Tracking Cookies: The Silent Surveillance Taking Over the Web

As a cybersecurity researcher with over a decade of experience, I‘ve seen many trends come and go in the world of online privacy. But one constant throughout the years has been the ever-increasing prevalence and sophistication of tracking cookies. These tiny text files, lurking unseen in the background of nearly every website, have become the primary fuel powering the $350 billion online advertising industry. By recording your every click, scroll, and search, tracking cookies allow companies to build shockingly intimate profiles of your behavior and interests. And most troublingly, they do this without your awareness or explicit consent.

In this in-depth guide, I‘ll shed light on the dark world of tracking cookies – explaining exactly what they are, what data they collect, what risks they pose, and most importantly, what you can do to fight back against this pervasive surveillance.

Tracking Cookies By The Numbers

First, let‘s establish just how ubiquitous these tracking cookies really are. A 2020 study by WhoTracks.me found that:

• 80% of websites include at least one third-party tracker
• The average website connects to 13 distinct third-party tracking domains
• News websites have the most trackers, with an average of 27 per page
• Google‘s trackers are present on over 80% of sites, and Facebook‘s on 30%

And it‘s only gotten worse since then. A 2022 analysis by Ghostery found the number of tracking cookies on news sites has grown nearly 70% since 2020. On popular sites like CNN, the median number of third-party cookies per page is a staggering 135.

So wherever you go online, it‘s a sure bet that dozens of trackers are silently recording your activity. Even reputable organizations like universities, hospitals, and government agencies often have ad trackers on their sites.

How Tracking Cookies Undermine Privacy

So what exactly are these trackers collecting about you? The specific data points can vary, but may include:

• Every URL you visit and how long you spend on each page
• Your searches, clicks, scrolls, and mouse movements
• Items you‘ve purchased, added to cart, or saved
• Your IP address and mobile device ID
• Your screen resolution and browser configuration
• Your location (inferred from IP or explicit geolocation)

Over time, data brokers aggregate and analyze these data points to infer your demographics (age, gender, income level), interests, political leanings, health conditions, travel plans, and much more. This data is continually enriched, at an individual level, and regularly bought, sold, and traded on the open market.

The privacy implications of all this data collection are far reaching. Tracking cookies undermine our fundamental rights of freedom of thought and intellectual privacy. The awareness that our every action is watched and judged causes a chilling effect on what we choose to read, watch, and research. Ubiquitous tracking enables manipulation and discrimination through hyper-targeted content. Your browsing history may impact the prices you‘re charged, the job ads you‘re shown, the financial offers you receive. Even if you have "nothing to hide", this level of surveillance is a power imbalance ripe for abuse.

Exposing the Cookie Surveillance Supply Chain

So who exactly are the companies tracking us through cookies? At the top of the heap are the adtech giants Google, Facebook, and Amazon – each of which run massive ad networks that track users across millions of sites. But they are just the tip of the iceberg. Analysis of tracking cookie data flows reveals a complex ecosystem of hundreds of ad exchanges, analytics services, audience segmentation platforms, and data brokers all participating in real-time bidding auctions whenever you load a web page.

Some of the biggest players in this category include:

• Adtech Platforms: DoubleClick, Google Marketing Platform, Facebook Audience Network, Twitter, Simpli.fi, AppNexus, InMobi, Rubicon Project, PubMatic, OpenX
• Audience & Analytics: Google Analytics, LiveRamp, Adobe Audience Manager, Oracle BlueKai, Lotame, Salesforce Audience Studio, Nielsen Marketing Cloud, Neustar
• Data Management Platforms: Adobe Audience Manager, Salesforce DMP, Oracle DMP, Lotame, Nielsen DMP, MediaMath DMP, [x+1]

On a typical ad-supported website, dozens of these companies‘ trackers are present, all communicating and syncing data with each other in a matter of milliseconds every time the page loads. This "cookie syncing" allows companies to match up the different identifiers collected and get a unified view of each user‘s activity.

Compounding the creepiness, much of this tracking happens through scripts and widgets that site owners embed without fully understanding the implications. That unassuming "Like" button may seem innocent, but behind the scenes Facebook uses it to track what articles you read, even if you never click it and aren‘t logged in. Google‘s ubiquitous Analytics script has grown into "the web‘s largest digital panopticon", invisibly recording our activity on over 75% of the top 100,000 sites.

Cookie Consent Theatre

In recent years, privacy regulations like the EU‘s GDPR and California‘s CCPA have aimed to crack down on non-consensual tracking by requiring sites to provide notice and obtain explicit permission before setting cookies. Hence the proliferation of cookie popup banners.

However, in practice, most consent mechanisms are privacy theatre. Sites have turned to manipulative UX dark patterns to confuse and coerce people into clicking "Accept." Many make it significantly more difficult to opt out than opt in, requiring users to navigate through multiple screens and granular settings. And the vast majority of sites offer no way to verify what tracking is truly disabled if you do opt out.

A 2019 study of cookie consent notices found rampant deceptive practices like:

• Pre-selected options that don‘t actually disable tracking
• Confusing wording like double negatives and non-obvious controls
• Threats that opting out will break site functionality or force you to pay
• Overwhelming users with dozens of granular options for each third-party partner

Another 2020 study intercepted web traffic to analyze what data websites actually send to trackers after opting out. The results were grim. Over 90% of sites were still sending tracking data to at least one third-party domain after opt-out. Worse, many simply ignored the consent signal and still set tracking cookies anyway.

So while regulations have led to more disclosure, control largely remains illusory. To truly prevent tracking still requires proactive measures on the user‘s part.

Proactive Steps to Prevent Tracking

Fortunately, there are concrete steps you can take to fight back against tracking cookies and protect your privacy:

1. Browser Settings: Disable third-party cookies in your browser preferences. In Chrome, go to Settings > Privacy & Security > Cookies. In Firefox, go to Preferences > Privacy & Security > Custom. Safari blocks cross-site tracking by default. But note that disabling cookies completely can break some websites.

2. Browser Extensions: Install trusted ad and tracker blocking extensions like uBlock Origin, Ghostery, Privacy Badger, or Disconnect. These automatically block tracking scripts from loading. As a bonus, they can significantly speed up page loads and cut down on annoying ads.

3. Opt Out Pages: Many of the largest ad networks offer opt out portals where you can instruct them not to track you. A good place to start is the Network Advertising Initiative opt-out page, which sets opt out cookies for dozens of the top ad networks.

4. Privacy Browsers: Switch to a browser built for privacy, like Brave or Firefox. These have tracking protection enabled by default and additional features to prevent privacy intrusions like fingerprinting.

5. VPN: Using a trusted VPN makes it harder for trackers to identify you by masking your IP address. Choose a no-log provider that isn‘t itself monetizing your data.

6. Mobile: Tracking is even more pervasive in mobile apps. Limit identifier access, reset your mobile ad ID regularly, and stick to apps from reputable developers with strong privacy practices.

The Tracking Arms Race Continues

While cookies are the best known tracking method, they are far from the only one. The ad industry is engaged in a continual arms race to develop new identification techniques to compensate for privacy countermeasures.

Browser fingerprinting has emerged as an insidious new tracking threat. By collecting dozens of discrete attributes about your browser environment – screen size, installed fonts, WebGL parameters, etc. – trackers can construct a unique "fingerprint" to identify you even without cookies. A 2020 study by Mozilla found fingerprinting scripts on over 25% of the top 500 sites.

Looking ahead, Google‘s "Privacy Sandbox" proposal aims to replace cookies with a complex set of new tracking APIs. While positioned as a privacy improvement, many critics argue these could actually enable even more invasive forms of surveillance and increase Google‘s gatekeeper power over the web. There are also moves to shift tracking to the server side and link online identity to offline data sources like store loyalty cards.

So while the specifics may evolve, tracking and behavioral ads are likely here to stay in some form. Protecting privacy will be an ongoing challenge requiring a multi-layered defense incorporating both technical and policy solutions. As users, staying informed and proactive will be key to preserving our autonomy and freedom of choice in an increasingly watched world.