How Online Tracking Actually Works: A RAJA89 Guide

What a Digital Footprint Actually Is

A digital footprint is the sum of what is recorded about you as you use the internet: what you typed, where you went, what you tapped, how long you looked, and which device you were holding. It is not one database. It is hundreds, held by companies you have never heard of, joined together by identifiers that were designed to be joined.

The useful distinction is between the two ways data about you comes into existence.

• Active footprint - what you deliberately hand over. A sign-up form, a delivery address, a review, a photo with location data, a comment under your real name, a support ticket. You know about these, even if you do not remember them.
• Passive footprint - what is observed about you while you do something else. Page views, click coordinates, scroll depth, the time you spent on a section, your IP address, your device's exact model, the other tabs that were open, and the fact that the same device appeared on three unrelated websites within a minute. You never agreed to this in any meaningful sense, and mostly you never see it.

Most privacy advice concentrates on the first category, which is the smaller one. Deleting an old post is easy and satisfying. The observations are the part that follows you around, because they are the part you did not choose and cannot enumerate.

It helps to hold three questions apart, because they have different answers. What is collected? Who ends up holding it? What can actually be done about it? The first is technical, the second is commercial and legal, and the third is where most of the disappointment in privacy advice comes from - because the honest answer is usually "less than you would like, but more than nothing".

Cookies, and Which Ones Actually Follow You

A cookie is a small piece of text a site asks your browser to store and send back on later requests. That mechanism is not sinister: it is how a shopping basket remembers what you put in it, and how a site knows you are still logged in. Calling all cookies "trackers" is one of the reasons the discussion is so confusing.

The distinction that matters is not cookie versus no cookie. It is first-party versus third-party, and same-site versus cross-site.

• First-party cookies are set by the site you actually visited. They support logins and preferences. They can still profile you intensively on that one site - a news publisher knows exactly which articles you read - but they do not follow you elsewhere on their own.
• Third-party cookies are set by an embedded script, pixel or iframe from a different company loaded into the page. Because that same company is embedded across thousands of sites, the identifier it sets can appear on all of them, which is what "following you around the internet" describes in its original form.

Where the major browsers stand is worth checking rather than assuming, because the summaries are usually out of date.

• Safari blocks third-party cookies by default, following its Intelligent Tracking Prevention work, and also caps the lifetime of script-set first-party cookies. It is the default position on iOS and macOS.
• Firefox partitions rather than blocks them. Total Cookie Protection gives each top-level site its own cookie jar, so an embedded network receives a different identifier on each site and cannot join them into one profile. The cookie still works; it simply stops being a cross-site key.
• Brave blocks third-party cookies by default, and blocks or partitions much else besides.
• Edge blocks known trackers on its Balanced setting and more on Strict, while leaving the underlying mechanism in place.
• Chrome allows third-party cookies by default in ordinary windows. Google announced a phase-out in 2020, moved the date repeatedly, and ultimately changed course: it now keeps third-party cookies while offering a user choice, and has been retiring most of the Privacy Sandbox proposals that were meant to replace them. Incognito does block them, and Chrome supports partitioned cookies, which it calls CHIPS - a widget keeps its state on one site without carrying identity between sites.

For a reader in 2026 the practical position is: blocked by default in some browsers, partitioned in another, and still alive in the most widely used one. Check your own browser's setting rather than trusting a headline, and see hardening your browser for where that setting lives.

Pixels, Beacons and Email Open Tracking

A web beacon - also called a tracking pixel, clear GIF or 1x1 image - is an invisible image embedded in a page or an email. Your browser or mail client requests it in order to render the page, and the request itself carries the information: which server, which identifier, at what time, from which IP address. There is nothing to accept or decline. No script runs, and no cookie needs to be set for the observation to happen.

Email is where this matters most, because the tracking is per-recipient. A newsletter sends the same content with a different image URL to each subscriber. The URL itself is the identifier, so when the image loads, the sender knows precisely which address opened the message, at what time, from roughly where, and what kind of device it was. Open rates in marketing are not measured; they are recounted from these requests.

Three defences, in decreasing order of completeness:

• Stop remote images loading automatically. Most mail clients have this setting, and in a dedicated app it is usually under the account's privacy or security options. You then approve images per sender, which breaks most email open tracking outright.
• Understand what a proxy does. Some mail providers fetch images through their own servers, so the sender sees the provider, not you. That hides your IP address and location but not the fact that the message was opened, because the provider's fetch is still triggered by your reading it.
• Expect links to be tracked regardless. A tracked link is often rewritten to pass through the sender's redirect domain before it reaches the destination. Blocking images does not prevent that; it is visible in the status bar when you hover.

The same technique appears outside email. A pixel in a page, a tracking script loaded from a "first-party" subdomain, an invisible iframe that loads a third-party domain - each produces a request to somebody's server that says a device was there.

Fingerprinting: Identifying the Device Instead of the Cookie

Cookies can be blocked, partitioned or deleted. A fingerprint cannot, because it is not stored on your device at all. It is derived from what your browser tells every site it visits, and then computed server-side.

The ingredients are individually innocuous: your screen resolution and available size, device pixel ratio, operating system and version, browser and version, the exact list of installed fonts, the graphics driver and its rendering quirks, your time zone, your language settings, how many processor cores you have, how your device handles certain drawing operations, whether a dark-mode preference is set, and on some systems the precise audio and canvas outputs. Each is common. The combination is not.

Measurements in this area repeatedly find that a large fraction of ordinary browsers produce a fingerprint that is unique among the sample, and that the fingerprint is stable for weeks or months. EFF's Cover Your Tracks tool will show you your own, alongside a picture of how distinctive it is. Looking at your own result is more instructive than reading about the technique, because the surprise is usually how few browsers resemble yours.

The awkward part is that the countermeasures are themselves detectable. Blocking canvas reads, spoofing the user-agent string, or randomising screen dimensions produces a browser that behaves unlike any real one, and a distinctive anti-fingerprinting configuration can be more identifiable than the thing it replaced. This is the fingerprinting paradox: to be unremarkable you must look like everybody else, which is precisely what the statistical technique measures.

What helps in practice is blending in rather than standing out:

• A browser with a large user base, updated promptly, whose fingerprint is whatever that browser's default is.
• Resisting the urge to install a dozen extensions, since each adds detectable surface.
• Accepting cookie clearing as imperfect - a fingerprint survives it - and treating fingerprinting as a reason to keep your browser ordinary rather than exotic.

Link Decoration: Identity Carried in the URL

Tracking parameters are the least technical and most easily defeated form of tracking, which is why it is odd how rarely the fix is mentioned.

When you click a link in a newsletter, a search result or a social post, the URL often carries extra fields: utm_source, utm_campaign, gclid, fbclid, igshid, mc_eid, and dozens more. Their official purpose is attribution - which campaign produced this visit. Their effect is to tell the destination site exactly where you came from, and in some cases to hand it an identifier that links the visit to a profile held by the platform you clicked from.

They also leak in the other direction. When you copy a link from a page into a message, a document, a bug report or a public post, the parameters travel with it, exposing where you were, what you were reading, and sometimes an identifier tied to your account.

Some sites have started stripping known tracking parameters from links that users paste into their own posts, which is a useful default and a rare example of a platform reducing its own data collection.

Mobile Advertising Identifiers, and What Replaced Them

Phones never needed cookies. Each mobile platform issued a device-wide advertising identifier - the Identifier for Advertisers on iOS and the Advertising ID on Android - readable by any installed app. That single value meant any two apps could compare notes and discover they were installed on the same device, which is how your behaviour in one app became an advertisement in another.

Apple changed the default in iOS 14.5 in 2021 with App Tracking Transparency: an app must ask through a system prompt before reading that identifier or tracking you across other companies' apps and websites. Asked plainly and in the user's own interest, most people decline. On iOS, Settings then Privacy and Security then Tracking shows which apps asked and lets you switch off future requests entirely.

On Android, the advertising ID can be deleted under Settings, then Privacy, then Ads - the exact path varies by manufacturer - after which apps requesting it receive a string of zeros. Google's Privacy Sandbox for Android has been developing a replacement, so expect the mechanism to shift rather than disappear.

One convenient identifier went away. Mobile tracking did not. Attention moved to signals the platform does not gate:

• The account you are signed in with, which links activity across every app from the same publisher and across the platform's own surfaces.
• Your email address, hashed and used as a common key between companies - the basis of identity graphs, described below.
• Your IP address, which indicates rough location and, combined with timing, can link sessions.
• Probabilistic matching from weaker signals: device model, operating system version, screen size, language and time zone.
• Server-side events, which never pass through your device at all.

The permission screen changes what an app may read. It does not change what an app already knows because you signed in. See app permissions and data minimisation for the settings that do bite.

Server-Side Tracking and Identity Graphs

Every mechanism so far passes through your device, which is why your settings can affect it. A growing share of tracking no longer does.

In server-side tracking, the seller's own server sends the event to the advertising platform directly: this order, this value, this hashed email address, this click identifier. Your browser never contacts the platform, so a content blocker, a cookie setting and a private window have nothing to act on. You cannot see the transfer, and no consent banner in your browser intercepts it. A companion technique serves the tracking script from a subdomain of the site you are visiting, so it appears first-party, receives first-party cookie lifetimes, and still resolves to the vendor.

Those events are then joined in an identity graph, usually keyed on a hashed email address. Hashing is often presented as anonymisation. It is not. A hash is deterministic: the same address always produces the same string, which is exactly what makes it useful as a shared key between two companies that both hold your email. And the space of plausible email addresses is small enough to enumerate and test against. Treat a hashed email as a pseudonym, not as anonymity.

The same logic merges devices. One account used on a laptop and a phone marks those devices as one person; a shared home IP address can group a household; a payment card used in both an app and a browser ties the two together.

None of this is reachable through a browser setting. It is limited by law and by contract rather than by your configuration, which is why exercising your data rights is the only real lever over data that has already left your device.

What Private Browsing Does and Does Not Do

Private, incognito and InPrivate windows are consistently misunderstood in both directions - treated as anonymity by some people, and as useless by others. Both are wrong.

What it does

• Does not keep local history, form data or new cookies after you close the window.
• Starts each session without your existing cookies, so you are logged out of accounts unless you sign in during that session.
• Blocks third-party cookies in Chrome, where ordinary windows do not.
• Keeps one private window separate from another in most browsers, so two sessions cannot see each other's logins.

What it does not do

• It does not hide your activity from your network. Your employer, your school, your internet provider and anyone on the same Wi-Fi can still see which domains you contact.
• It does not hide anything from the sites you visit. Your IP address, your fingerprint and anything you type are all visible to them, and server-side tracking is unaffected.
• It does not make you anonymous. A distinctive fingerprint is just as distinctive in a private window.
• It does not hide activity from the platform operator. Google is explicit that incognito browsing is not invisible to Google itself, and a signed-in browser account can associate activity regardless of the window type.
• It does not stop downloads or bookmarks saved during the session, and it does not protect against malware or extensions, which run in private windows too.

Private browsing is best understood as local cleanup: a way to keep one session's cookies and history off your device and out of your logged-in profile. It is a good tool for reading something you would rather not have in your history, for logging into a second account on the same site, and for checking what a page looks like to a first-time visitor. It is not a privacy tool in the sense most people mean.

Questions readers ask about this page

Back to top ↑