How Online Tracking Works: Cookies, Pixels and Fingerprints

Online tracking is the collection of information about what you do on the web, usually to recognize you from one visit or site to the next.

The main tools are cookies, tracking pixels and browser fingerprints, and each can be limited in a different way.

This guide explains how each works, which browsers block what by default, and what you can do.

It also covers the other meaning of the phrase, package tracking, with links to the carriers' own pages. Sources were checked on October 21, 2026.

The short answer

Cookies are small pieces of data a site stores in your browser. Tracking pixels are snippets of code that report your visit to another company. Fingerprinting builds a profile from details of your device, so it needs no stored file.

To reduce tracking, use a browser that blocks third-party cookies by default, send the Global Privacy Control signal, and test your browser on EFF's Cover Your Tracks. No single setting stops all three methods.

What online tracking means

Tracking links your activity across pages and visits. A site you use directly is called first-party. Another company's code running on that page, such as an advertising or analytics service, is third-party.

Third parties can see which pages load their code, and they use cookies, pixels or fingerprints to recognize you elsewhere. That is the basis of behavioral advertising.

Cookies

MDN, Mozilla's web documentation, says a server typically uses the contents of cookies to decide whether different requests come from the same browser or user.

That is how a site keeps you signed in, and it is also how tracking works.

The SameSite attribute lets a server specify whether cookies are sent with cross-site requests. Those cross-site cookies are what MDN calls third-party cookies.

Third-party cookies and your browser

MDN lists how a selection of browsers handle third-party cookies. It is a snapshot of the page as read on October 21, 2026.

WebKit, the engine behind Safari, says most of its tracking prevention technologies have been on by default, going back to Safari 1.0 in 2003.

Tracking pixels

A tracking pixel is a snippet of code on a page that reports your visit to another company. The best-known examples named in a 2022 US health bulletin were the Meta (Facebook) pixel and Google Analytics.

That bulletin, from the US Department of Health and Human Services, covered how health providers use cookies, pixels and similar tools.

On June 20, 2024, a federal court in Texas vacated one part of it: the idea that an IP address combined with a visit to a public page triggers privacy-law duties. HHS later dropped its appeal.

The ruling concerned one US health privacy law, not tracking in general. It does not make pixels private, and it does not stop other laws applying.

Browser fingerprinting

EFF describes a digital fingerprint as a list of characteristics unique to a single user, their browser and their hardware setup.

It includes things a browser must send, plus seemingly insignificant details such as screen resolution and installed fonts, which tracking scripts gather and stitch together.

Unlike a cookie, a fingerprint is not stored on your device, so clearing cookies does not remove it.

EFF's Cover Your Tracks tool shows how unique and identifiable your browser is. WebKit says it looks for fingerprinting vulnerabilities as it adds new web features.

Online tracking examples

How one tracked ad is assembled

This is a simplified picture, not a description of any one company. You open a page, and code from other companies loads with it. Each can set a cookie, report the visit like a pixel, or read device details.

If they recognize you, they can add the visit to a profile held under an identifier. When you open another site that loads the same code, they can recognize you there too, and an ad can follow.

The method differs but the aim is the same: recognize you again. That is why the defenses work in layers.

Method	What it uses	Easy to clear?
Cookie	A small file in your browser	Yes, delete cookies
Third-party cookie	A cookie set by another company's code	Yes, or block by default
Tracking pixel	A snippet of code that reports your visit	No, block the request or the script
Fingerprint	Browser and device details	No, it is not stored on your device
Advertising ID	An identifier on your phone	Yes, in app privacy settings

The last row is covered in our guide to App Tracking Transparency, which explains how an iPhone limits an app's access to its advertising identifier.

Apple's iPhone User Guide says every app has to get your permission before it follows you or your iPhone across other companies' websites or apps for advertising, or shares your information with data brokers.

You can review this in Settings > Privacy & Security > Tracking. It is the phone's version of the same idea: stop another company's code from following you from one place to the next.

Global Privacy Control

Global Privacy Control is a browser signal that tells websites you do not want your personal information sold or shared.

Its site says that you can send it in one step, and that participating websites can respect your privacy rights accordingly.

The GPC site also says some state privacy laws require businesses to honor it. Whether a particular site does so is a different question, so treat it as one layer of protection, not a guarantee.

How to reduce online tracking

Why layers matter

Blocking cookies does not stop fingerprinting, because EFF says a fingerprint is built from details a browser sends, not from a stored file. Limiting fingerprinting does not stop a site you are logged in to from knowing who you are.

So treat each defense as covering one method. Browser protections cut cross-site cookies, the signal asks businesses to stop selling or sharing your data, and Cover Your Tracks shows what remains.

This section is our advice, built on the sources above.

If you meant package tracking

Many people searching for online tracking mean following a parcel. Use the carrier's own page and the tracking number from your receipt or shipping email: USPS Tracking, UPS Tracking or FedEx Tracking.

Our advice: type the carrier's address yourself instead of following a link in an unexpected text or email. A tracking number does not need your password or card details.

Frequently asked questions

What does online tracking mean?

It means collecting information about your activity on the web and linking it across pages and visits. Cookies, pixels and fingerprints are the main methods.

Do cookies track me across websites?

Third-party cookies can. MDN says Firefox and Safari block them from doing so by default, and that Chrome does not block them by default.

Can I stop fingerprinting?

Not with one switch. A fingerprint is built from device details, so the best defenses are browser features that limit what sites can read, and sites that you trust.

Is a tracking pixel the same as a cookie?

No. A pixel is code that reports a visit, and it can work without a stored file. Cookies are stored in your browser.

How do I track a package online?

Use the carrier's tracking page and your tracking number. The links above go to USPS, UPS and FedEx.

A quick checklist

• Check how your browser treats third-party cookies.
• Turn on Global Privacy Control.
• Run Cover Your Tracks on your main browser.
• Review app tracking permissions on your phone.
• Use the carrier's own site for parcel tracking.

Up nextData brokers explained and how to opt outTracking does not stop at your browser. Our guide to data brokers explains who buys the information and how to opt out.→