PrivacyProbe Blog
Understanding Cookies, Trackers, and Online Profiling
Published Aug 2026 · 10 min read
Every time you browse the web, websites and third parties may collect information about your device, your activity, and your interactions. Some of that data collection is necessary for core functionality, such as keeping you signed in or remembering what is in your cart. Other collection supports analytics, personalization, advertising, or fraud prevention.
If you have ever viewed a product on one site and then seen related ads elsewhere, you have seen cross-site tracking in practice. Cookies are a major part of that ecosystem, but they are no longer the only mechanism. Modern tracking can also rely on browser storage, fingerprinting signals, scripts, tags, and related techniques.
Privacy laws such as the GDPR and California's CCPA/CPRA create meaningful rights and legal limits, but they do not make tracking disappear. Understanding the mechanics is still one of the most practical ways to make informed choices about consent banners, browser settings, and privacy tools.
Index
- What Are Cookies and How Do They Work?
- First-Party vs. Third-Party Cookies
- Beyond Cookies: Modern Tracking Methods
- Online Profiling and Behavioral Targeting
- Privacy Laws and Cookie Consent
- How to Reduce Tracking
What Are Cookies and How Do They Work?
Cookies are small pieces of data that websites ask browsers to store and send back later through the HTTP Set-Cookie and Cookie mechanisms. They exist because HTTP is largely stateless: without state mechanisms, websites cannot reliably recognize that successive requests belong to the same session.
That makes cookies useful for normal operations like authentication, carts, language settings, and session continuity. Cookies are also used for analytics, fraud controls, personalization, and advertising. The privacy issue is not the existence of cookies alone, but that repeated identifiers can be used to recognize people over time and, in some contexts, across sites.
Cookies are often categorized by duration and by who sets them. Session cookies usually expire when browsing ends, while persistent cookies remain until a defined expiry or manual deletion. Cookies are also described as first-party or third-party depending on whether they are tied to the visited site or to an external domain present on the page.
First-Party vs. Third-Party Cookies
First-party cookies are associated with the site a person is directly visiting. They are commonly used for account sessions, preferences, security controls, subscriptions, and carts.
Third-party cookies are associated with a different domain than the one in the browser address bar. Historically, they were a key way ad-tech and embedded services recognized browsers across multiple websites for behavioral advertising.
Browser behavior now differs by vendor. Safari's WebKit says Intelligent Tracking Prevention blocks third-party cookies by default, with limited exceptions through mechanisms like the Storage Access API. Firefox's Total Cookie Protection isolates cookies to their originating site context. Chrome has introduced its own tracking protections and restrictions, but not the same implementation model as Safari or Firefox.
So third-party cookies still matter, but they now sit inside a broader tracking ecosystem rather than defining it entirely.
Beyond Cookies: Modern Tracking Methods
Regulators increasingly frame the issue as broader than cookies. The UK ICO, for example, discusses rules for storage and access technologies including cookies, pixels, scripts, tags, web storage, and fingerprinting techniques.
Web storage APIs such as localStorage and sessionStorage can store key-value data outside cookie headers. localStorage typically persists across sessions unless cleared. sessionStorage is more temporary, but both can support persistent recognition patterns depending on implementation choices.
Browser fingerprinting is another major category. W3C guidance describes fingerprinting as identification or re-identification using observable browser, device, or network characteristics rather than a traditional stored identifier. Individual signals may be common, but combinations can make browsers more distinguishable.
Other mechanisms include tracking pixels, scripts and tags, link decoration patterns, and API-level signals that may expose network or device attributes. Some cache-related techniques, such as ETags, have also been discussed historically as persistence vectors.
WebRTC is not a tracking technology by design, but network details exposed by real-time communication features can create privacy risk in some contexts. Browser mitigations such as mDNS masking were introduced to reduce those risks.
Online Profiling and Behavioral Targeting
Tracking gets more powerful when many observations are combined into a profile. GDPR defines profiling broadly as automated processing of personal data to evaluate or predict aspects of a person, including interests, behavior, location, and preferences.
In practice, profiles may use page visits, search behavior, approximate location, time patterns, purchase signals, and inferred interests. These profiles can shape ad delivery, recommendations, segmentation, risk scoring, and offer prioritization.
Not all profiling is unlawful or harmful; some use cases support security or fraud prevention. But regulators focus on profiling that is opaque, excessive, discriminatory, or hard for users to avoid. The FTC has also highlighted concerns around "surveillance pricing" based on detailed personal data.
Privacy Laws and Cookie Consent
In Europe and the UK, cookie and similar technology rules come from both ePrivacy-style rules (such as PECR) and data protection rules (GDPR/UK GDPR) when personal data is involved. Non-essential storage or access technologies generally require valid consent unless a specific exemption applies.
Under GDPR-style standards, valid consent must be freely given, specific, informed, and unambiguous. Regulators continue to emphasize genuine choice and discourage interfaces that make acceptance easy while making refusal unnecessarily difficult.
California takes a different legal structure. CCPA/CPRA does not mirror the same broad prior-consent model for cookies. Instead, it grants rights to know, delete, correct, and opt out of sale/sharing, plus additional controls for sensitive personal information. In ad-tech contexts, "sharing" is often the key concept for cross-context behavioral advertising.
That means a cookie banner alone is not proof of privacy quality. The design of consent flows, defaults, and friction still matters in practice.
How to Reduce Tracking
No single setting eliminates all tracking, but layered controls can reduce it significantly. Start by restricting third-party cookies or enabling browser anti-tracking protections where available. Then review site permissions, clear stored data periodically, and separate sensitive browsing activities across browser profiles.
Content blockers and privacy-focused browsers can add meaningful protection. For fingerprinting concerns, remember that cookie controls alone are not enough; resistance depends heavily on browser architecture and anti-fingerprinting design choices.
VPNs can reduce IP-based exposure, but they are not a complete anti-tracking solution. They do not prevent all browser-side identifiers or all inference methods.
A practical approach is layered: use browser protections, reject non-essential tracking where possible, and minimize unnecessary data sharing.
Final Thoughts
Cookies were created to preserve state across the web's largely stateless request model, and many still support useful functionality. But today's privacy landscape extends far beyond cookies. Tracking now includes storage APIs, scripts, pixels, fingerprinting signals, and automated profiling systems that influence decisions about ads, offers, and personalization.
Understanding that difference helps people make more informed choices. A website may use cookies primarily for session continuity, or it may combine multiple techniques to infer and act on detailed behavioral data. Those are different privacy realities, and they should be assessed differently.