Simon Willison’s Weblog

How to track an RSS feed

According to the HTTP specification, RSS/Atom aggregators should obey the HTTP 301 Moved Permanently header by altering the stored subscription URL for the feed they are attempting to retrieve.

This behaviour can be used to track repeat aggregator hits to a feed, in essence the equivalent a setting a permanent cookie. The first time an aggregator hits the published feed address, a 301 header is served redirecting that aggregator to a new URL incorporating a unique ID. The aggregator permanently changes the stored subscription URL, meaning future request to that feed will carry the unique ID that was assigned the first time the feed was retrieved.

At its most innocent, this could allow people to track their number of unique subscriptions—although the value of this would be severely diluted if people started deliberately subscribing to the same redirected feed URL. I’m sure there are more insidious uses for this as well.

Maybe aggregators should prompt users when a feed has permanently moved, to prevent them from being tracked without their knowledge.