Understanding how websites track you starts with one idea: a site recognises you by attaching an identifier to your browser, your account or your device, then recording what you do under that label. Cookies are the best-known method, but tracking also relies on tiny embedded requests, login details, link tags and device signals. You cannot remove all of it, though a few settings reduce most of it.
How websites track you: a label and a log
Almost every tracking technique does the same two jobs. First it gives you a label, such as a random string of characters stored in your browser. Second it logs activity against that label: pages viewed, searches, items added to a basket, time spent on a page. The label rarely contains your name. It does not need to, because a long history under one label is often revealing enough, and it can be linked to a real identity the moment you log in or fill in a form.
Not all tracking is sinister. A shop needs to remember your basket, and a site owner wants to know which articles are read. The privacy problem begins when the label follows you from one site to another, because then a company you never visited directly can assemble a picture of your habits.
The main ways it happens
Cookies and similar storage
A cookie is a small piece of text a site asks your browser to keep. First-party cookies are set by the site you are visiting and usually handle logins and preferences. Third-party cookies are set by other domains whose content is embedded in the page, and they are the classic cross-site tracking tool. Browsers can also store identifiers in other places, such as local storage, so deleting cookies alone does not always clear everything. We cover the details in our explainer on cookies and trackers.
Tracking pixels and scripts
Many pages load a tiny invisible image or a script from an analytics or advertising company. When your browser fetches it, that company learns that your browser, with its label, visited that page. The same trick works in email: a hidden image in a newsletter can tell the sender that you opened the message and roughly when.
Logins and account data
When you sign in, a service can tie everything to a named account. If you stay signed in to a large platform while browsing, any page that embeds that platform’s buttons or code may report the visit back to it. Using one email address everywhere also helps different companies match their records about you.
Link and URL tags
Some links carry extra parameters added to the address, designed to show which campaign or message sent you there. These help the sender measure results, but they can also act as an identifier that travels with you from one page to the next.
Device and network signals
Even without stored labels, a site sees your IP address, browser type, language and screen details. Combined, these can help recognise a returning visitor. This approach is covered in our guide to browser fingerprinting.
Why it matters in practice
The data feeds advertising, price and content personalisation, and in some cases it is bundled and resold. Rules differ by country, and the consent banners you click through are one result of them. Whatever the law says where you live, collected data can be leaked, sold or combined later in ways you did not expect, so collecting less in the first place is the safest position.
It is also worth being realistic. Blocking everything can break checkouts, videos and logins. The aim is to cut the unnecessary cross-site tracking while leaving the useful features alone.
What actually reduces tracking
The following steps give the most benefit for the least effort. They are listed roughly in order of impact.
- Use a browser with tracking protection turned on. Several mainstream browsers block known trackers and third-party cookies by default or in a strict mode. Check the privacy settings of the one you use.
- Add a reputable content blocker. An extension that blocks known tracking scripts stops many requests before they leave your device. Install only from your browser’s official extension store and keep the number of extensions small.
- Separate your accounts from your browsing. Sign out of large platforms when you are not using them, or use a separate browser profile for them.
- Review site permissions. Location, notifications and similar permissions should be granted only when a feature genuinely needs them.
- Clear data periodically. Removing cookies and site data now and then resets many labels, although you will be signed out of sites.
- Be careful with email images. Turning off automatic image loading prevents many open-tracking pixels.
What a VPN does and does not do here
A VPN hides your real IP address from the sites you visit and encrypts traffic between your device and the VPN server, which helps on untrusted networks and removes one tracking signal. It does not remove cookies, stop scripts, or log you out of accounts. If you stay signed in to a service, that service still knows who you are. Treat a VPN as one layer, as we explain in our piece on VPNs and anonymity.
Check what you are agreeing to
Cookie banners often offer a quick “accept all” button and a harder path to refuse. Taking the extra few seconds to choose only essential cookies is a real, if small, privacy gain. Browser-level protection is more consistent, because it works even when a banner is confusing or missing.
Where to start
Pick one browser, switch on its strongest tracking protection that still lets your regular sites work, and sign out of platforms you do not need. Once that feels normal, work through the rest of the list above. For the wider picture, browse everything in our Online Privacy section.
Frequently asked questions
Can a website track me without cookies?
Yes. Sites can use your IP address, browser and device details, logins and URL parameters to recognise a returning visitor. Blocking cookies helps, but it does not stop every method.
Does clearing my cookies stop tracking?
It resets many identifiers, so trackers have to start building a profile again. Because you will be signed out and the same techniques resume, it is a short-term reset rather than a permanent fix.
Is tracking always bad?
No. Remembering a basket, a language choice or a login is useful. The concern is cross-site tracking and data collected beyond what a service needs.
Will a VPN stop websites tracking me?
A VPN hides your IP address and encrypts your traffic, but it does not block cookies, scripts or account-based tracking. It works best alongside browser protections.
