How online tracking actually works

"Tracking" is a single word for four different mechanisms that operate at different layers. Confusing them is why people block third-party cookies, observe that advertising is still uncannily well-targeted, and conclude that nothing works.

Something did work. It addressed one layer of four.

Layer 1 — stored identifiers

The familiar one. A cookie is a small file placed on your device so a site can recognise it on your return. The UK's Information Commissioner's Office regulates this layer directly, requiring sites to ask before setting anything beyond what is strictly necessary to run the page.

First-party cookies

Come from the site you are visiting and do useful work — keeping you logged in, remembering your basket.

Third-party cookies

Come from a different domain embedded in the page, typically an advertising network. Because the same network is embedded on thousands of sites, it sees a large share of your browsing across all of them, not just one.

Browsers now block third-party cookies by default in most cases, and this was a genuine change. It is also why the industry moved on.

Layer 2 — pixels and beacons

A tracking pixel is a tiny image, usually invisible, loaded from a third-party server. Requesting it tells that server you opened the page.

No stored identifier is required. The request itself carries your IP address, device type, browser, and the page you were on. The FTC's technologists have described this directly: a pixel can be built from ordinary HTML or JavaScript rather than a literal image, which is why it can also report what you typed into a form or which items you viewed, not just that you visited.

Related mechanisms include conversion tracking (a site telling an ad network you bought something) and server-side tagging, where the reporting happens between servers and never touches your browser at all — which no browser setting can block.

Layer 3 — identity resolution

This is the layer that makes the other three coherent, and it is the one people underestimate. The FTC studied it directly in a staff report on cross-device tracking, which found the practice already widespread and largely invisible to the people it applied to.

Cookies and fingerprints identify devices. Identity resolution links devices to a person.

How the link gets made

The mechanism is usually mundane. You log into a service with your email address on your phone. You log into the same service on your laptop. Both device profiles are now associated with one identity — and activity recorded before you logged in can be attributed retroactively.

Hashed email addresses are commonly used as the shared key across advertising systems, which allows linking without the address itself being passed around in plain form. The FTC's report flagged the same limitation this creates for consumers: a stored preference not to be tracked on one device does nothing once that device is linked to others through a shared login.

Layer 4 — offline data

The final layer is not online at all.

Loyalty card purchases, public records, property and vehicle data, warranty registrations, survey responses, and app SDK data are collected and merged by data brokers, then matched to online profiles. The FTC described this combination process over a decade ago in a report on the data broker industry, and enforcement since has shown it has not slowed down — in 2024 the agency took action against a location-data broker for collecting and selling precise movement data from ordinary apps without people's knowledge.

This is how an advertising profile comes to include your estimated income, household composition, and whether you recently moved — none of which you entered on a website.

What each layer requires

And running underneath all four, fingerprinting, which needs a browser that resists it rather than a setting.

The changes worth making

Ordered by effect for effort:

1. Switch to a browser with strong default protection. Firefox, Safari or Brave, with the stricter mode enabled. One decision, applies everywhere.
2. Decline non-essential cookies. One extra click on the banner, and it genuinely reduces third-party collection.
3. Turn off automatic image loading in email. Defeats pixel tracking almost entirely.
4. Turn off ad personalisation in your Google, Meta, Apple and Microsoft account settings. It is available, it is buried, and it works.
5. Use separate browser profiles for things you would rather not have linked — work, personal, shopping.
6. Reduce logged-in browsing where you do not need an account.

Why this is a security question too

Every tracking layer produces profile data, and profile data is what makes a scam convincing.

The FTC's own advice on social media scams begins with limiting what others can see about you — scammers "exploit what a user posts to figure out how to target them" and buy ads targeted by age, interests and shopping habits using the same tools as any advertiser.

The infrastructure built for advertising is available, at low cost, to people building pretexts.

Two practical follow-ups: how to stop apps tracking your location deals with the layer that produces the most sensitive data, and how to remove your personal information from the internet covers getting existing profiles taken down.