Beyond Access: Examining Tracking and Surveillance on Library Vendor Platforms

Helping patrons make informed decisions about their data

Posted on July 13, 2026 in Blog Posts

As concerns about data privacy continue to grow and become increasingly difficult to navigate, libraries play an important role in helping patrons make informed decisions. A key challenge is ensuring patrons understand what happens to their data when they access third-party vendor websites, particularly in cases where tracking and data collection are not immediately visible.

An ongoing project within Cornell University Library (CUL) examines vendor privacy policies alongside the data collected by vendor platforms. The goal is to better align what vendors say in their policies with what their websites actually do, while also improving transparency for patrons. I contributed to this project by exploring how a tool called Blacklight Query could support these efforts of improving patrons’ visibility into vendor data practices.

Methods

I used Blacklight Query to collect privacy and surveillance data for a subset of vendors with which CUL contracts for electronic resources. Blacklight Query is a command-line tool that runs locally and enables batch scanning across multiple URLs, addressing a key limitation of Blacklight, “a real-time website privacy inspector” created by The Markup, which only processes one URL at a time. Blacklight scans websites for surveillance and privacy-related technologies and identifies practices such as:

• Third-party cookies
• Ad trackers
• Key logging
• Session recording
• Canvas fingerprinting
• Facebook tracking
• Google Analytics “Remarketing Audiences”
• TikTok Pixel
• X Pixels

These categories introduce varying levels of concern, ranging from relatively common analytics tools to more intensive forms of behavioral tracking, such as session recording and fingerprinting. Taken together, they offer a useful starting point for evaluating how vendor platforms engage in data collection.

Using a seed list of 244 vendor URLs, I ran Blacklight Query to generate JSON files capturing the surveillance technologies used by each site. This approach allowed for a broader, more systematic assessment than would be possible through manual inspection.

To make the results more accessible, I used Blacklight Reporter to convert the JSON outputs into tabular CSV data with Boolean (true/false) values. This transformation made it easier to sort, filter, and analyze the data by vendor and tracking type. It also ensured that collaborators without a technical background could engage with the findings in a meaningful way.

---

🔥 Stay up-to-date with LibTech Insights by signing up for our free newsletter. Just one weekly email with our new blog posts, top tech news stories, and other bonus content. Check out some posts from our archive:

• AI Talk Galore at ALA Annual Conference 2026
• The Optimized Library: The Green Library
• How to Run an Edit-a-thon for Your Library’s Staff

🧑‍🏫 Sign up for Choice/Clarivate’s new, free micro-course on AI literacy. In “Beyond the Basics,” expect to learn more about connecting libraries to the AI ecosystem, integrating AI into pedagogy, and creating library workflow efficiencies.

---

Results

Of the 229 vendor URLs that returned results, only 35 showed no use of identified surveillance technologies. This indicates that 84.7 percent of the vendors analyzed employ at least one form of tracking.

While the presence of tracking technologies does not necessarily indicate misuse of data, the prevalence of these tools highlights the extent to which vendor platforms rely on analytics and third-party services. In a library context, this raises important questions about user expectations and consent. Patrons may reasonably assume that interactions mediated by libraries carry stronger privacy protections than typical commercial platforms, even when external vendors are involved.

These findings reinforce the need for greater transparency around vendor data practices, particularly at the moment when patrons are redirected away from a library-controlled environment.

Limitations

Some vendor URLs were redirected during the scanning process. In these cases, Blacklight Query scanned a vendor’s main website rather than the specific page hosting the resource. As a result, instances of “no tracking” may reflect incomplete scans rather than a true absence of tracking technologies.

This limitation also points to a broader challenge: vendor platforms are often complex, with multiple layers of access and authentication. A single scan may not capture the full range of tracking behaviors users encounter in practice. Future work may require more targeted scanning approaches or manual validation to address these gaps.

Next Steps

This dataset, combined with ongoing analysis of vendor privacy policies, supports more direct comparisons between stated policies and observed data practices. By identifying inconsistencies or gaps, the project contributes to a more evidence-based understanding of vendor behavior and strengthens the overall reliability of its conclusions.

To extend this work, I am developing a Python script that reads the compiled dataset and identifies key types of data collected by vendors. The goal is to surface selected tracking information directly within the library catalog, making it visible at the point where patrons are choosing whether to access a resource. This integration would allow tracking details to appear alongside resource records, similar to the way terms of use are currently presented. For example, a patron viewing a database or eJournal link could see whether the platform uses third-party tracking or session recording tools before deciding to proceed.

In addition, the catalog interface will include links to explanatory content defining common tracking technologies. Providing this context is essential, as many terms associated with web surveillance are not widely understood. Clear definitions can help patrons interpret the information and make more informed decisions about their use of vendor platforms.

Future work will focus on integrating these findings at the title level within the catalog interface. Doing so will require coordination and consideration of how much information to present without overwhelming users. Even so, surfacing this data represents a meaningful step toward aligning library values with user experience.

Ultimately, patrons should be able to understand what data they are sharing when they interact with vendor platforms. By making this information visible and accessible, libraries can better support informed consent and reinforce their long-standing commitment to user privacy.

Related Posts