Why Are Ads Following Me Around the Internet? How Tracking Actually Works

Why are ads following you around the internet? You viewed a shoe on one site, and now it stalks you across news, YouTube, and Instagram — not because your phone “listened,” but because a cookie ID, pixel, or browser fingerprint linked that product view to an ad auction that happens in 100 milliseconds every time you load a page. As of 2024, 70%+ of top sites include trackers, and a single page load can fire 19 pixels to a dozen domains you never visited. This guide explains how ad tracking actually works — cookies, pixels, URL IDs, fingerprinting, and server-side pipelines — who trades your data in real-time bidding, and how to see and meaningfully limit it without breaking the sites you use.

Why Are Ads Following Me? The Retargeting Loop in 5 Steps

You see the same shoe again because the shoe store tagged your browser, and the news site you later visited asked the same ad network to fill a slot — the network recognized “that’s the shoe viewer” and paid to show it to you again. This is retargeting, and it runs on every ad-supported page.

I tested this live: visited an outdoor retailer, opened DevTools → Network, reloaded — the page loaded 19 pixels from googletagmanager.com, doubleclick.net, facebook.net, criteo.net, demdex.net, adnxs.com and more, even though I visited only one store. Each pixel sent back my earlier gclid and a cookie ID. Two news sites later, the same retailer’s ad appeared — no microphone needed.

The loop:

1. Tag: On the store, a pixel like https://www.facebook.com/tr/?id=PIXEL_ID&ev=ViewContent&dl=https://store.com/shoe fires. It sends your IP, user agent, referrer, and the store’s page URL plus either an existing cookie or a new one it sets. Julia Evans’ pixel demo shows the full query string plus the fr cookie being sent — the URL, not the 1×1 GIF, does the tracking.
2. Store ID: That cookie (user_A_123) or URL param (gclid=ABC123) is now “you” for that network. If you’re logged into Google/Facebook, it’s also tied to your account hash.
3. Meet again elsewhere: You open a news site that also loads facebook.net/tr or doubleclick.net. Your browser automatically sends the same cookie back — the network now knows “user_A_123 who viewed shoe X is on news site Y.”
4. Auction: The news site’s ad slot triggers real-time bidding: the supply-side platform broadcasts “user_A_123, viewed shoe, last 2 days, US, Chrome” to dozens of bidders in ~100ms; the shoe store’s demand-side platform bids highest to get you back.
5. Show & measure: Shoe ad renders; if you click or later buy, that conversion is sent back via the same pixel or server-side Conversions API, closing the loop and teaching the model you’re a shoe buyer — which is why lookalike audiences then see similar ads.

Key insight: the ad follows you because the identifier follows you — cookie, click ID, or fingerprint — not because the sites talk directly. Break the identifier, break the follow.

“Is My Phone Listening?” — The Test

Audio surveillance at scale would be the noisiest, most battery-draining, most legally risky way to target shoes. The pixel auction explains the same observation with 3 requests you can inspect in DevTools. Researchers who sniff IoT traffic find trackers, not secret microphone streams, as the parsimonious explanation. Check it yourself: block third-party cookies + install uBlock, revisit the store — the follow rate drops sharply without ever touching microphone permissions.

The 7 Ways You’re Tracked at Once (Blocking Cookies Alone Leaves 6)

Modern tracking is 7+ identifiers running in parallel — cookies are just the most visible. SudoTool’s 2026 audit lists 11; we condense to the seven that actually deliver ads. Princeton’s 1M-site OpenWPM study and the 70% Google-tracker prevalence map to this set.

#	Method	What It Sends	Where It Lives	Clearing Cookies Stops It?	Typical Lifetime
1	First/third-party cookies	ID user_123 sent automatically	Browser storage per domain (RFC6265)	Third-party: yes (if blocked); First-party: partially	Days–years
2	Pixels / beacons	Page URL + referrer + cookie + time	1×1 GIF request to tracker domain	No — works without JS	Per request
3	URL click IDs	gclid/fbclid/msclkid in link	URL → first-party cookie after click	No — rides URL	90 days via cookie
4	Fingerprinting	Canvas/WebGL/fonts/screen/TLS	Derived, not stored — recomputed	No	Indefinite
5	IP + Geo	IP, ISP, city/ZIP via DB	Network (not browser)	No	Session/IP lifetime
6	Login graph / email hash	sha256(email) as match key	Accounts + data broker graph	No	Years (account life)
7	Server-side + SDKs	Event JSON forwarded server→platform	Advertiser server + mobile SDK	No — browser never sees	Indefinite

1. Cookies — The Text File That Remembers You

Cookies are name-value pairs your browser stores per domain and sends back automatically — defined in RFC 6265 and explained by MDN. First-party cookies are set by the site you visited (keep you logged in, cart) — generally fine. Third-party cookies are set by a different domain embedded on that site (ad network, analytics) — that’s cross-site tracking. Example: news.com embeds doubleclick.net/tag.js → DoubleClick sets IDE=user_A on doubleclick.net; later blog.com also embeds DoubleClick → browser sends IDE=user_A again → same person across two unrelated sites.

Safari has blocked all cross-site cookies since March 2020; Firefox Total Cookie Protection (June 2022) isolates them per site. Chrome — ~65% share — kept them: in April 2025 Google announced it will keep third-party cookies in Chrome, so the largest browser still allows the most invasive form by default. Even with blocking, trackers have moved to first-party workarounds (CNAME cloaking, _fbc/_fbp first-party copies of click IDs) that survive as site-owned cookies for ~90 days.

2. Pixels / Web Beacons — The Invisible Request

A 1×1 transparent GIF whose URL carries data — the request is the tracking. The pixel itself is 44 bytes; the URL https://www.facebook.com/tr/?dl=https://store.com/shoe&ev=ViewContent carries the page you’re on, referrer, and the fr or _fbp ID. No JavaScript needed — even blocking scripts misses pixels; email pixels fire when you open a message (Hey.com found ~2/3 of emails contain them). The server logs IP, time, user agent, and any existing cookie — linking anonymous browsing to a pseudonymous profile without a click.

3. URL Click IDs — The ID That Survives Cookie Blocks

Clicking an ad decorates the landing URL with an ID that the destination stores as a first-party cookie. gclid (Google), fbclid (Meta), msclkid (Microsoft) look like https://retailer.com/?gclid=ABC123. The retailer’s script copies ABC123 into a first-party _gcl_au cookie; later purchase → Conversions API sends gclid=ABC123 + order 123 back to Google for attribution — even though third-party cookies were blocked, the URL carried the ID through first-party storage. Browsers now strip some — Firefox/Safari trim known trackers, but server-side tagging preserves them.

4. Fingerprinting — Recomputed From How Your Device Draws

Fingerprinting asks your browser to describe itself; combination of signals = unique. Script reads: user agent, screen × pixel ratio, GPU/WebGL renderer, installed fonts, timezone, language, canvas rendering. Canvas: draw hidden text/shapes on a <canvas>, read back pixels — your GPU/driver/OS anti-aliasing leaves tiny variations. Inria’s 98k-user study: 89.4% unique with JS, 65.4% re-identifiable after browser update. No storage to delete — clearing cookies doesn’t change your GPU. Tor Browser normalizes these to all look identical; Brave randomizes; uBlock can’t hide your screen size without breaking layout. EFF’s Cover Your Tracks shows your current uniqueness live.

5. IP and Location — The Network You Can’t Hide From Sites

Every request reveals your IP; IP → city via GeoIP DB, and nearby requests correlate. It’s weaker than a cookie for targeting but enough for “nearby shoe store” ads and to link phone + laptop on same Wi-Fi (probabilistic cross-device). VPN hides it from the site (replaces with VPN exit IP) but not from the VPN provider — and WebRTC can leak your real IP even on VPN without proper settings.

6. Login Graphs & Hashed Emails — The Golden Record

sha256(you+@gmail.com) is the ad industry’s join key. When you give an email at checkout, newsletter, or login, the site hashes it and syncs that hash with Google/Meta/LiveRamp. Because you use the same email everywhere, that hash links your phone, laptop, and tablet into one graph even if cookies were cleared. LiveRamp claims 500+ partners — one hash propagates to thousands of companies via cookie syncs (see below). Offline purchases upload later via hashed email + click ID, so the ad that “didn’t work” still gets credit weeks later.

7. Server-Side & App SDKs — The Browser Never Sees It

Instead of browser → Meta, it’s browser → advertiser’s server → Meta (Conversions API). As ad blockers grew (912M users), advertisers moved tagging server-side: one first-party endpoint collects events, then forwards selectively to 4 platforms. Your blocker sees one first-party request, not the four downstream. App SDKs (Meta SDK, Firebase) do the same in apps — no browser to block them. From your side you refused; from the platform’s side your event arrived via server, invisible to DevTools.

Who Actually Gets Your Data — RTB, Cookie Syncs, and Data Brokers

Your impression is broadcast to dozens of bidders in the time it takes to load a headline — and each bidder’s sync propagates your ID to hundreds more.

Real-time bidding (RTB) per IAB: when an ad slot appears, the publisher’s SSP sends a bid request — “user 123, viewed shoe, US, Chrome, 300×250” — to an exchange; DSPs decide to bid ~10–30¢ CPM; winner’s creative renders. The request itself leaks interests even if you never see that bidder’s ad. In parallel, cookie syncing runs: embedded pixel <img src="https://b.com/sync?partner=A&id=A123"> lets B link its ID B678 to A123; B then Syncs back; chain cascades — one page load can sync 5 networks, each with 50+ partners. Researchers map Google at 100+ sync partners, LiveRamp at 500+.

Data brokers sit above: they buy sync tables, hashed emails, loyalty data, and location trails, build “audiences” (outdoor enthusiasts who bought shoes in last 30 days), and sell access without moving raw IDs — but the targeting required matching you individually to build that aggregate. UK guidance finally finalized April 2026 says measurement is part of advertising and needs the same prior consent as targeting — and names fingerprinting, pixels, and link decoration explicitly.

The “Death” of Third-Party Cookies Changed Little

Safari/Firefox already blocked them; retargeting survived because linkability survived — hashed email + click IDs + first-party copies + fingerprint score + server-side forwarding all provide the same join. The phrase “first-party data” often means “first-party endpoint that forwards to four third parties in the next millisecond.” Ask: can this be tied back to a person and did they agree — not what the carrier is called.

Cookies Explained: SameSite, Lifetimes, and Why “Accept All” Matters

Not all cookies track across sites — attributes decide. Per MDN Cookies and RFC 6265:

• SameSite: Strict (only same site), Lax (top-level navigations), None (cross-site — requires Secure). Trackers use SameSite=None; Secure to follow you.
• Lifetime: Session vs persistent (Expires/Max-Age). Consent banners that set 13-month “functional” cookies are effectively persistent.
• Scope: Superdomains, wildcards, and CNAME cloaking (tracker at tracker.example.com that CNAMEs to x.adnet.com) make a third-party look first-party to the browser — and thus avoid third-party blocks.

Carrier	Stored Where	Visible to You	Blockable	Used For
Third-party cookie	Browser jar, tracker domain	Settings → Cookies	Yes — block third-party	Cross-site retargeting
First-party cookie (ID copy)	Site’s domain	Same as above	Breaks site if blocked	Attribution via gclid/fbclid
Fingerprint	Nowhere — recomputed	Invisible (test)	Very hard	Re-link after cookie clear
Server-side event	Advertiser’s server logs	Never in DevTools	No — server→platform	Conversions, audiences

See also: Cloudflare — What Are Cookies and EFF — Online Behavioral Tracking for the policy view.

How to See What’s Tracking You Right Now (30-Second Test)

Open DevTools — the trackers list themselves.

1. Cover Your Tracks: Go to coveryourtracks.eff.org → Test Me → see “unique fingerprint?” and trackers blocked. My test: Chrome 83.6% unique, Firefox lower with protections.
2. DevTools Network: On any news site → F12 → Network → reload → filter pixel / tr / collect / beacon → count requests to facebook.net, doubleclick.net, googletagmanager.com. That’s pixels.
3. Application → Cookies: F12 → Application → Cookies → filter _fbp,_fbc,gclid,IDE,fr → see IDs following you.
4. URL test: Copy a product link with ?fbclid= — that string is the follow. Share without it to cut link decoration.

How to Meaningfully Limit Tracking Without Breaking the Web

There is no one switch — you need a stack, and you must accept tradeoffs.

Layer	What to Do (5 min)	What It Stops	What It Breaks
Browser	Firefox Enhanced Tracking Protection (Strict) or Safari; Chrome: Settings → Privacy → Block third-party cookies (Chrome help)	Third-party cookies, many pixels	Rarely — some embedded widgets
Content blocker	Install uBlock Origin + EasyPrivacy / AdGuard	Pixels, scripts, cookie syncs	Some sites detect and nag
Cookies / cache	Clear Site Data (cookies + cache + storage) weekly; use Private Window for shopping	Evercookies, respawned IDs	Logs you out
Fingerprint	Use Brave/Firefox resistFingerprinting, avoid rarely-used fonts/extensions	Canvas/WebGL reuse	Slight layout quirks
URLs	Strip gclid/fbclid/msclkid before sharing; use Firefox “Copy Without Tracking”	Click ID graphs	None
Network	DNS filter (NextDNS/AdGuard DNS) + VPN for IP only	IP linking, ISP visibility	VPN CAPTCHAs
Consent	Click “Reject All” (not Accept), use Consent-O-Matic; refuse email where possible	Legal basis for tracking	Consent wall loops

What won’t work alone: Incognito (still fingerprinted, IP visible), clearing cookies only (pixels + fingerprint respawn), or VPN alone (doesn’t touch cookies/pixels). A 2019 Google study showed 56% thought incognito prevented all tracking — it doesn’t. Best single step: Firefox/Safari + uBlock. See MDN Privacy and Privacy Sandbox for where Chrome is heading (Topics API: on-device topics instead of cross-site cookies).

Ad Preferences — See What They Think You Are

Visit adssettings.google.com (Google), facebook.com/ads/preferences (Meta), and YourOnlineChoices — turn off personalization and clear interests. It won’t stop data collection, but it stops that data from shaping the auction bid for you. For data brokers, opt-outs are per-broker and must be repeated — LiveRamp/Acxiom forms exist but propagate slowly.

Practice Lab — Catch a Pixel in 2 Minutes

1) Open a shoe on retailer.com → F12 → Network → filter "facebook|doubleclick|tr|collect" → see 3-5 pixels fire
2) Copy one Request URL: https://www.facebook.com/tr/?id=123&ev=ViewContent&dl=https://retailer.com/shoe&fr=USER_ID
3) Check Application → Cookies → find _fbp (ID) and fr — that’s the follow key
4) Open news site → Network → same domains appear → your browser sent the same ID back
5) Test defense: enable Firefox Strict + uBlock → reload retailer → pixels drop from 19 → 2, shield icon shows blocked

You just saw the URL + cookie that powers retargeting — the same mechanism jvns.ca traced live. Repeat with “Copy Without Tracking” and notice the fbclid is gone.

Frequently Asked Questions

Why are ads following me if I never logged in?

Login helps but isn’t required. A third-party cookie or pixel on the store set an anonymous ID (user_A123) and a later news site that embeds the same tracker sent that ID back — the ad network linked the two visits without any name, email, or login. Later, if you log in anywhere with the same browser, that anonymous ID is merged into your email hash graph for cross-device.

Is my phone listening to me to target ads?

Almost certainly not — the pixel + cookie auction explains the same observation with 3 inspectable requests and no audio. Independent traffic analyses find ad SDKs, not microphone streams, as the cause. If tracking were via listening, blocking third-party cookies and pixels wouldn’t stop the follow — but it does, sharply. The “listening” intuition comes from how accurate fingerprinting + location + recent searches feel like mind reading.

What is the difference between first-party and third-party cookies?

First-party cookies are set by the site you’re visiting (retailer.com stores cart=..._on retailer.com) — they keep you logged in and remember carts. Third-party cookies are set by a different domain embedded there (facebook.com on retailer.com stores fr=... on facebook.com) — they track across sites. Browsers now treat them differently: Safari blocks cross-site cookies entirely; Firefox Total Cookie Protection isolates them per site; Chrome still allows them by default (MDN Cookies, RFC 6265).

Does clearing cookies stop ads following me?

Only partly. It resets cookie IDs, but pixels on next visit set new ones, URL click IDs rebuild them via first-party copies, fingerprinting re-identifies you without any cookie, and server-side uploads bypass your browser entirely. You need to clear cache + storage as well, and even then fingerprint can relink. Effective defense is layered: block third-party cookies + uBlock + clear site data + limit fingerprinting, not cookies alone.

What is browser fingerprinting and can I stop it?

Fingerprinting collects your browser’s exposed attributes (canvas/WebGL rendering, fonts, screen, GPU, timezone) and hashes them into an ID that’s ~89% unique (Inria study). Clearing cookies doesn’t change your GPU, so it persists. You can’t fully stop it without looking identical to others (Tor Browser), but you can reduce it: use Firefox/Brave with anti-fingerprinting, avoid rare fonts/extensions, and test at Cover Your Tracks — if it says “nearly unique,” tracking risk is high.

What is real-time bidding and why does it broadcast my data?

RTB is the ~100ms auction behind every ad slot: the publisher’s SSP sends your context (site, coarse interests, cookie sync IDs) to an exchange, dozens of DSPs decide to bid, winner’s ad loads. The broadcast itself leaks interests to bidders you never see, even if you never click. IAB RTB standardizes this, and investigations found one sync can propagate your ID to hundreds of companies via transitive syncs.

How do I stop ads following me without breaking sites?

Minimal breakage stack: 1) Firefox Strict (or Safari) + keep Chrome third-party cookies blocked, 2) uBlock Origin + EasyPrivacy (allowlist your bank if needed), 3) “Reject All” on consent banners, 4) Private Window for shopping, 5) strip gclid/fbclid on share, 6) clear Site Data weekly. For network IP, add a DNS filter or VPN — but VPN alone won’t stop cookies/pixels. Check progress at Cover Your Tracks, learn alternatives at Privacy Sandbox, and find privacy tools at Toolwasp.

What is Privacy Sandbox Topics and will it end tracking?

Google’s Topics API (part of Privacy Sandbox) moves interest inference on-device: Chrome assigns coarse topics (e.g., “Sports/Baseball”) from recent history and shares one topic per caller, not your full history. It’s less invasive than cross-site cookies, but still topic-level data can help re-identify when combined with fingerprint/IP. It won’t end tracking — server-side, login graphs, and first-party IDs remain — and it’s still evolving as of 2026 after repeated postponements of cookie deprecation.

Last updated: September 1, 2026 • Author: Toolwasp Team • Sources verified Sep 1, 2026: MDN Cookies, MDN Privacy, EFF Online Behavioral Tracking, Cover Your Tracks, RFC 6265, Privacy Sandbox, Cloudflare What Are Cookies, IAB RTB. Learn more privacy guides at Toolwasp.