What is the org relationship mitigation strategy of Microsoft edge browser tracking prevention

Users use Microsoft Edge The browser Strict When visiting the website in mode , You can select the page information pop-up icon on the left side of the address bar to find out which trackers are blocked on a specific page ：

As shown in the figure below , Prompt the user , Access to the Website Detected a Tracker, Its request has been Track Prevention Mechanism block 了 ：

URL：edge://settings/privacy/trackers/detail?tracker=SAP

Click on the SAP, See the following prompt message ：

This organization has 10 trackers seen on 14 sites. The same tracker may be seen across multiple sites.

Mitigation

To ensure that as much as possible Web Compatibility ,Microsoft Edge Three mitigation measures are provided to help balance enforcement in specific situations . These are ：

• Organizational relationship eased （Org Relationship mitigation）
• Organizations participate in mitigation （Org Engagement mitigation）
• CompatExceptions list

Before further study of mitigation measures , Worth defining “ organization ” Or abbreviation “ organization ” The concept of .
Disconnect Also maintain a named entity.json A list of , This list defines the parent organization / The company owns URL Group .

Microsoft Edge The tracking and prevention function in uses this list in organizational relationship mitigation and organizational participation mitigation , To minimize the occurrence of compatibility problems caused by tracking and prevention that affect cross organization requests .

Org Relationship Mitigation

Some popular websites maintain websites and content delivery networks at the same time (CDN), Provide static resources and content for these websites . To ensure that these types of schemes are not affected by tracking protection , When a site makes a third-party request to another site owned by the same parent organization ,Microsoft Edge It will exempt the tracking protection of the site （ Such as Disconnect entity.json As defined in ） list ）.

entity.json The website of ：https://github.com/disconnectme/disconnect-tracking-protection/blob/master/entities.json

You can see that there is SAP Corresponding entry：

"SAP": {
    
      "properties": [
        "sap.com"
      ],
      "resources": [
        "ondemand.com",
        "sap.com",
        "seewhy.com"
      ]
    },

be known as Org1 The organization of owns the domain org1.test and org1-cdn.test, Such as Disconnect entity.json Defined in the list . Imagine ,org1-cdn.test It is classified as a tracker , Tracking preventive enforcement measures are usually applied to them . If the user accesses https://org1.test And the site tries to start from https://org1-cdn.test load resources ,Microsoft Edge Not in the opposite direction org1-cdn.test Requests made to take any enforcement measures , Even if it's not the first party URL. however , If it doesn't belong to Org1 Another organization URL Try loading the same resource , Then the request will be enforced , Because it does not belong to the same organization .

Although this eases the implementation of tracking and prevention for sites belonging to the same organization , But this is unlikely to introduce a lot of privacy risks , Because these organizations can determine that you are https://org1 Which sites have been visited on / resources . Test with internal back-end data https://org1-cdn.test.