What Trackers Actually Know About You

Most people think tracking means “ads follow me around.” That’s the visible tip. Underneath, the data collection is deeper and stranger than you’d expect.

Here is what trackers on a typical news site know about you after a single visit. Not accumulated over time. One page load.

Your device fingerprint

Your browser sends a surprising amount of identifying information with every page load: screen resolution, installed fonts, timezone, language settings, browser version, operating system, and hardware specs. Combined, these create a fingerprint that uniquely identifies your device with 90%+ accuracy, and none of it requires cookies.

Canvas fingerprinting goes further. A hidden canvas element draws a specific image, and the way your GPU renders that image is slightly different from every other device. The site reads the pixel data, hashes it, and now it has a hardware identifier that survives clearing cookies, using incognito mode, or switching browsers.

WebGL fingerprinting does the same thing with 3D rendering, AudioContext fingerprinting does it with audio processing, and font enumeration probes which fonts are installed. You can’t see any of this happening because there’s no permission prompt and no consent banner that covers it.

Your browsing context

Third-party trackers embedded on the site already know which other sites you’ve visited today, as long as those sites embed the same tracker. The largest ad network appears on roughly 73% of the top million websites, which means a single company can construct a timeline of nearly every site you visit.

Social media tracking pixels operate similarly. Even if you don’t have an account on the platform, the pixel creates a shadow profile linked to your device fingerprint. That profile accumulates data over months and years, building a detailed picture of a person who, as far as the platform is concerned, doesn’t exist yet.

Your behavior on the page

Session replay scripts record your mouse movements, clicks, scrolls, and keystrokes in real time. Some companies sell this as “user experience analytics,” but in practice it means someone can watch a recording of exactly how you used the page, including text you typed into form fields and then deleted before submitting.

Beyond replays, scroll depth tracking tells them how far you read, attention time tracking measures how long you spent on each section, and click heatmaps show where your eyes probably went.

Tracker A knows your browsing history. Tracker B knows your email address. They sync cookies, and now your real identity is attached to your full browsing history. This happens constantly, silently, across thousands of domains. The result is a profile that’s far more complete than any single tracker could build alone.

What you can do

You can’t stop all of it, but you can see it and reduce it significantly.

Block trackers at the network level. EasyList and EasyPrivacy block 30,000+ known tracker domains, which stops the majority of cross-site tracking before it starts.

Auto-reject every cookie consent banner. Those banners aren’t asking if you want to be tracked. They’re asking if you want to be tracked in the ways that require consent, because the tracking that doesn’t require consent happens regardless. Reject everything and reduce the surface area.

Use a privacy-scoring tool. When you see your favorite news site score an F, it hits differently than reading about tracking in the abstract. Visibility changes behavior.

Request your data. Under GDPR, CCPA, and PIPEDA, you have the right to request all data a company holds about you and to request its deletion. Send the request, because you’ll be surprised what comes back.

The real problem

Tracking isn’t really about ads. It’s about asymmetry. Companies know more about your behavior than you do, and they use that knowledge to shape what you see, what you pay, and what you believe.