Characterizing Website Behaviors Across Logged-in and Not-logged-in Users.

ABSTRACTUsers on today's Internet are subjected to a barrage of advertising and privacy concerning practices. However there is a gap in understanding the treatment of not-logged-in and logged-in users on websites. To address this gap in understanding, we create accounts and crawl 345 popular websites from 14 Alexa website categories while both not-logged-in and logged-in to determine -- for the first time -- how users are treated when logged-in versus not-logged-in with respect to the types and rat of ads and privacy concerns. We establish that logged-in users are treated to more ads and more privacy concerns on average and the website category greatly impacts the amount of ads/concerns users are subjected to. We also note that 42\% of website crawled leaked PII and identify that age/gender/zipcode are more valued than user/first/last name personal information. Finally, we observe that 463 unique third parties received at least one piece of PII, indicating that user PII is leaked more aggressively than previously known.