Speed and bandwidth improvements with Firefox Tracking Protection

Browser safeguards that block web-tracking technology are usually touted for the privacy gains that they offer to users. But recent research from Mozilla reveals yet another benefit: substantially increased web-browsing performance. The researchers studied the effects of Firefox's built-in Tracking Protection feature, and measured a roughly 40% reduction in load times and data usage—on certain sites—as a result.

The Tracking Protection feature was introduced in Firefox 35. It relies on a human-curated blacklist of untrusted domains; when the feature is enabled, Firefox intercepts and removes all outgoing HTTP requests to blacklisted domains. The human-curated list lets Firefox block not just simple cookies, but more sophisticated measures as well—while preventing the site-breakage that can accompany a broad content-blocking policy.

The ill effects of web trackers are well known, of course. In addition to the obvious (disclosing large amounts of personal data to advertisers), there are also law-enforcement programs, government and corporate espionage, and even healthcare companies that may be interested in observing one's habits. No doubt there are new buyers for such tracking information every day.

As of now, Firefox Tracking Protection must be enabled by the user manually changing the privacy.trackingprotection.enabled setting to true in Firefox's about:config page. It is a distinct feature from Firefox's Do Not Track user preference (which sends a header that, regrettably, many sites simply choose to ignore). The closest comparison is probably to the Electronic Frontier Foundation (EFF) add-on Privacy Badger—though Privacy Badger uses heuristics, rather than a blacklist, to decide which trackers to block.

The Tracking Protection feature grew out of Mozilla's Polaris initiative, a collaboration with the EFF and Stanford University's Center for Internet and Society (CIS). Back in 2013, CIS and Mozilla had investigated using a public Cookie Clearinghouse as the basis for its blacklist; the current Firefox Tracking Protection feature uses the Disconnect blacklist as its base instead.

On May 21, the results of Tracking Protection research by Georgios Kontaxis from Columbia University and Monica Chew (until recently, of Mozilla) were announced. Their paper [PDF] was presented at the IEEE's Web 2.0 Security and Privacy workshop, where it won the "best paper" award.

The paper describes how Tracking Protection works in more detail. The blacklist contains around 1500 domains and is updated every 45 minutes in order to minimize interruptions caused by false positives. The list is not exposed in the user interface; it is transmitted and amended in hashed form using Mozilla's implementation of the Safe Browsing API to protect again interception. To test its performance, Kontaxis and Chew used a Mozmill-instrumented version of Firefox to visit the top 200 news sites on Alexa, tracking the difference between a default Firefox configuration, one with Tracking Protection enabled, and one with AdBlock plus enabled.

The results recorded 4006 cookies with the default configuration, 2398 cookies with AdBlock Plus, and 1300 cookies with Tracking Protection. The statistics collected show that 50% of these top news sites include eleven or more trackers—although one (unnamed) site included 150. Perhaps more importantly, the feature also blocks requests for other resource types. The paper says that 79% of the requested elements were JavaScript, for example, and 14% were images.

The cumulative effect of blocking all of these blacklisted requests is perhaps the most startling result of the research. The team found that the median time needed to load a page went down by 44% when Tracking Protection was enabled, and the median amount of total data transferred was reduced by 39%.

Those numbers will no doubt sound appealing to many users—especially those who pay for bandwidth on a per-megabyte basis. Interestingly enough, the paper concludes with a look at user behavior. In addition to the aforementioned laboratory tests, the team also used Firefox's Telemetry framework to measure real-world usage by Firefox Nightly users between December 25, 2014 and January 7, 2015.

Just 0.5% of Firefox Nightly users enabled Tracking Protection during the study period. The numbers might be higher today, particularly in light of the speed improvements reported, but significant gains may only be achievable if the browser maker does more to make the feature easy to enable. As the paper's conclusion notes:

Since neither Kontaxis nor Chew are employed by Mozilla at present, it is only speculation to suggest that future versions of Firefox might ship with Tracking Protection switched on—although seeing it moved from an about:config option to a checkbox in Firefox's "Privacy" settings tab does not seem out of the question.

In the meantime, users of Firefox 35 and later who have not enabled Tracking Protection will probably be pleased to learn its performance characteristics. Among other details, the paper notes that Tracking Protection seems to result in far less page-breaking incidents (that is, situations where blocking a suspected tracker has the side effect of making the site unusable) than using Privacy Badger. Similarly, it points to research indicating that AdBlock Plus imposes CPU overhead that many users find unacceptable.

Perhaps the most significant distinction between AdBlock Plus, Privacy Badger, and Tracking Protection, though, is the fact that Tracking Protection is a built-in feature not a third-party add-on. In her blog announcement about the paper, Chew challenged Mozilla's leadership to "recognize that current advertising practices that enable 'free' content are in direct conflict with security, privacy, stability, and performance concerns -- and that Firefox is first and foremost a user-agent, not an industry-agent."

Should Mozilla accept that challenge, the online advertising industry will no doubt look for new methods to work its way into the browsing experience. But a 40% improvement over the speeds and data costs of the current state of affairs is hard to ignore—even without user privacy at stake.