What cookies actually are
A cookie is a small text file a website writes to your browser when you visit. Its original purpose was straightforward: help sites remember you. Without cookies, you would need to log in again on every page load, and shopping carts would empty the moment you clicked to a new product.
First-party cookies come from the site you are actively visiting. They handle session management, language preferences, and similar functions. Third-party cookies come from domains other than the one in your address bar, most commonly from advertising networks embedded in the page. A news article might load content from a dozen advertising domains simultaneously, each dropping its own cookie.
Third-party cookies are the mechanism behind ads that seem to follow you across the web. If you browse a pair of shoes on one site and then see ads for those same shoes on an unrelated site, third-party cookie tracking is the usual explanation. Because the ad network operates on both sites, its cookie can connect your activity on the first to your visit on the second. You can learn more about what other signals websites collect in our article on the personal information you share without realizing it.
How trackers go beyond cookies
Tracking pixels are another common tool. A tracking pixel is a tiny, often invisible image embedded in a webpage or email. When your browser loads it, the server hosting that pixel records your IP address, browser type, and the time of the request. Email marketers use pixels to confirm whether a message was opened.
Local storage and session storage are browser features that work similarly to cookies but can hold more data and, in some cases, are less visible in standard privacy controls. Scripts from analytics and advertising companies often use these alongside cookies to maintain a more durable record of your visits.
Blocking one method does not block all
Ad networks and analytics platforms frequently combine several tracking methods. Blocking cookies alone may not stop a tracker that also uses local storage or pixel requests. Understanding what your IP address reveals is a related piece of the privacy picture, since that data is collected regardless of cookie settings.
Ad networks and analytics platforms frequently combine several tracking methods. Blocking cookies alone may not stop a tracker that also uses local storage or pixel requests. Understanding what your IP address reveals is a related piece of the privacy picture.
Browser fingerprinting: tracking without storage
Browser fingerprinting is the most persistent of the common tracking methods because it stores nothing on your device. Instead, a script collects a list of technical attributes from your browser: screen resolution, operating system, time zone, installed fonts, graphics card details, and how your browser renders specific test images. Each attribute alone is ordinary, but in combination they produce an identifier that is statistically near-unique to your specific setup.
Research from the Electronic Frontier Foundation has shown that a large majority of browsers can be uniquely identified through fingerprinting. Clearing your cookies, switching to private mode, or deleting your browsing history has no effect on this process because the fingerprint is assembled fresh on each visit from your hardware and software configuration.
~83%
Browsers uniquely identifiable by fingerprint
Research published by the Electronic Frontier Foundation found that a large majority of tested browsers carried a fingerprint unique enough to identify the user.
72%
Top websites using third-party tracking
Web privacy audits have consistently found that the majority of popular websites load at least one third-party tracking script during a normal page visit.
Changing your browser or updating your operating system will alter your fingerprint. Some privacy-focused browsers deliberately randomize certain fingerprint attributes to make profiling harder. Social media privacy settings are a related area where similar profiling techniques apply to your activity on major platforms.
What you can realistically do about it
Reading cookie consent banners carefully matters. Many banners are designed to make 'accept all' the easiest option while burying more limited choices. Looking for 'manage preferences' or 'reject non-essential' options, where available, reduces the third-party cookies placed on your device.
Browser settings are a practical starting point. Most major browsers have options to block third-party cookies by default, and enabling these does not typically break the sites you use regularly. Some browsers are built with stricter privacy defaults than others and include built-in protections against known tracking scripts.
Browser extensions that block tracking scripts can add another layer of control. These tools maintain lists of known tracker domains and prevent your browser from loading their scripts. The tradeoff is that occasionally a script these tools block is one a site needs to function.
For families thinking about how tracking applies to younger users, our guide to protecting kids online covers the specific risks children face from data collection.
