Tracking, Cookies, and Fingerprinting

Websites use multiple mechanisms to track users across sessions and sites: cookies, local storage, tracking pixels, and browser fingerprinting. This data is used for advertising, analytics, and sometimes malicious profiling.

First-party cookies are set by the website you are visiting. They store session state, preferences, and authentication tokens. These are generally necessary for websites to function and are considered acceptable.

Third-party cookies are set by domains other than the one you're visiting — typically ad networks, analytics providers, or social media widgets. They track you across every site that includes their resources.

Major browsers are phasing out third-party cookies.

Important cookie security attributes:

• HttpOnly — prevents JavaScript access (anti-XSS)
• Secure — sent only over HTTPS
• SameSite=Strict/Lax — prevents CSRF attacks
• Max-Age/Expires — limits session lifetime

A tracking pixel is a 1x1 transparent image embedded in emails or web pages. When loaded, it sends the user's IP address and load time to the tracker. Email clients that load images automatically reveal when emails are opened and from where.

Web APIs like localStorage and sessionStorage allow sites to store data in the browser. Unlike cookies, these don't automatically send to the server and can store more data. They persist after closing the browser (localStorage) until explicitly cleared.

Browser fingerprinting identifies users without cookies by combining unique browser characteristics:

• User-agent string
• Screen resolution and color depth
• Installed fonts and plugins
• Canvas and WebGL rendering output
• Timezone and language settings

Each combination is highly unique — often more reliable than cookies.

Canvas fingerprinting draws hidden graphics in an HTML canvas element. Different GPU/driver combinations render text slightly differently. The pixel data hash uniquely identifies the device without setting any cookies.

Anti-tracking measures:

• Use Firefox with Enhanced Tracking Protection
• uBlock Origin with tracking blocklists
• Privacy Badger for learning-based blocking
• Tor Browser for maximum anonymity
• Disable JavaScript on sensitive sites (blocks fingerprinting)

Tor Browser standardizes all fingerprinting values across users — everyone looks the same. It also routes traffic through three hops, hiding your IP. Trade-off: significant performance reduction and some sites block Tor exit nodes.

The GDPR (EU) and ePrivacy Directive require obtaining consent before placing non-essential cookies. Cookie banners are the result. Despite banners, enforcement is inconsistent and many sites use dark patterns to nudge users into accepting all cookies.

Which technique identifies users by combining unique browser properties like GPU rendering output and installed fonts, without setting any cookies?

Websites track users via first- and third-party cookies, tracking pixels, localStorage, and browser fingerprinting. Fingerprinting is especially persistent — it requires no cookies and survives cache clearing. Defenses include ETP (Firefox), uBlock Origin, Privacy Badger, and Tor Browser for high-privacy needs.