Why tracking exists
The web was not originally designed to remember anyone. Each request to a server was independent: ask for a page, get a page. Tracking grew out of practical needs. A shop needs to remember what is in your basket; a login needs to remember you are signed in. Over time the same techniques were extended to measure audiences and to build advertising profiles. Tracking in itself is a set of methods for recognizing the same browser or person over time. What it is used for varies from harmless to intrusive.
This article stays at the conceptual level. It describes what the main techniques are, not how to build or defeat them.
Cookies
A cookie is a small piece of text that a website asks your browser to store, and which the browser sends back on later visits. A site might store a random code, so it recognizes your browser as the same one as before.
Cookies come in a few broad types:
- Session cookies disappear when you close the browser and are often used to keep you signed in during a visit.
- Persistent cookies last for days, months or longer.
- First-party cookies are set by the site you are visiting. They often support logins, preferences and baskets.
- Third-party cookies are set by another domain whose content is embedded in the page, such as an advertising or analytics service. If the same third party is embedded on many sites, it can recognize the same browser across all of them.
That last case is the foundation of cross-site tracking. Many browsers now restrict or block third-party cookies by default, though policies vary by browser and change over time.
Identifiers beyond cookies
When cookies are limited, other identifiers can do similar work.
Account identifiers. If you are signed in to a service, your activity there can be linked to your account, and sometimes to the same account elsewhere on that service’s network of sites.
Email-based identifiers. Some systems derive a code from an email address you supplied, so that the same person can be matched across services without the address itself being passed around. The code still identifies you, which is why this is not the same as being anonymous.
Device identifiers. Phones and other devices may have advertising identifiers that apps can read. Many systems let users reset or restrict these.
Network addresses. Your internet address is visible to sites you connect to. It is a coarse signal, since many households share one and it can change, but it hints at location and can be combined with other data.
Tracking pixels and links. A tiny invisible image or a specially coded link in an email or web page can report that it was opened or clicked.
Browser fingerprinting
Fingerprinting does not store anything on your device. Instead, a site observes many small characteristics that your browser reveals when it loads a page: browser version, operating system, language, screen size, time zone, installed fonts, and the way the device draws graphics or handles certain features. Any one detail is common. The combination may be rare enough to recognize a device again.
The key idea is that uniqueness comes from combining ordinary details, much as a postal code, birth date and gender can jointly narrow down a person. Fingerprints are less stable than cookies, since software updates and setting changes alter them, and they can be wrong. But because they leave nothing for you to clear, they are harder to notice. Browser makers have been working on reducing the detail exposed, with partial success that is hard to measure.
Tracking in apps and devices
Tracking is not limited to browsers. Mobile apps can include code from third parties that measure usage or show ads. Connected televisions, smart home devices and other products from the internet of things may report usage back to servers. Location from satellite navigation and nearby Wi-Fi networks can reveal where a device goes. Even a headset used for virtual reality records how it moves, which is a form of headset tracking.
How the pieces are combined
A single data point rarely matters much. The value, to advertisers and to data brokers, comes from joining records together: a browsing history, a purchase, an app, a location. The result is a profile that may include interests and estimated traits. These profiles can be inaccurate, and people usually cannot see them.
Data is often exchanged in real time. When a page loads, the slots for ads may be offered to many advertisers within a fraction of a second, with information about the visitor passed along. Which details are shared depends on the companies, the settings and the local law.
Why it is hard to avoid
Tracking is spread across the web, embedded in tools that sites find useful, such as analytics, payment buttons, maps and video players. Blocking one method often pushes trackers toward another. Blocking too aggressively can also break sites. And the line between helpful and intrusive is not obvious: remembering a language preference and building a cross-site profile use related technology for very different ends.
What people can do
None of these removes tracking entirely.
- Review the cookie choices a site offers, and clear cookies periodically.
- Use browser settings that limit third-party cookies and cross-site tracking.
- Limit app permissions, and reset or restrict advertising identifiers where the device allows it.
- Be aware that being signed in links your activity to your account.
- Keep your browser and software updated, since privacy protections arrive through updates.
- Consider that privacy-focused tools help but can be imperfect.
Privacy settings can help but have limits. The broader point is that tracking is a set of overlapping techniques, not one switch, and that understanding them is the first step to making informed choices.