Beyond Cookies
As browsers started putting strict limits on third-party cookies (e.g., maximum expiration times), trackers looked for other places to store unique identifiers. The Web Storage API (LocalStorage and SessionStorage) was a primary target.
How it Differs from Cookies
- Capacity: Cookies are limited to 4KB. LocalStorage can hold ~5MB.
- Network: Cookies are sent automatically with every HTTP request. LocalStorage must be read by Javascript and explicitly appended to network requests (e.g., via Fetch or XMLHttpRequest).
- Expiration: Cookies expire. LocalStorage persists until explicitly cleared by the user or script.
The Threat
Because LocalStorage is highly persistent, trackers use it to respawn deleted cookies. If you delete your cookies but forget to clear site data, a script can read your unique ID from LocalStorage on your next visit and recreate the cookie.
Example: Zombie Cookies
1. Tracker sets ID 'XYZ' in Cookie and LocalStorage.
2. User clears Cookies.
3. User returns. Tracker finds Cookie empty.
4. Tracker reads 'XYZ' from LocalStorage.
5. Tracker writes 'XYZ' back to Cookie. The tracking continues seamlessly.