Key Takeaways
- Cookies remember your preferences and logins, but third-party cookies also track you across unrelated sites.
- Tracking pixels and browser fingerprinting can identify you even without cookies.
- You can manage, limit, or delete cookies through your browser settings at any time.
- Incognito mode doesn't block cookies from being set — it only deletes them when the session ends.
- Websites are required to disclose cookie use, but consent banners vary widely in how fairly they present your choices.
Browser Cookies
A browser cookie is a small text file a website saves on your device when you visit. It stores information — like your login status, shopping cart contents, or preferences — so the site recognises you when you return. Cookies themselves are not programs and cannot run code or carry viruses.
Cookies are categorised as first-party (set by the site you're visiting) or third-party (set by external services like ad networks embedded in that site). Third-party cookies are the primary mechanism behind cross-site tracking.
The Quiet Exchange That Happens Every Time You Visit a Website
You type a web address, hit Enter, and a page loads. Simple enough — but behind the scenes, a series of small data exchanges happens in milliseconds. Websites recognise returning visitors, remember what you left in a shopping cart, and serve ads for products you viewed days ago on an entirely different site. None of this is magic. Most of it comes down to three mechanisms: cookies, tracking pixels, and browser fingerprinting.
Understanding how these tools work gives you real control over what you share — and what you don't. It also helps make sense of those cookie consent banners that appear on nearly every site you visit.
Cookie Consent Banners Aren't Always Neutral
Many cookie consent notices are designed to make accepting all cookies the easiest choice — large colorful buttons for "Accept All" and small gray text for managing preferences. Privacy researchers call this a "dark pattern." Take an extra moment to find the full preference menu before accepting, especially on sites you visit frequently.
First-Party vs. Third-Party Cookies: A Critical Difference
Not all cookies work the same way. First-party cookies are set by the website you're actually visiting. They handle genuinely useful tasks: keeping you logged in, saving your language preference, or remembering what's in your cart. Without them, most websites would feel broken.
Third-party cookies are the ones that raise privacy concerns. They're placed by external companies — typically advertising or analytics services — whose code is quietly embedded in the site you're visiting. Because these same ad networks appear on thousands of different websites, their cookies can follow your activity across the web, building a detailed picture of your interests, habits, and behavior over time.
This cross-site tracking is what lets an ad for running shoes follow you from a sports news article to a recipe blog. The shoes retailer didn't place that ad — an ad network did, using the browsing profile it assembled about you.
Block Third-Party Cookies First
If you want a quick privacy win, start by blocking third-party cookies in your browser settings — this disrupts cross-site tracking with minimal impact on everyday browsing. Most major browsers include this option under Privacy or Security settings. First-party cookies will still work, so logins and shopping carts remain functional.
Beyond Cookies: Pixels and Fingerprinting
Cookies are well-known, so some tracking has shifted to methods that are harder to see or block.
Tracking pixels (also called web beacons) are tiny, invisible images — often just one pixel — embedded in a webpage or email. When your browser or email client loads the pixel, it sends a signal back to the server: confirming you opened the email, which page you visited, and basic details like your IP address and browser type. Email newsletters frequently use these to measure open rates.
Browser fingerprinting is more sophisticated. Every browser leaks small details about your device — screen resolution, installed fonts, time zone, browser version, graphics hardware. Individually, these details are unremarkable. Combined, they form a profile unique enough to identify your device with high accuracy, even if you've cleared all cookies or switched to a private browsing window.
For a broader look at the trail you leave across the internet, see our article on your digital footprint.
~80%
Websites using third-party tracking tools
Research by web privacy analysts has consistently found that the large majority of popular websites embed third-party tracking scripts from ad networks or analytics services.
1 pixel
Size of a tracking pixel image
Tracking pixels are designed to be completely invisible to the human eye — a single pixel rendered in the same color as the background, yet fully functional as a data signal.
18+
Browser attributes used in fingerprinting
Studies on browser fingerprinting have shown that combining even a modest number of technical browser and device attributes can uniquely identify a large proportion of users.
What You Can Actually Do About It
You have more control than most people realise. Here are practical steps that genuinely make a difference:
- Block third-party cookies: Most browsers allow you to block third-party cookies specifically without blocking first-party ones. Check your browser's Privacy or Security settings.
- Review and clear cookies regularly: Your browser's settings menu lets you see all stored cookies and delete them selectively or all at once.
- Read cookie consent banners carefully: Many banners pre-select all options as accepted. Look for a "Reject all" or "Manage preferences" option before clicking Accept.
- Use privacy-focused browser extensions: Tools that block tracking scripts can reduce fingerprinting exposure, though no solution is complete.
Keep in mind that incognito mode is not the same as private browsing with tracking protection — it deletes cookies after a session but doesn't block them while you're browsing. For context on what apps collect beyond browsing, our article on what apps actually know about you covers related ground. You can also explore broader strategies in our Privacy & Safety hub.