Bounce tracking, also called redirect tracking, is a cross-site tracking technique in which a navigation from one website to another is routed briefly through a tracker’s domain, so that the tracker becomes the top-level site for a fraction of a second and can read or write its own first-party cookies before forwarding the user to the real destination.
In privacy and web tracking, bounce tracking matters because it was a direct response to third-party cookie blocking. When browsers stopped letting trackers read cookies inside embedded frames, trackers moved their identifiers into first-party storage reached through redirects, which ordinary cookie blocking does not cover.
How bounce tracking works
Bounce tracking exploits the fact that browsers treat any site the user navigates to as a first party, even if the visit lasts only milliseconds. The user believes the link leads from site A to site B, but the browser actually visits tracker T in between.
- The user clicks a link on site A whose target is a URL on the tracker’s domain, often with the final destination encoded as a parameter.
- The browser loads the tracker URL as a top-level navigation, so the tracker’s cookies count as first-party cookies.
- The tracker reads its existing identifier or sets a new one and records the source site and the destination.
- The tracker answers with an HTTP 302 or 307 redirect, a meta refresh or a JavaScript redirect to site B.
- Site B loads normally, often with the identifier appended to the URL as link decoration.
Because the same tracker domain sits in the middle of navigations from many unrelated sites, its first-party cookie works as a cross-site identifier. The redirect is usually invisible: the address bar flickers and the user rarely notices the extra hop.
Variants and related techniques
Bounce tracking appears in several forms that differ in how the redirect is triggered and in whether the user ever interacts with the intermediate site. The distinction matters because browser defenses rely on user interaction signals.
| Variant | Trigger | Typical setting |
|---|---|---|
| Server-side bounce | HTTP 3xx response from the tracker | Ad click URLs and affiliate links |
| Client-side bounce | JavaScript or meta refresh on the tracker page | Email links and campaign landing pages |
| Stateful bounce | Tracker sets or reads storage during the hop | Cross-site identification |
| Stateless bounce | Identifier passed only in the URL | Link decoration without storage |
| Chained bounces | Several tracker domains in sequence | Ad exchanges and affiliate networks |
Bounce tracking is closely related to link decoration, which passes identifiers in URL parameters, and to CNAME cloaking, which disguises a tracker as a subdomain of the first party. All three techniques aim at the same goal: recovering cross-site identity after third-party cookies lose their power.
How browsers detect and mitigate it
Browser defenses against bounce tracking focus on sites that store data but never receive genuine user interaction. A real website that a person uses has clicks, logins or scrolling; a bounce tracker has only redirects. Browsers therefore delete the storage of such sites periodically or skip the redirect altogether.
| Browser protection | Approach | Key behavior |
|---|---|---|
| Intelligent Tracking Prevention in Safari | Classifies bounce trackers on the device | Purges storage of classified domains without recent user interaction |
| Enhanced Tracking Protection in Firefox | Redirect tracking protection with a tracker list | Clears tracker storage about every 24 hours unless the user interacted within 45 days |
| Bounce tracking mitigations in Chrome | Heuristic detection of bounces | Deletes state of bouncing sites without interaction in about 45 days, when third-party cookies are blocked |
| Debouncing in Brave | Known redirect patterns | Navigates directly to the destination and skips the tracker |
Exact thresholds change between browser versions, but the design principle is stable: interaction exempts a site, and absence of interaction marks it as a likely tracker. Debouncing is the strongest approach because the tracker is never contacted at all, while storage deletion only limits how long an identifier survives.
Bounce tracking compared with other cross-site methods
Each cross-site tracking method leaves a different footprint and requires a different defense. Comparing them shows why bounce tracking needed dedicated countermeasures.
| Technique | Where the identifier lives | Blocked by third-party cookie blocking | Main defense |
|---|---|---|---|
| Third-party cookies | Cookie in an embedded context | Yes | Cookie blocking or partitioning |
| Bounce tracking | First-party cookie of the tracker | No | Storage purging or debouncing |
| Link decoration | URL query parameters | No | Parameter stripping |
| Device fingerprinting | Derived from device attributes | No | Reducing entropy and randomization |
| CNAME cloaking | First-party subdomain cookie | No | DNS-aware blocking and cookie limits |
The comparison also explains why legal frameworks do not depend on the technique. Under the ePrivacy Directive and the GDPR, setting an identifier during a bounce is still storage on the terminal equipment and requires consent when it serves tracking, regardless of whether the cookie is technically first-party.
Implications for site owners and legitimate redirects
Not every redirect is tracking. Single sign-on, payment flows and link shorteners also send users through intermediate domains, and aggressive mitigations can break them. Browser vendors therefore spare sites with real user interaction, such as an identity provider where the user typed a password.
- Federated login providers keep working because users interact with the login page regularly.
- Affiliate and ad click redirects lose stored identifiers, so attribution shifts toward parameters and server-side measurement.
- Marketing teams should avoid redirect chains that add little value and slow page loads by tens to hundreds of milliseconds each.
- Consent must still be obtained before a redirect service stores tracking identifiers.
A common misconception is that a redirect is harmless because the user never sees the intermediate page. For privacy purposes the opposite is true: invisibility is what makes the technique effective, and it is exactly why browsers treat silent, non-interactive storage as a tracking signal.
In simple terms
Imagine taking a taxi from a shop to a café, and the driver always makes a quick stop at the same office where someone writes down your name and where you came from. You never get out of the car, so you hardly notice the stop.
Bounce tracking does the same thing with web links. Your browser makes a lightning-fast detour through a tracking company’s website, and the company recognizes you on every detour. Modern browsers fight back by erasing the data of sites you never actually use or by skipping the detour.
A practical example
A reader clicks a product recommendation in a news article. The link points to an affiliate network domain, which receives the request, reads a cookie it set months earlier during a click on a recipe blog and then redirects to an online store in about 80 milliseconds. The network now knows that the same browser visited both publishers.
In a browser with redirect tracking protection, the affiliate domain has no record of the user ever interacting with it directly. Its cookies are cleared within a day, so each new click looks like a fresh, unlinked visitor. The store still receives the click parameter and can count the sale, but the cross-site profile can no longer be built.