Your Digital Crumbs: The Privacy Risks of Cookies and Online Tracking
Spend any amount of time browsing the web and you‘re bound to encounter a message asking you to accept cookies. Thanks to privacy laws like the EU‘s GDPR and California‘s CCPA, websites now have to disclose that they use cookies and get your consent to do so. But what exactly are you agreeing to when you click "accept all cookies"? As a cyber security consultant who‘s analyzed cookie technology for over a decade, I want to unpack the privacy implications of ubiquitous online tracking and what you can do to take back control of your data.
Anatomy of a cookie
At their most basic, cookies are small text files that websites save on your device. They can store login credentials and preferences to provide a smoother browsing experience. However, they can also store unique identifiers that allow websites and third parties to recognize your device and track your activity across the web.
There are several different types of cookies that present varying levels of privacy risk:
| Cookie Type | Set By | Purpose | Privacy Concerns |
|---|---|---|---|
| Session cookie | Website you‘re visiting | Enables basic website functionality like maintaining login status | Minimal; only tracks activity within a single website during one browsing session |
| Persistent first-party cookie | Website you‘re visiting | Remembers preferences, login details, etc. across multiple browsing sessions | Moderate; allows a website to track repeat visits and activity over time |
| Third-party tracking cookie | Advertising platforms, analytics companies, and other entities separate from the website you‘re visiting | Tracks browsing activity across all websites where the third party has a presence to compile a behavioral profile | Severe; enables cross-site tracking, profiling, and targeting by companies you may not even be aware of |
So while first-party cookies generally just enable you to use a website as intended, third-party cookies raise much thornier privacy issues. As the Electronic Frontier Foundation‘s Alexis Hancock explains, "the privacy implications come down to how that cookie is being used. Cookies that are simply keeping you logged in are fine from a privacy perspective. It‘s the cookies that are storing a unique identifier and sending your browsing data to third-party servers to track you across websites that are concerning."
The tangled web of third-party tracking
To understand how third-party cookies track you across the web, consider this hypothetical:
- You visit a news website that has an ad from an advertising platform (let‘s call them "Ads Inc.").
- Ads Inc. places a cookie on your device with a unique identifier.
- You then navigate to an online store that also displays ads from Ads Inc.
- Ads Inc. recognizes you via the cookie identifier and records that you visited the store.
- Later, you see ads for products from that store on entirely different websites that partner with Ads Inc.
Behind the scenes, Ads Inc. is compiling a detailed record of the websites you visit, the things you shop for, the links you click, and more. They use this behavioral data to infer your interests, tastes, and purchasing intent. Then they share those insights with their advertising partners to show you uncannily targeted ads.
In many cases, multiple tracking companies beyond just Ads Inc. are simultaneously collecting data on you and trading information with each other through a process called cookie syncing. According to a 2020 study from NordVPN, the average website has 12 third-party trackers. Google trackers are present on 84% of websites.
Source: NordVPN analysis of third-party trackers on the top 1 million websites
This means even if you‘ve never directly interacted with most of these tracking companies, they still have detailed profiles on you. A 2019 report from Cracked Labs estimates that the average American is profiled in over 500 databases.
An arms race against tracking technology
As awareness of third-party tracking has grown, an arms race has emerged between trackers and privacy-preserving technologies. Ad blockers like uBlock Origin prevent third-party tracking scripts from loading in your browser. Apple‘s Safari browser was one of the first to start algorithmically blocking third-party cookies. Meanwhile, Mozilla Firefox blocks known fingerprinting scripts by default.
However, tracking technology keeps evolving to circumvent these defenses. Browser fingerprinting techniques capture information about your device and browser configuration to identify you without needing to save a cookie file. Information like your screen resolution, installed fonts, and even the way your browser renders images can be combined to create a unique fingerprint that persists even if you delete your cookies.
There have also been several proposals for alternative tracking mechanisms that aim to be more privacy-friendly. Google‘s Privacy Sandbox and the Unified ID 2.0 project both propose using encrypted tokens rather than cookies for ad targeting. However, critics argue these methods still allow users to be tracked on an individual level and don‘t go far enough to prevent privacy harms.
The regulatory push for cookie consent
In recent years, policymakers have started to rein in invasive tracking practices through privacy legislation. The GDPR classifies cookie identifiers as personal data and requires websites to get consent before setting tracking cookies. It also gives users the right to access the personal data that companies have collected on them, including through cookies.
Subsequent laws like the CCPA include similar consent and transparency requirements for tracking technologies. Notably, the CCPA requires websites to have a "Do Not Sell My Personal Information" link that allows users to opt out of third-party data sharing. The CCPA‘s broad definition of "sale" means disclosing cookie data to third parties for behavioral advertising is likely included.
Companies that don‘t comply with these laws can face hefty fines – up to €20 million or 4% of annual global revenue under the GDPR. France‘s data protection authority recently fined Google €150 million for deceptive cookie consent banners. The regulatory landscape is putting more pressure on companies to limit tracking or at least be much more transparent about it.
How to put privacy first in a cookie-filled world
Despite regulatory progress, the reality is tracking and profiling are still rampant online. Invasive tracking is so baked into the monetization model of the "free" web that it‘s not going away anytime soon. Given that, here are some practical steps you can take to minimize tracking and protect your privacy:
-
Be selective about accepting cookies. When a website asks you to accept cookies, choose "reject all" or "only accept necessary cookies" if given the option. Don‘t just mindlessly click "accept all."
-
Regularly clear your cookies. Periodically delete cookies and other browsing data through your browser settings. This flushes tracking identifiers and stops behavioral profiles from getting too detailed. In Chrome, go to Settings > Privacy and security > Clear browsing data. In Safari, go to Preferences > Privacy > Manage Website Data.
-
Enable your browser‘s built-in tracking protections. Most major browsers now include options to block third-party cookies and/or known tracking scripts. In Firefox, go to Preferences > Privacy & Security and choose "strict" tracking protection. In Safari, go to Preferences > Privacy and check "prevent cross-site tracking."
-
Use a reputable ad blocker. Ad blocking extensions like uBlock Origin and AdBlock Plus stop most third-party trackers from loading. Just be aware that they can break some websites and cause content like videos not to load.
-
Opt out of targeted ads and data sharing. Many advertising platforms let you opt out of behavioral targeting and third-party data sharing. Google and Facebook both have ad personalization settings you can turn off. The Digital Advertising Alliance provides a tool to opt out of targeting from over 100 ad networks.
-
Use a trustworthy VPN. A VPN encrypts your internet traffic and masks your true IP address, making it harder for trackers to link your browsing activity to your identity. However, VPNs can still see your activity themselves, so choose a provider with a strict no-logs policy – ideally one that‘s been independently audited. Some VPNs like ProtonVPN also include NetShield, a feature that blocks tracking domains at the network level.
| VPN | Blocks Trackers | No Logs | Jurisdiction | Kill Switch |
|---|---|---|---|---|
| ProtonVPN | NetShield feature blocks tracking domains | Independently audited no-logs policy | Switzerland | Yes |
| IVPN | AntiTracker feature blocks ads and trackers | No logs policy | Gibraltar | Yes |
| Mullvad | Ad and tracker blocking in browser extensions | No logs policy | Sweden | Yes |
Comparison of privacy features in three VPNs I recommend
- Support privacy-respecting browsers and business models. Consider switching to a browser like Brave that automatically blocks third-party trackers and offers a privacy-preserving ad platform. Brave lets you earn a cut of ad revenue for opting into first-party ads that don‘t track you across sites. For search, use an engine like DuckDuckGo that doesn‘t track your searches or create a behavioral profile.
Ultimately, effectively protecting your privacy requires a combination of individual controls, regulatory pressure, and alternative business models. Making conscious choices about where you browse and what data you share is a start. Advocating for stronger privacy legislation and responsible innovation in adtech will create more systemic change.
But the key is to recognize that even mundane actions like online shopping or reading the news leave digital breadcrumbs that trackers eagerly gobble up. I‘ve seen firsthand how those crumbs can be compiled into an alarmingly detailed picture of your life. Staying educated about tracking technology and taking proactive steps to control your data are essential in this constantly evolving privacy landscape. If this in-depth look at cookies made you rethink some browsing habits, I‘ve done my job.