Online tracking works by giving your browser an identifier, or deriving one from its characteristics, and then recognising that identifier on every site that embeds the same tracker. Third-party cookies, tracking pixels, decorated links, CNAME-cloaked subdomains and browser fingerprints are all ways to recognise the same browser twice. The profile that results is sold, matched to email addresses and used to target you.
Tracking is a matching problem
Strip away the vocabulary and every tracking technique solves the same problem: a company that is present on thousands of sites wants to know that the visitor on a news site at 09:12 is the same person who looked at running shoes at 21:40. The site owner cannot tell them, so the tracker needs its own way to recognise you. Whatever gives it a stable handle on your browser, whether a stored cookie or a computed fingerprint, is the tracking mechanism; everything else is plumbing.
This framing matters because protections are usually sold as if they stop "tracking" outright. They do not. Each one removes a particular handle, and the industry has spent fifteen years building replacements for every handle that browsers took away. Understanding which handle a technique relies on tells you which protection actually stops it.
Third-party cookies: the original identifier
A cookie is a small value a server asks the browser to store and send back on future requests to the same domain. When a page on news.example loads an image or script from ads.tracker.example, the tracker's server can set a cookie under its own domain. That is a third-party cookie: it belongs to a domain other than the one in the address bar. Because the same tracker is embedded on thousands of sites, the same cookie comes back from all of them, and every page view joins the profile. The cookies guide covers the mechanics and the SameSite attribute in depth.
A typical tracking cookie looks like this on the wire, with an expiry measured in years:
Set-Cookie: uid=8f3a1c2e-77b4-4d0f-9e51-2c6b0a9d4e17; Domain=.tracker.example; Path=/; Expires=Sat, 09 Jun 2028 10:00:00 GMT; Secure; SameSite=NoneThe SameSite=None; Secure pair is what allows the cookie to be sent in a cross-site context at all. Where the browser blocks third-party cookies, this cookie is either never stored or is partitioned per top-level site, which breaks the cross-site join.
The browser landscape in 2026 is uneven. Safari's Intelligent Tracking Prevention has blocked third-party cookies by default since 2020. Firefox's Total Cookie Protection partitions them by top-level site by default. Chrome, after announcing and then abandoning its deprecation plan, still allows third-party cookies by default outside Incognito, which is why a tracker blocker still earns its place on Chrome. Our browser check reports the third-party cookie behaviour it observes in your own browser.
Pixels, beacons and link decoration
A tracking pixel is a request for a tiny or invisible image, or a navigator.sendBeacon() call, whose only purpose is to make your browser contact the tracker with the cookie attached and the page URL in the Referer header. Pixels are how email opens are counted (the image loads when the mail is displayed) and how conversion events are reported to ad platforms. They carry no identifier of their own; they are the delivery vehicle for a cookie or for parameters in the URL.
Link decoration is the fallback for when the cookie is blocked. The tracker appends an identifier to the URL you click, such as ?fbclid=IwAR2x... or ?gclid=EAIaIQ..., and the destination site's first-party script reads it and stores it in a first-party cookie. The identifier has been laundered from the third party into the first party. Safari caps the lifetime of cookies created this way to 24 hours, and Firefox strips a list of known decoration parameters in its strict mode, precisely because this route became the main workaround.
CNAME cloaking and server-side tracking
Because browsers treat a first-party subdomain as trusted, some analytics vendors ask customers to create a DNS alias that points a subdomain of the customer's own site at the vendor's servers:
metrics.news.example. CNAME customer-4821.collect.tracker.example.Requests to metrics.news.example are now first-party from the browser's point of view, so cookies set by it are stored and sent with full lifetime, and a blocklist keyed on tracker.example never matches. This is CNAME cloaking. Good blockers resolve the alias and block anyway, and Safari and Firefox limit cookie lifetime for cloaked subdomains, but it is a real gap in naive blocking.
Server-side tracking goes one step further: the page sends events to the site owner's own server, which forwards them to the ad platform out of the browser's sight entirely. Nothing in your browser can block the second hop. What you can still do is deny the first hop the identifiers it wants, which is where cookie limits and fingerprint reduction come back in.
Fingerprinting: tracking without storage
A browser fingerprint is a hash of dozens of observable facts: user agent, screen size, installed fonts, time zone, language list, how your GPU renders a canvas, which audio codecs you support. None of these are secret, and none are stored by the tracker on your machine, which is the point: clearing cookies changes nothing. The combination is often unique enough to identify a browser among millions. The fingerprinting guide explains how uniqueness is measured in bits of identifying information, and our browser check reports your own fingerprint uniqueness and whether canvas fingerprinting produces a stable value.
Take the position seriously: for a determined tracker, fingerprinting is the technique that matters most in 2026, because every other handle is now blocked by default in at least one major browser. It is also the hardest to defeat cleanly, since making your browser less unique means making it look like everyone else's.
Who buys the profile
The profile is not an end in itself. It is matched to other data and sold on. The buyers fall into a few groups:
- Ad exchanges use it in real-time bidding, where the fact that you looked at a product is broadcast to hundreds of bidders in the milliseconds before a page renders.
- Identity graphs tie the browser identifier to a hashed email address captured when you log in or subscribe somewhere, which lets the profile follow you across devices.
- Data brokers combine the online profile with offline records such as property, voter and purchase data. The data broker guide explains who they are and how to opt out.
The US Federal Trade Commission's 2014 report on data brokers documented profiles built from hundreds of sources and sorted into inferred categories, and the mechanism has only become more automated since. That is the reason to care even if you do not mind ads: the inferred categories include health, finances and religion, and the data leaks like any other.
What each protection actually blocks
| Protection | Stops | Does not stop |
|---|---|---|
| Blocking third-party cookies | Cross-site cookie joins | Link decoration, CNAME cloaking, fingerprinting, server-side tracking |
| Deleting cookies on tab close | Long-lived first-party identifiers, laundered link IDs | Fingerprinting, tracking during the session |
| Tracker blocker (filter lists) | Requests to known tracker domains, most pixels and fingerprinting scripts | First-party analytics, unlisted domains, server-side tracking |
| Fingerprint resistance | Stable fingerprints | Cookies, pixels; may break sites |
| VPN | IP-based linking | Everything above |
Two conclusions follow. First, a tracker blocker is the single highest-value protection because it stops the request before any handle can be used. Second, it needs a partner: automatic cookie deletion handles the first-party identifiers a blocker cannot touch, and the two together close most of the gap. Our browser extension bundles both because they are rarely worth having separately.
Tracking you cannot see from the browser
Two further channels are worth knowing about because browser tools do not reach them. Email tracking works through the pixel described above, and the fix is in your mail client: disable remote image loading or use a client that proxies images. Mobile advertising identifiers (IDFA on iOS, GAID on Android) play the cookie's role inside apps; both platforms now let you reset or deny them in settings. The privacy hub covers the other exposures, from leaked IP addresses to reused passwords, that trackers and attackers combine with the profile.
A realistic setup
- Install one well-maintained tracker blocker and leave its default lists on. Do not stack several; they interfere and add fingerprint surface.
- Turn on your browser's strictest built-in tracking protection (Enhanced Tracking Protection Strict in Firefox, third-party cookie blocking in Chrome and Edge).
- Delete cookies automatically for sites you are not logged into.
- Check your referrer leakage and fingerprint uniqueness with a browser check, and change only the settings that measurably reduce them.
- Accept that first-party tracking by the sites you log into cannot be blocked from the browser; limit what you tell them instead.
