Online Privacy
How Websites Track You Without Cookies
Most people know about cookies. Fewer know that cookies are only one of five ways websites follow you — and that blocking them leaves the other four running. This guide explains each method in plain English, and what actually stops it.
Try the tool: URL Structure Analyzer
Method 1: Cookies — the one everyone knows
A cookie is a small file a website asks your browser to store, so it can remember you: your login, your basket, your language. A first-party cookie comes from the site you are visiting and is mostly useful. A third-party cookie comes from another company whose code runs on the page — an advertiser or analytics firm — and it follows you from site to site, building a picture of your interests. When you see an ad for shoes on a news site, minutes after looking at shoes in a shop, a third-party cookie (or one of the methods below) is usually why. Most browsers now block third-party cookies by default, and you can delete the rest — but the tracker simply switches to the methods below.
Method 2: Browser fingerprinting
Fingerprinting identifies your browser from details it naturally reveals: screen size, fonts, operating system, browser version, time zone, language, and how it draws hidden images. None is secret on its own, but together they are often distinctive. Unlike a cookie, a fingerprint is not a file on your device — you cannot delete it, and clearing cookies does nothing to it. The published studies disagree about how often fingerprints are unique, and our guide to browser fingerprinting explains why, figure by figure. The defence is to look ordinary: a common browser setup, few unusual extensions, and tracker blocking switched on.
Method 3: Tracking pixels and scripts
A tracking pixel is a tiny invisible image embedded in a web page or an email. When your browser loads it, the sender's server records that you opened the page or the email, when you opened it, and from which device. That is how email senders know you read their message. Scripts go further: a piece of code from an advertising or analytics company, loaded by the page you are reading, can watch what you click, how far you scroll, and how long you stay — then report it back. One page commonly loads scripts from a dozen companies you never heard of. Content blockers stop most of these scripts from loading at all, which is the most effective single defence.
Method 4: Your IP address and location
Every connection reveals your IP address, which identifies your network and your rough location — usually your town or city. Sites combine it with other signals to recognise a returning visitor even without a cookie. Your device's GPS and Wi-Fi network names reveal far more, when you grant an app or site location permission. A VPN replaces your IP address with the provider's, as our what a VPN hides guide explains — but it does nothing about the other four methods.
Method 5: Your account login — the strongest tracker of all
The most accurate tracking needs no trickery at all: you log in. The moment you sign in to an account, the company knows it is you, across every device and every visit, and it can join your browsing to your purchases, your searches and your location history. This is why the biggest trackers are the companies whose accounts you already hold. The defence is not to stop logging in — it is to choose what you share: review the privacy settings of the services you use most, turn off ad personalisation and location history you do not need, and use separate browser profiles for separate parts of your life, so one site's tracking does not follow you elsewhere.
What the trackers do with it
The data feeds three things. Advertising is the biggest: supposedly anonymous profiles of interests, sold to advertisers who bid to show you an ad. Analytics is the second: sites study how visitors behave to improve their pages. The third is data brokering: companies that buy, combine and resell personal data, which is why your details can surface in places you never visited. None of this requires your name to work — a profile can follow your browser for years without ever knowing who you are, and it becomes yours the moment you log in or buy something.
How to fight back — what actually works
- Block third-party cookies and trackers. In your browser settings, turn on third-party cookie blocking and built-in tracking protection. One minute, large effect.
- Use a reputable content blocker. It stops tracking scripts and pixels from loading in the first place.
- Audit your biggest accounts. Open the privacy settings of the services you use most and turn off ad personalisation and location history you do not need.
- Use separate browser profiles. One for work, one for personal use — free, quick to set up, and it stops one site's tracking following you elsewhere.
- Limit location permissions. Give apps location access only while using them, and never to sites that do not need it.
- Understand a VPN's limits. A VPN hides your IP address and your browsing from your provider. It does nothing about cookies, fingerprinting, pixels or logins. Use it for its own job, not as a cure-all.
For the full picture, see our digital footprint guide — which shows you how to check what is already out there about you — and our metadata guide, which explains what your own photos and files reveal about you.
The honest summary. Tracking is five methods, not one — and the popular fixes each stop only part of it. Cookies are the visible part; fingerprinting, pixels, IP addresses and logins do the quiet work. Fight it in layers: block trackers, audit accounts, limit location, look ordinary.
Sources
- Electronic Frontier Foundation — Cover Your Tracks — how browsers reveal tracking signals (2026). Last checked: 14 November 2026.
- Peter Eckersley, "How Unique Is Your Web Browser?", Electronic Frontier Foundation, 2010 — Panopticlick paper (PDF) . Last checked: 14 November 2026.
- Electronic Frontier Foundation — privacy and tracking explainers (eff.org). Last checked: 14 November 2026.
- Learn Dark Web Editorial Policy — how this site researches and checks its guides (2026).
Last checked: 14 November 2026.
Frequently asked questions
How do websites track you without cookies?
Through browser fingerprinting (screen size, fonts, system details), tracking pixels and scripts, your IP address, your account login, and data shared between companies. Blocking cookies stops only one method — the others keep working unless you block them too.
What is a third-party cookie?
A cookie placed not by the site you are visiting but by another company whose code runs on the page — usually an advertiser or analytics firm. It follows you from site to site and builds a picture of your interests. Most browsers now block third-party cookies by default.
Does clearing cookies stop tracking?
Only partly. It deletes the cookies stored on your device, but trackers also use fingerprinting, your IP address and your account logins, and they set fresh cookies the moment you visit again. Clearing cookies is one step, not a reset button.
What is a tracking pixel?
A tiny, invisible image embedded in a page or email. When your browser loads it, the sender’s server records that you opened the page or email, when, and from which device. Pixels are how email senders know you opened their message.
Can a website track me if I never log in?
Yes — through your IP address, cookies, fingerprinting and tracking pixels. Logging in makes tracking far more accurate, because it ties every visit to your name, but trackers can follow an anonymous browser too.