How do they know it's you?
Web tracking isn't magic; it's a combination of stateful identifiers (cookies, LocalStorage) and stateless identifiers (fingerprinting, IP). Every HTTP request your browser makes inherently leaks metadata.
Stateful Tracking
The traditional method. When you visit a site, the server sends a Set-Cookie header. The next time your browser connects to that domain, it sends the cookie back. This allows the server to recognize the session.
Stateless Tracking (Fingerprinting)
As users started blocking third-party cookies, trackers moved to stateless methods. By querying your browser for a list of installed fonts, rendering a hidden canvas element to see how your specific GPU anti-aliases text, and checking your WebGL renderer string, a tracker can create a highly unique hash of your device.
| Vector | Type | Mitigation |
|---|---|---|
| Cookies | Stateful | Block 3rd-party cookies |
| Canvas | Stateless | Brave Browser / Tor Browser |
| CNAME Cloaking | DNS Routing | Network-level blocking (Pi-hole) |
Common Mistakes
- Assuming "Incognito Mode" stops tracking. (It only deletes state *after* closing, and does nothing against fingerprinting).
- Thinking a VPN stops tracking. (VPNs hide your IP, but not your browser fingerprint or cookies).
Frequently Asked Questions
What is cross-site tracking?
It's when a third-party script (like Facebook Pixel) is loaded on Site A and Site B. Because it's the same script, Facebook can read the cookie it set on Site A while you are visiting Site B, linking your activity across the web.