About the LevelUp series: At The Markup, we are committed to doing everything we can to protect our readers from digital harm. We are constantly working to improve digital security, respect reader privacy, create an ethical and responsible user experience, and ensure that our websites and tools are accessible. We are also committed to writing about our process and sharing our work.
Tagging respects our readers’ privacy in everything we do – including the links we use to share news.
We don’t use popular URL shorteners like Bitly, because tracking that comes with the car creates more privacy risks — like sharing reader click traffic — than we’re comfortable with.
Check out our code here and let us know if you find any bugs
Instead, we found an existing privacy-focused URL shortener called Shlink and built a custom WordPress plugin called Smol Links on top of it so our editor could easily generate short URLs on its own , and then host it all on a server infrastructure that we have full control over. Our short links only count aggregated clicks, so our audience team can measure trends in a way that complies with our privacy restrictions.
From day one, our entire organization, and especially our product teams, had a clear and public requirement to avoid tracking technology as much as possible — no third-party analytics, no sketchy ad tech, no visitor data Monetization. This means we often do extra due diligence on the services we rely on, and if we can’t find something that meets our privacy requirements, we build our own tools or customize existing systems and host them ourselves. Here’s why and how we host our own URL shortener.
Tracking that comes with existing short links
A popular way to share news links on Twitter – used by The New York Times, BBC News, Yahoo! News and many others – use multiple sequential redirects from short URLs. With link retargeting, news outlets capture audience analytics in different tools, each of which tracks how many people clicked and who they were. Click Yahoo! A news yhoo.it link posted to Twitter takes you to another short URL at yahoo.trib.al (hosted by the analytics service SocialFlow), which ultimately redirects you to stories on news.yahoo.com.
Twitter itself has its own URL shortener, t.co, which automatically tracks clicks on every URL posted on its platform. One such click on a news article may be observed by Twitter, Bitly, SocialFlow, news outlets, and any third-party affiliates that work with these companies.
SocialFlow claims it has tracked more than 12 billion consumer clicks from more than 2 billion devices. Bitly also publishes 10 billion clicks and scans of ads every month. The accumulated traffic data is large, the exact amount of tracking deployed by the company is not transparent to the public, and both the data generated and the short URLs are stored in analytics or URL shortening companies used by the organization. These are some of the reasons we took an open source URL shortener and built our Smol link so it could all be hosted on a server infrastructure that we have full control over.
Tracking of all these URL redirects also happens forward page loads. Once you actually load an article, sites willing to host ads will do more tracking through ad trackers, third-party cookies, and canvas fingerprinting. If you’re wondering how the websites you visit track you, check out another tool we’ve made: Blacklight.
Not all news outlets rely on short URLs in this way, but when links are shared on Twitter, they are automatically shortened using Twitter’s own t.co service, which cannot be turned off. In most cases, we post the full article URL to Twitter, and clicks on those links are still tracked by t.co redirects. If we want to tweet our work, there’s not much we can do; all we can do is make sure we don’t do invasive tracking on top of that. Other news outlets such as Newsweek and The Guardian also avoid short URLs in their Twitter updates.
Markup sometimes relies on our own short URLs in our Twitter posts to measure traffic or for aesthetic reasons. We count the total number of clicks for each short URL, but do not track individuals or IP addresses. This allows us to understand the various sources of traffic to our website without violating anyone’s privacy.
Finally, while the tracking that occurs in URL redirects is barely noticeable, just like other ad technologies that load on article pages, each redirect slows down article load times. By eliminating these redirects, we reduce privacy risks while speeding things up slightly.
Build tagged URL shorteners and “Smol Links”, our WordPress plugin
We’re not interested in building something that already exists, so before writing our own link shortener, we tried to find out if a privacy-focused tool already existed. So when we found Shlink, an open source URL shortener written by software developer Alejandro Celaya, we decided to use it. Shlink has functionality similar to Bitly, but is designed to run on its own servers. Our self-hosted Shlink server does most of the heavy lifting – keeping track of our short URLs and redirecting them to the longer original article URLs.
For example, when you click on mrkup.org/amazon-brands, our Shlink servers send you to https://themarkup.org/amazons-advantage/2021/10/14/amazon-puts-its-own-brands – The product that bears the brunt.
Shlink also includes a feature to avoid tracking our visitors by IP address. When we tested the software, we found a bug, which meant that the IP address was tracked anyway, and a request from Celaya to fix it was logged. We thank Celaya for taking this request seriously and he fixed the bug within a day.
The piece of software we build on top of Shlink’s URL shortener is a WordPress plugin we publish called Smol link. This plugin allows our editors to create and manage short URLs from our existing WordPress CMS (the user interface they are already familiar with).
The plugin has the option to automatically generate new short URLs when stories are published, which is an essential feature for sending SMS announcements. The plugin uses WordPress filter hooks to provide more customization possibilities – for example, appending query string parameters to each long URL.
Because mrkup.org is hosted on a server infrastructure that we have full control over, we can observe and modify the running code, which means we can be more confident about changes in our readers’ click data. That means we’re not limited to choosing between the ad tech panopticon and not having any traffic insights. Smol Links allow us to measure the overall source of our visitors without undermining the trust in the privacy promises we strive to earn.
Last year, our audience team wanted to try out SMS notifications whenever we published an article. We ran this experiment for five months, initially building our own partially vowel-removed domain, mrkup.org, to make article updates fit within the 160-character limit for text messages.
Another great feature of sending SMS announcements is the ability to generate new short URLs whenever a story is published. That’s what drove us to find Shlinks and build Smol Links on top of them.
After looking at the total traffic data, we found that SMS was not a popular way for our readers to get article updates, so we decided to end the experiment. But we continue to use URL shorteners on other social media platforms like Instagram, where hypertext links are not supported, except as stickers in Stories.
Build a better World Wide Web with us, starting with modest short URL redirects. You can download Smol Links in the WordPress plugin directory or from GitHub. We look forward to reading your issues and pull requests.
We intend to do more in public, share what we know about maintaining systems that respect privacy, and release some of the software we write. We hope this effort will encourage others to make similar investments on behalf of their own site visitors and help us gather feedback on where we may have room for improvement.