Cookies, Trackers, and Fingerprinting: How Websites Follow You Around the Internet

How Cookies Actually Work

A cookie is a small text file a website deposits in your browser when you visit. First-party cookies — set by the site you're actually on — serve legitimate purposes: keeping you logged in, remembering your shopping cart, or saving language preferences. These are largely benign.

The privacy concern centers on third-party cookies, which are set by external services embedded in a page — advertising networks, social media widgets, and analytics platforms. Because the same ad network can appear on thousands of sites, its cookie follows you across all of them, allowing it to compile a detailed record of your browsing history across unrelated domains. This data feeds the targeted advertising ecosystem.

Many browsers have moved to restrict third-party cookies by default. But the advertising industry has been developing alternative tracking approaches in parallel, which means the overall tracking landscape hasn't simply improved — it has shifted.

Trackers Beyond Cookies: Pixels, Scripts, and Session Replay

Tracking pixels — also called web beacons — are transparent 1×1 images embedded in web pages or emails. When your browser loads the image, it sends a request to the tracker's server, revealing your IP address, device type, browser, and the exact time you opened the content. Email marketers use pixels to confirm when messages are read; advertisers use them to verify ad impressions.

JavaScript-based trackers go further. These small scripts run inside your browser and can log which links you click, how long you hover over an element, and even the sequence of keystrokes in a search box — data used to infer intent and interest. A subset of these tools, called session replay scripts, can record everything you do on a page, including partially typed text, effectively capturing sensitive information you never intentionally submitted.

Because these trackers don't rely on stored files, clearing your cookies has no effect on them. They're active every time a page loads. Understanding this broader picture is central to understanding your digital footprint across the web.

Browser Fingerprinting: Tracking Without Storage

Browser fingerprinting is among the most persistent tracking techniques because it requires nothing to be stored on your device. Instead, a script queries your browser for a combination of attributes: your operating system, browser version, installed fonts, screen resolution, time zone, graphics rendering characteristics, and more. Individually, none of these details is unique. Combined, they form a profile that is statistically distinct enough to identify a specific device across sessions.

Canvas fingerprinting is a common variant. A script silently draws an invisible graphic using your browser's rendering engine; subtle differences in how each device processes this task produce a value that functions as a near-unique identifier. Audio fingerprinting works similarly, probing how your system processes sound data.

Because fingerprinting is stateless, private browsing mode offers no protection. Even resetting your device's IP address through a VPN may not defeat fingerprinting if your device's other characteristics remain unchanged.

What You Can Do About It

No single countermeasure eliminates tracking, but a layered approach meaningfully reduces it. Start with your browser's built-in protections — most modern browsers include a setting for enhanced or strict tracking protection that blocks known third-party trackers by default. Review these settings rather than accepting defaults, as discussed in our guide to browser privacy settings worth changing.

Consider these practical steps:

• Block third-party cookies in your browser's privacy settings — this is usually a toggle, not an advanced option.
• Use a DNS-level blocker to prevent tracker domains from resolving before scripts even load.
• Opt out of email pixel tracking by disabling automatic image loading in your email client.
• Be selective with browser extensions — some privacy-focused extensions block known fingerprinting scripts, though they can't stop all variants.

For a broader view of how this tracking feeds into commercial data ecosystems, the article on data brokers and what they know about you explains how fragmented tracking data gets aggregated and sold. The goal isn't invisibility — it's reducing the density of the profile built about you over time.