Web tracking is the practice of recognizing a browser or user over time and recording what they do on websites, so that page views, clicks, purchases and other events can be linked into a behavioral record. It ranges from first-party analytics on a single site to cross-site tracking that follows a person across thousands of unrelated websites.
In privacy, tracking is a central concern because the resulting profiles reveal interests, habits, location and sometimes sensitive traits. Under European law, most tracking requires prior consent for accessing the device, and the resulting data is personal data subject to the GDPR.
How web tracking works
Every tracking system has two parts: an identifier that recognizes the same browser or person again, and a collection mechanism that reports events to a server. The identifier makes separate visits linkable; the collection mechanism determines what is observed.
Collection usually happens through JavaScript tags or a tracking pixel, a tiny image request whose URL carries event parameters. The request also delivers the referring page, IP address, user agent and any cookies for the tracker’s domain, so even a single invisible image can reveal which page a person is reading.
| Component | Role | Examples |
|---|---|---|
| Identifier | Recognizes the browser or user | Cookie ID, advertising ID, login, fingerprint |
| Collector | Sends events to a server | JavaScript tag, pixel, SDK, server API |
| Event data | Describes the activity | URL, clicks, scroll depth, purchase value |
| Identity graph | Joins identifiers across devices | Hashed email matching, probabilistic links |
| Profile store | Accumulates history and segments | Data management or customer data platforms |
Identification techniques used for tracking
Tracking techniques differ in persistence, visibility and controllability. Stateful methods store an identifier on the device and can be cleared by the user; stateless methods compute one from device characteristics and are far harder to detect or reset.
| Technique | Stored on device | User can reset | Cross-site reach |
|---|---|---|---|
| First-party cookie | Yes | Yes, by clearing cookies | Limited to one site |
| Third-party cookie | Yes | Yes; often blocked by browsers | High where still allowed |
| Device fingerprinting | No | Very difficult | High and covert |
| Advertising ID | Yes, mobile OS | Yes, or opt out entirely | Across apps on the device |
| Login-based ID | Server side | Only by not logging in | Across devices and partners |
Device fingerprinting combines attributes such as screen size, fonts, time zone, graphics rendering and audio processing into a value that is often unique among millions of browsers. Regulators treat it as access to information on the device, so it requires the same consent as cookies.
First-party analytics compared with cross-site tracking
Not all tracking carries the same risk. The decisive variables are who receives the data, whether it is combined across contexts, and whether it is used to target or decide about the individual.
| Scenario | Data recipient | Privacy impact | Usual legal treatment in the EU |
|---|---|---|---|
| Aggregate site analytics | Site owner or bound processor | Low | Consent, or exemption in some member states |
| Product analytics with user IDs | Site owner | Moderate | Consent for device access |
| Retargeting | Ad platforms | High | Consent required |
| Cross-site profiling for ads | Many intermediaries | Very high | Consent and strict transparency |
The shift away from third-party cookies has moved tracking toward server-side collection and login-based identity. These approaches change the technology but not the legal assessment: data sent from a server to an ad platform about an identifiable visitor is still personal data that needs a legal basis.
Controlling and limiting web tracking
Responsible tracking starts with an inventory of every tag and SDK, followed by consent gating in a consent management platform and data minimization at the collector.
Purpose definition comes first. A site that only needs to know which pages perform well does not need persistent user IDs, cross-device matching or third-party recipients, and each component it leaves out removes a category of risk rather than merely reducing it.
| Control | What it does | Limitation |
|---|---|---|
| Consent gating | Blocks tags until opt-in | Only as good as the tag inventory |
| IP truncation | Removes the last octet before storage | Other identifiers may remain |
| Short retention | Deletes raw events after a set period | Aggregates must be kept separately |
| Server-side filtering | Strips fields before forwarding to vendors | Requires careful governance |
| Browser protections | Block third-party cookies and known trackers | Outside the site owner’s control |
Common mistakes in web tracking
- Tags firing before consent because they are hard-coded outside the tag manager.
- Personal data leaking in URLs, such as email addresses in query strings captured by pixels.
- Pixels on sensitive pages, such as health or account pages, that disclose sensitive interests to third parties.
- Assuming hashing anonymizes email addresses used for matching; hashed values remain identifiers.
- Forgotten SDKs in mobile apps that collect advertising IDs regardless of the web consent banner.
Most enforcement actions involving tracking result not from deliberate profiling but from unmanaged third-party code, which is why periodic tag audits are a core privacy engineering task.
Put simply
Web tracking is keeping a diary of what you do online. A website, or a company whose code sits on many websites, notes which pages you open, what you click and what you buy, and gives your browser a label so it can add to the same diary next time.
Some diaries stay with one shop and help it fix a confusing checkout. Others are shared among advertisers and follow you from site to site. That is why the law asks websites to get your permission first for most tracking.
In practice
A regional health clinic installs an advertising platform’s pixel on its website to measure appointment bookings. A later review shows the pixel also fires on pages about specific conditions and sends the page URL, IP address and a cookie ID to the ad platform.
The combination reveals that an identifiable visitor read about a particular condition, which is sensitive health information. The clinic removes the pixel from all condition and booking pages, switches to aggregate first-party analytics with IP truncation and a 14-month retention period, and gates any remaining marketing tags behind explicit consent.
The clinic keeps the ability to count bookings per campaign while no longer disclosing patient interests to a third party.