# PURL: Safe and Effective Sanitization of Link Decoration

arXiv: https://arxiv.org/abs/2308.03417 · HTML: https://mlsanity.com/paper/2308.03417/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 11 of its 110 references that are in the map.
- First posted on arXiv 7 Aug 2023.

## Builds on (most cited first, 11 of 11)

- [Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation](https://mlsanity.com/paper/1806.01156/) (2018)
- [Fingerprinting the Fingerprinters: Learning to Detect Browser Fingerprinting Behaviors](https://mlsanity.com/paper/2008.04480/) (2020)
- [WebGraph: Capturing Advertising and Tracking Information Flows for Robust Blocking](https://mlsanity.com/paper/2107.11309/) (2021)
- [Cookie Synchronization: Everything You Always Wanted to Know But Were Afraid to Ask](https://mlsanity.com/paper/1805.10505/) (2018)
- [Modeling and Measuring Graph Similarity: The Case for Centrality Distance](https://mlsanity.com/paper/1406.5481/) (2014)
- [Missed by Filter Lists: Detecting Unknown Third-Party Trackers with Invisible Pixels](https://mlsanity.com/paper/1812.01514/) (2018)
- [COOKIEGRAPH: Understanding and Detecting First-Party Tracking Cookies](https://mlsanity.com/paper/2208.12370/) (2022)
- [The CNAME of the Game: Large-scale Analysis of DNS-based Tracking Evasion](https://mlsanity.com/paper/2102.09301/) (2021)
- [JSForce: A Forced Execution Engine for Malicious JavaScript Detection](https://mlsanity.com/paper/1701.07860/) (2017)
- [FP-Radar: Longitudinal Measurement and Early Detection of Browser Fingerprinting](https://mlsanity.com/paper/2112.01662/) (2021)
- [The Hitchhiker's Guide to Facebook Web Tracking with Invisible Pixels and Click IDs](https://mlsanity.com/paper/2208.00710/) (2022)

## Built on by (most cited first, 1 of 1)

- [An In-Depth Investigation of Data Collection in LLM App Ecosystems](https://mlsanity.com/paper/2408.13247/) (2024)

## Abstract (arXiv)

While privacy-focused browsers have taken steps to block third-party cookies and mitigate browser fingerprinting, novel tracking techniques that can bypass existing countermeasures continue to emerge. Since trackers need to share information from the client-side to the server-side through link decoration regardless of the tracking technique they employ, a promising orthogonal approach is to detect and sanitize tracking information in decorated links. To this end, we present PURL (pronounced purel-l), a machine-learning approach that leverages a cross-layer graph representation of webpage execution to safely and effectively sanitize link decoration. Our evaluation shows that PURL significantly outperforms existing countermeasures in terms of accuracy and reducing website breakage while being robust to common evasion techniques. PURL's deployment on a sample of top-million websites shows that link decoration is abused for tracking on nearly three-quarters of the websites, often to share cookies, email addresses, and fingerprinting information.