UC Davis

The web has become an essential part of modern life, yet pervasive tracking increasingly threatens user privacy at scale. As traditional tracking mechanisms face growing regulatory and technical restrictions, advertisers and trackers continuously develop new techniques to circumvent protections. This dissertation presents a comprehensive approach to safeguarding user privacy in this evolving web tracking ecosystem across three themes: machine learning approaches to privacy protection, techno-legal analyses of web privacy, and preserving the integrity of the web ecosystem. The first part develops machine learning-based tools to detect and mitigate emerging tracking techniques. CookieGraph addresses the shift toward first-party tracking cookies using graph-based learning to identify tracking cookies with 93% accuracy, while reducing website breakage compared to blanket cookie blocking. PURL tackles link decoration abuse by safely sanitizing tracking information embedded in URLs, revealing that nearly three-quarters of top websites engage in link decoration for tracking purposes. NoT.js operates at function-level granularity to remove tracking logic from mixed JavaScript code while generating surrogate scripts that preserve website behavior, achieving 94% precision. The second part bridges technical realities and legal frameworks. An analysis of JavaScript event listeners through the lens of California's wiretapping statute shows that over 38% of websites install listeners capable of intercepting user communications, with evidence that captured data is exfiltrated to third parties and used for unsolicited marketing. A companion examination of Google's Chrome browser and its market dominance highlights downstream harms to consumer privacy and motivates regulatory interventions grounded in antitrust precedents. The third part examines threats to web ecosystem integrity. FP-Inconsistent studies evasive bots that manipulate browser fingerprints to avoid detection, uncovering systematic inconsistencies that can be used to improve bot detection and strengthen the reliability of web measurement. Together, these contributions advance technical privacy protections while informing the legal and regulatory frameworks needed to support a more private and trustworthy web.