How Third-Party Tracking Works

Now that you know how to find a cookie and examine its value, the next question is:
How does a cookie become part of a larger tracking system?
The answer begins with the connections a website makes to third-party services.
A useful way to understand this is to follow the same identifier as you move between different websites.
A cookie does not physically "follow" you from site to site like a shadow.

For this example, imagine:

• Site A — the website you are visiting
• Site D — another website
• Company X — a third-party service used by both sites

Step 1: You Visit Site A

You visit Site A.

Site A includes a script or other third-party resource provided by Company X.

That resource may cause information to be exchanged between your browser and Company X's servers. Depending on the technology being used, an identifier may be created or read.

For example:

The browser stores the associated cookie according to the cookie's attributes.

At this point, you have created the first piece of the trail:

The important thing to understand is that Site A does not necessarily need to be owned by Company X.

Company X can be present on Site A because Site A has incorporated Company X's service into its application.

Step 2: You Visit Site D

Later, you visit Site D.

Site D also incorporates a service provided by Company X.

Your browser again communicates with Company X.

If the browser can provide an identifier that Company X can associate with an existing record, Company X may be able to recognize that the request is associated with the same browser or identifier previously encountered.

The important distinction is that the recognition does not come from the cookie simply "following" you around the Internet.

The connection exists because the same third-party service is present in multiple places.

Conceptually:

Company X is the common connection.

Step 3: Activity Can Be Correlated

Now imagine that Company X is present on Site A, Site D, Site K, and Site S.

Each site may generate information about your interaction with that site.

Depending on the tracking technology and the data available to Company X, those interactions may be associated with the same identifier or other identifiers that can be linked together.

The result can look conceptually like this:

This is where individual observations can become a profile.

The profile does not necessarily exist entirely inside one cookie. A cookie may contain only an identifier or a small amount of structured information.

The larger profile can exist on the server side, where the third party combines information received from multiple interactions and sources.

This distinction is important when investigating tracking.

The cookie is evidence of a mechanism. It is not necessarily the entire mechanism.

Step 4: The Data Can Be Used

Once information has been collected and associated with identifiers, it can potentially be used for purposes such as analytics, personalization, advertising, attribution, or other forms of profiling.

What happens next depends on the company, the data collected, the relationships between the parties, and the purpose for which the information is processed.

Finding the cookie is the beginning.

The next questions are:

• Who set it?
• What identifier does it contain?
• What other requests are being made?
• Where are those requests going?
• What third-party services are present?
• What information is being transmitted?
• Can activity from different sites or sessions be associated?

Those questions move you from examining a browser artifact to examining a data flow.

That is why simply deleting a cookie does not necessarily tell you whether tracking has stopped.

The cookie may be one identifier within a much larger system.

Conversely, finding a cookie does not automatically tell you exactly what information a company has about you.

You have to follow the evidence.

The browser tells you what has been stored.

The cookie tells you something about the identifier and its structure.

The network tells you where information is going.

And the combination of those observations gives you a much clearer picture of what is happening.

Why This Matters: Connecting the Dots

Finding a cookie is interesting.

Understanding what the cookie connects to is where the investigation becomes important.

A cookie may be a small piece of data stored in your browser. An identifier may be only a short string of characters. A request may look like nothing more than a routine connection to another server.

Individually, these pieces can seem insignificant.

Together, they can become a much larger picture.

This is why learning to read cookies and follow data flows matters. The information collected at the Application Layer does not necessarily remain in the browser. It can become part of larger systems used for analytics, advertising, personalization, attribution, and—in some circumstances—profiling and decision-making.

Influencing What You See

The same kinds of signals can also influence the information presented to you.

Your previous interactions can be used to determine which content is recommended, prioritized, or shown to you.

Over time, this can create a feedback loop:

This is one way personalized information environments can develop.

The important question is not simply:

"Am I being tracked?"

It is also:

"What decisions are being made from the information being collected about me?"

That question takes us beyond cookies.

Credit and Financial Services

Financial technology companies have explored alternative sources of information when evaluating consumers.

Depending on the system and the jurisdiction, this can include information about spending behavior, device usage, online activity, or other digital signals.

Insurance

Insurance is another area where organizations evaluate risk.

Digital information can potentially become one input among many when assessing individuals or groups.

Again, the lesson here is not that a cookie sitting in your browser automatically determines your insurance premium.

It doesn't.

Employment

Digital information can also enter the world of employment and hiring.

Housing and Other Decisions

The same principle extends beyond advertising.

The Promise and the Reality

There is usually a promise attached to data collection.

Those benefits can be real.

The problem begins when the person generating the data has little visibility into what happens after collection.

The Human Impact of the Application Layer

It is easy to think of the Application Layer as a technical abstraction.

But every one of those technical mechanisms ultimately exists within a system used by people.

The Application Layer is where information begins to acquire context.

A browser request can identify a resource.

A cookie can identify a browser or session.

An identifier can allow activity to be associated over time.

A collection of interactions can become behavioral information.

And behavioral information can become an input into systems that affect what people see, what they are offered, or how they are evaluated.

That is why the Application Layer matters.

It is not simply the layer where a webpage loads.

It is one of the places where the relationship between technology, data, organizations, and people becomes visible.

The Architecture of the Modern Web

The modern web is built from thousands of interconnected services.

A website may communicate with its own servers while simultaneously communicating with analytics providers, advertising networks, content delivery networks, payment processors, embedded services, and other third parties.

To the person visiting the page, this may look like one website.

From a network perspective, it can be many relationships happening at once.

That is why this field guide keeps returning to the same principle:

Then ask what information is being exchanged.

Each step gives you another piece of the picture.

You do not have to understand the entire architecture at once.

You only need to learn how to follow one connection at a time.