What “tracking” means
Online tracking is the collection of information about what a person or device does over time, usually so that the activity can be linked together. A single page view says very little. Thousands of page views, app sessions and searches, tied to the same identifier, can describe interests, routines and sometimes personal circumstances.
Not all tracking is sinister. A shop needs to remember what is in your basket, and a website’s owner often wants to know which pages are popular. The privacy concern arises mainly when activity is gathered across many unrelated sites and apps by companies you never chose to deal with, and then combined or passed on.
The basic ingredients
Most tracking systems rely on three things.
- An identifier. A label that lets a system recognise the same browser, device or person later. It might be a random string stored in the browser, a number issued by the phone’s operating system, or an email address used to sign in.
- A way to observe activity. Small pieces of code on a page, or software built into an app, report back what happened.
- A place to store and combine what was observed. The reports are sent to servers, where events from the same identifier are grouped into a profile.
Everything else is a variation on these three.
Tracking on websites
When you load a web page, your browser also fetches resources from other companies: analytics scripts, advertising code, social media buttons, embedded videos and fonts. Each request tells that company which page you are on, along with technical details such as your IP address and browser type.
If the company has stored an identifier in your browser, the request can carry it too. The most familiar mechanism is the browser cookie, a small piece of text a site asks the browser to keep. When the same advertising company is present on many sites, its identifier arrives with each visit, and it can build a record of pages you viewed across all of them. That is why third-party cookies became the symbol of cross-site tracking, though they are only one method.
Other methods exist alongside them. Sites can place identifiers in web addresses, store data in other browser storage areas, or combine many small device traits into a recognisable pattern, which is the idea behind browser fingerprinting. Some trackers sit on the site’s own server and send data onward from there, which makes them harder for ordinary browser tools to see.
Tracking in apps
Apps do not use cookies in the same way, but they have equivalents. Many apps include software development kits, which are bundles of code from outside companies that provide analytics, crash reporting, advertising or login features. Such a kit may collect information about how the app is used and report it to its provider.
Phones also provide advertising identifiers, resettable numbers that apps can use to recognise the same device across different apps. Operating systems have been adding controls that let users limit or reset these, and how they work varies by platform and version. Apps may also access device information that you allow through app permissions, such as location, which can be a particularly revealing signal.
How the pieces get connected
Linking activity across contexts is the central step. Common routes include:
- Shared identifiers. The same tracker appears in many places and sees the same cookie or advertising identifier.
- Logging in. An email address or account used on several services can tie sessions together, including across a phone and a laptop.
- Matching. Companies can compare their own records, often using scrambled versions of email addresses or phone numbers, to work out that two records belong to the same person. Scrambling an email address does not make it anonymous, since the same address always produces the same result.
- Data brokers. Specialist firms gather records from many sources and sell or license combined profiles. These data brokers are one of the main ways information leaves the original site or app.
The result is often described as a profile: a set of inferred traits such as approximate age range, interests, or likely purchases. Many of these traits are guesses produced by machine learning rather than facts the person supplied, and they can be wrong.
Where the data goes
Tracking data is typically used for several purposes: measuring audiences, personalising content, preventing fraud, and above all selecting ads. In the advertising system, tracking signals are shared with many companies within fractions of a second as a page loads, and the result is targeted advertising. Data may also be retained and shared with partners afterward, depending on the company’s policy and the law that applies.
Other devices contribute as well. Connected televisions and many items in the internet of things can report usage information, with smart TV data being a common example of a household device that records what is watched.
What you can and cannot control
Reasonable steps usually reduce tracking rather than eliminate it. A private browser or built-in tracking protection can block many known trackers. Clearing cookies, limiting app permissions, resetting the advertising identifier and being selective about browser extensions all help to varying degrees. A virtual private network changes what network address sites see, but it does not stop cookies, logins or fingerprinting, so it is only part of the picture.
Some tracking is also tied to services you deliberately use, and avoiding it entirely may mean giving up convenience. Laws in many places give people rights over how companies handle personal data, although the details differ; data protection laws often include rights to access and delete information held about you. It is worth remembering that your digital footprint is shaped as much by what other parties collect as by what you post yourself.
Browsers, operating systems and regulations change over time, so the exact techniques that work, and the controls you have, shift. The underlying pattern of identifiers, observation and combination has stayed fairly constant.