviewing a response header sent by a host server associated with the tracking tool in response to the host server receiving a Hyper Transfer Protocol (HTTP) request to identify the host server; and
matching, based on the host server, the source script with the tracking tool.