Web tracking

Methods

IP address

Every device connected to the Internet is assigned a unique IP address, which is needed to enable devices to communicate with each other. With appropriate software on the host website, the IP address of visitors to the site can be logged and can also be used to determine the visitor's geographical location. Logging the IP address can, for example, monitor if a person voted more than once, as well as their viewing pattern. Knowing the visitor's location indicates, besides other things, the country. This may, for example, result in prices being quoted in the local currency, the price or the range of goods that are available, special conditions applying and in some cases requests from or responses to a certain country being blocked entirely. Internet users may circumvent censorship and geo-blocking and protect personal identity and location to stay anonymous on the internet using a VPN connection.

HTTP cookie

An HTTP cookie is code and information embedded onto a user's device by a website when the user visits the website. The website might then retrieve the information on the cookie on subsequent visits to the website by the user. Cookies can be used to customise the user's browsing experience and to deliver targeted ads. Some browsing activities that cookies can store are:

• pages and content a user browsed,
• what a user searched online,
• when a user clicked on an online advertisement,
• what time a user visited a site.

First- and third-party cookies

A first-party cookie is created by the website the user is visiting. The main goal of first-party cookies is usually to recognize the user and their preferences so that their desired settings can be applied.

A third-party cookie is created by websites other than the one a user visits. They insert additional tracking code that can record a user's online activity. On-site analytics refers to data collection on the current site. It is used to measure many aspects of user interactions, including the number of times a user visits.

Restrictions on third-party cookies introduced by web browsers are bypassed by some tracking companies using a technique called CNAME cloaking, where a third-party tracking service is assigned a DNS record in the first-party origin domain (usually CNAME) so that it's masqueraded as first-party even though it's a separate entity in legal and organizational terms. This technique is blocked by some browsers and ad blockers using block lists of known trackers.

ETags

ETags can be used to track unique users, as HTTP cookies are increasingly being deleted by privacy-aware users. In July 2011, Ashkan Soltani and a team of researchers at UC Berkeley reported that a number of websites, including Hulu, were using ETags for tracking purposes. Hulu and KISSmetrics have both ceased "respawning" as of 29 July 2011, as KISSmetrics and over 20 of its clients are facing a class-action lawsuit over the use of "undeletable" tracking cookies partially involving the use of ETags.

Because ETags are cached by the browser and returned with subsequent requests for the same resource, a tracking server can simply repeat any ETag received from the browser to ensure an assigned ETag persists indefinitely (in a similar way to persistent cookies). Additional caching headers can also enhance the preservation of ETag data.

ETags may be flushable by clearing the browser cache (implementations vary).

Other methods

• Canvas fingerprinting allows websites to identify and track users using HTML5 canvas elements instead of using a browser cookie.
• Cross-device tracking are used by advertisers to help identify which channels are most successful in helping convert browsers into buyers.
• Click-through rate is used by advertisers to measure the number of clicks they receive on their ads per number of impressions.
• Mouse tracking collects the user's mouse cursor positions on the computer.
• Browser fingerprinting relies on users' browsers and is a way of identifying users whenever they go online and tracking their activity. Through fingerprinting, websites can determine the user's operating system, language, time zone, and browser version without their permission.
• Supercookies or "evercookies" can not only be used to track users across the web, but they are also hard to detect and difficult to remove since they are stored in a different place than the standard cookies.
• Session replay scripts allows the ability to replay a visitor's journey on a web site or within a mobile application or web application.
• "Redirect tracking" is the use of redirect pages to track users across websites.
• Web beacons are commonly used to report that an individual who received an email has read it.
• Favicons can be used to track users since the browser stores them separately from other data across sessions.
• Federated Learning of Cohorts (FLoC), trialed in Google Chrome in 2021, which intends to replace existing behavioral tracking which relies on tracking individual user actions and aggregating them on the server side with web browser declaring their membership in a behavioral cohort. EFF has criticized FLoC as retaining the fundamental paradigm of surveillance economy, where "each user's behavior follows them from site to site as a label, inscrutable at a glance but rich with meaning to those in the know".
• "UID smuggling" (method of tracking users on the Internet that allows user identifiers (UIDs) to be synchronized across different sites) was found to be prevalent and largely not mitigated by the latest protection tools – such as Firefox's tracking protection and uBlock Origin – by a 2022 study, which also contributed to countermeasures.

Browsers

A 2025 study shows that there are varying degrees to which browsers collect users' browsing data. It notes that Chrome is the browser that collects the most personal data without any user action, across 20 different data types, compared to an average of six for the typical competing browser, with Brave and Tor collecting two anonymous data types and none, respectively. This data includes unique identifiers, device identifier, contact list information, financial data (card, account, etc.), location, and complete browsing history.

Controversy

Web browsing is linked to a user's personal information. Location, interests, purchases, and more can be revealed just by what page a user visits. This allows them to draw conclusions about a user, and analyze patterns of activity. Use of web tracking can be controversial when applied in the context of a private individual; and to varying degrees is subject to legislation such as the EU's eCommerce Directive and the UK's Data Protection Act. When it is done without the knowledge of a user, it may be considered a breach of browser security.

Justification

In a business-to-business context, understanding a visitor's behavior in order to identify buying intentions is seen by many commercial organizations as an effective way to target marketing activities. Visiting companies can be approached, both online and offline, with marketing and sales propositions which are relevant to their current requirements. From the point of view of a sales organization, engaging with a potential customer when they are actively looking to buy can produce savings in otherwise wasted marketing funds.

Prevention

The more advanced protection tools are or include Firefox's tracking protection and the browser add-ons uBlock Origin and Privacy Badger.

Moreover, they may include the browser add-on NoScript, the use of an alternative search engine like DuckDuckGo and the use of a VPN.

On mobile

On mobile, the most advanced method may be the use of the mobile browser Firefox Focus, which mitigates web tracking on mobile to a large extent, including Total Cookie Protection and similar to the private mode in the conventional Firefox browser.

Opt-out requests

Users can also control third-party web tracking to some extent by other means. Opt-out cookies let users block websites from installing future cookies. Websites may be blocked from installing third-party advertisers or cookies on a browser, which will prevent tracking on the user's page. Do Not Track is a web browser setting that can request a web application to disable the tracking of a user. Enabling this feature will send a request to the website users are on to voluntarily disable their cross-site user tracking.

Privacy mode

Contrary to popular belief, browser privacy mode does not prevent (all) tracking attempts because it usually only blocks the storage of information on the visitor site (cookies). It does not help, however, against the various fingerprinting methods. Such fingerprints can be de-anonymized. When using a privacy mode, one may not stay logged into a website, and preferences may be lost, because the cookies storing those preferences are deleted by the browser automatically.

Browsers

Some web browsers use "tracking protection" or "tracking prevention" features to block web trackers. The teams behind the NoScript and uBlock add-ons have assisted with developing Firefox's SmartBlock capabilities.

Search Engines

To safeguard user data from tracking by search engines, various privacy-focused search engines have been developed as alternatives. Examples of such search engines include DuckDuckGo, MetaGer, and Swiscows, which prioritize preventing the storage and tracking of user activity.