1. Pixel Tracking
The oldest trick in the book. A 1x1 transparent GIF is loaded from a third-party server. When your browser requests this image, it sends your IP address, user agent, and cookies to the tracker.
Deep Dive: Pixel Tracking ->
Live Threat Analysis
Every Click
Is Monitored
You are leaking data. TheyAreTracking.com breaks down the mechanics of web surveillance, CNAME cloaking, and fingerprinting used by modern data brokers.
The Invisible Tax
Trackers don't just steal privacy; they steal bandwidth, battery life, and attention.
73%
Of Top 10K Sites
Use third-party trackers to aggregate user data before the page even fully renders.
2.4MB
Average Payload
The extra Javascript weight loaded strictly for surveillance and ad retargeting.
$200B+
Data Broker Market
The estimated global value of the data broker economy in 2023.
0
Trackers Here
We don't collect, aggregate, or sell your data. View our source to verify.
Live Tracker Analysis
Enter a URL to see a simulated breakdown of third-party domains it connects to. (Note: This is an educational simulation based on average site profiles).
Total Requests
Tracking Domains
Threat Score
Detected Third-Parties
The
Mechanics
2. Browser Fingerprinting
Cookies can be deleted. Your hardware cannot. Scripts query your canvas rendering, installed fonts, WebGL parameters, and audio API to build a unique hash of your specific device.
Deep Dive: Fingerprinting ->3. CNAME Cloaking
Ad blockers look for known tracking domains (e.g., analytics.tracker.com). To bypass this, sites use DNS CNAME records to alias a first-party subdomain (metrics.yoursite.com) to the tracker, fooling the browser into thinking it's a first-party request.
You Are The Product
Data brokers aggregate thousands of data points—purchase history, geolocation, political affiliation, health concerns—into unified profiles sold to the highest bidder.
Expose the EconomyInteractive Tools
View All Tools ->Entropy Calculator
Calculate how identifiable your browser setup is based on standard fingerprinting vectors.
Use Tool ->Cookie Payload Cost
Estimate the bandwidth and latency cost of massive third-party cookie headers.
Use Tool ->CNAME Uncloaker
Simulate resolving a subdomain to see if it masks a known tracking service.
Use Tool ->Tracker Latency
Calculate the render-blocking time caused by synchronous tracking scripts.
Use Tool ->URL Params Decoder
Decode and analyze the telemetry data hidden in pixel tracking URLs.
Use Tool ->Blocker ROI
Calculate data saved per month by running a network-level blocker like Pi-hole.
Use Tool ->Tracking Vectors
The Cookie Fallacy
"Just clear your cookies" is dangerously outdated advice. Modern surveillance infrastructure relies on stateless tracking vectors that survive clearing your browser state.
Learn How
State Is Dead.
Behavior Is Forever.
Behavior Is Forever.
Your Hardware Betrays You
1. GPU Rendering
Scripts force your browser to render complex 3D shapes. How your specific GPU processes anti-aliasing creates a unique mathematical fingerprint.
2. Audio Processing
Your sound card is queried to process an audio signal. The resulting floating-point variations in the buffer are hashed as an identifier.
3. Battery Status
Even innocent APIs like checking battery level or charging status can be combined to form a transient but highly effective tracking metric.
The Legal Illusion
Cookie banners do not protect you. They condition you to click "Accept" via dark patterns.
Read on GDPR FailuresMilli-
second
Markets
Every page load triggers a Real-Time Bidding (RTB) auction. Your location, reading habits, and demographic data are broadcast to hundreds of exchanges in the milliseconds before an ad appears.
RTB Data Flow (Simplified)
1. User Requests Page
↓
2. Bid Request Broadcast (Data Leak)
↓
3. Advertisers Evaluate Profile
↓
4. Winning Ad Displayed
Compartmentalize
Stop logging into Facebook on the same browser you use for banking. Technical isolation is the only guaranteed defense against cross-site aggregation.
View Defense Stack- AApp SDKs: Free mobile games embed ad SDKs that continuously poll your GPS location.
- BIn-App Browsers: Apps open links internally to inject tracking JavaScript into every page you view.
- CPush Tokens: Notifications rely on persistent device identifiers tied to Google/Apple services.
Mobile Defenses Are Flawed
Smartphones are designed as closed ecosystems. Unlike a desktop browser where you control the extensions and network flow, mobile OS structures favor data collection over user sovereignty.
Block at the Source
Browser extensions are not enough to protect your smart TV or mobile apps. You need network-level DNS sinkholing (like Pi-hole) to drop telemetry packets before they leave your router.
If it's free...
The vast majority of the modern web is subsidized by a sprawling, automated surveillance apparatus. When a service is provided without cost, the required server compute and engineering labor are paid for by the extraction, aggregation, and auctioning of behavioral data.
Reclaiming privacy requires friction: paying for secure services, breaking site functionality with aggressive blockers, and spending time learning the mechanics of the systems used against you.
Frequently Asked Questions
Does incognito mode stop tracking?
No. Incognito/Private browsing only prevents your browser from saving history and cookies locally *after* you close the session. While active, websites can still track you, and your ISP/network admin can still see your DNS requests.
Is a VPN enough?
A VPN hides your IP address and encrypts your traffic from your ISP. However, if you are logged into accounts, or if the tracker uses browser fingerprinting, a VPN provides almost zero protection against web tracking.
Why do sites need trackers?
Many sites rely on ad revenue, which pays significantly more for "targeted" ads (based on your tracking profile) than "contextual" ads (based on the page content). Other trackers are for product analytics to see how users interact with the site.