How Browsers Track You: A Simple Guide

September 13, 2025 · By cryptoke

By cryptoke, developer and editor at SafeLinkWrite. Reviewed for technical accuracy. This article is an overview of the tracking surface a browser exposes. For deeper technical detail on fingerprinting specifically, see Browser Fingerprinting Explained.

Modern browsers are astonishingly good at identifying the person behind them. Even with cookies disabled and JavaScript limited, a browser leaks enough distinctive information about itself that the website on the other end can often tell whether two visits come from the same device. This article is not a catalogue of techniques — that belongs to a fingerprinting deep dive. It is an answer to a simpler question: when you visit a website once, what does the site learn about you?

Understanding the layers of what is collected — and why — is the first step toward deciding what to do about it. The list below covers six layers, ordered from the ones you can control most easily to the ones you can barely control at all.

The Six Layers of What a Website Can See

Layer What it exposes Persistence User control
1. First-party cookies Session state, logged-in identity Persists until cleared or expired Full — clearing works
2. Third-party cookies Cross-site identifier set by ads, analytics, widgets Persists across sites Increasing — browsers blocking by default
3. Browser storage (localStorage, IndexedDB) Purer version of cookies — writes without expiry unless the site releases or the user clears Persists until cleared Full — clearing works
4. Fingerprint signals Canvas, WebGL, fonts, screen, language, hardware Stable across sessions Very limited — no local file to clear
5. Network-level signals IP address, TLS handshake details, referrer header Session-persistent; IP stable for weeks Partial — VPN changes IP; referrer policy controls the header
6. Behavioral signals Mouse movement, scroll pattern, timing between events Session-level; useful when combined with a persistent ID None that is practical

Layers 1 through 3 are the ones most users think of as "tracking." Layers 4 through 6 are the ones most users do not know exist. Roughly in that order, the countermeasures become less effective and more disruptive to ordinary browsing.

Layer by Layer: What Each One Actually Does

1. First-party cookies

Cookies are small text files that a website instructs the browser to store. On each subsequent visit, the browser sends the cookie back to the same domain. This is how logins persist and how shopping carts survive a page reload. First-party cookies are set by the site you visited and are usually benign in isolation — they exist to serve you, not to track you.

2. Third-party cookies

Third-party cookies are set by other domains whose content appears on the page — advertisements, analytics scripts, social widgets. They are the classic mechanism behind cross-site tracking: a script running on Site A and Site B can read the same cookie at both. Browsers are steadily restricting this. Safari and Firefox already block third-party cookies by default, and Chrome has been progressively rolling back support. This is a meaningful change, but it does not eliminate tracking — the fingerprint layer remains.

3. Browser storage (localStorage, sessionStorage, IndexedDB)

Modern browsers also offer localStorage, sessionStorage, and IndexedDB. These are purer versions of cookies: the site writes a piece of data to the browser, and the browser keeps it until the site releases it or the user clears it. They were designed for applications, not tracking, but they serve the same purpose when used that way. Unlike cookies, storage is not sent with every request — the site reads it explicitly through JavaScript. This makes it less visible to network-level inspection and, in practice, easier to slip tracking identifiers past tools that only watch HTTP headers.

4. Fingerprint signals

Cookies and storage can be blocked. Fingerprinting cannot — at least not easily. The combination of operating system, screen resolution, browser version, installed fonts, language settings, and dozens of other small details is often distinctive enough to distinguish one device from hundreds of thousands. The two heaviest signals are the canvas fingerprint (the specific pixels the browser produces when rendering identical text and shapes) and the WebGL fingerprint (the 3D graphics layer, which exposes GPU vendor and renderer strings). Because fingerprinting does not require storing anything on the device, it survives cookie clearing, private browsing, and most ad-blocking. It is one of the harder problems in browser privacy — and the subject of its own article.

5. Network-level signals

Beyond the browser, every request carries the visitor's IP address. That address reveals the network the visitor is on, and often the geographic region and the Internet service provider. On most home connections the address is stable for weeks or months. A referrer header accompanies most requests and indicates which page linked to the current one — this is how analytics platforms connect a visit back to a specific source, and it is the specific signal a safelink can strip when the visitor passes through an intermediate page. TLS handshake details (cipher suite, extensions supported) add a secondary network-layer signature that survives browser-level countermeasures.

6. Behavioral signals

Some sites track how the visitor moves, not just what they arrive with. Mouse movements, scroll patterns, time spent per section, and the timing of clicks can all be measured and stored. Behavioral signals are usually useless on their own — they are noisy and human variability is high. They matter when combined with a persistent identifier from one of the earlier layers. In that combination, they build a picture of habits, not just identity: how fast you read, whether you scroll to the end, what holds your attention.

Example: One Page Load, Six Layers Firing

Suppose you open a page on a news site that runs embedded ads and an analytics provider. What happens between clicking the link and reading the first paragraph:

[request]  GET /article/123
           Host: news.example.com
           Cookie: session=abc123                     → layer 1
           Referer: https://forum.example.com/thread → layer 5
           User-Agent: Firefox/128                   → layer 4
           
[script]   analytics.js requests /collect
           → reads canvas hash                       → layer 4
           → reads localStorage "uid"                → layer 3
           → sets third-party cookie on tracker.com  → layer 2
           → records TLS cipher via JSON body        → layer 5
           
[script]   engagement.js starts listening
           → records scroll depth, mouse moves       → layer 6
           → posts aggregated data to /beacon

Everything above happens in the first two seconds of page load, before you have scrolled. Clearing cookies afterward removes layers 1 through 3 for the next visit. Layers 4, 5, and 6 fire again on every subsequent load, regardless of what was cleared.

Myths vs Facts

Myth Fact
"Cookies are the way websites track me." Cookies are the oldest way. Fingerprinting, network-layer signals, and behavioral analysis are now at least as significant.
"Clearing cookies is enough." Clearing removes layers 1 through 3. It does not change fingerprints, IP-adjacent signals, or behavioral data tied to those.
"If I'm logged out, I'm anonymous." Logging out clears the first-party session. The remaining five layers are unaffected.
"Private mode is the same as a VPN." Private mode prevents local persistence. A VPN changes the IP the destination sees. They address different layers and neither addresses the fingerprint layer.
"A safelink hides my visit from the destination." A safelink strips the referrer header — that is layer 5, one signal out of many. The destination still sees the full browser, IP, and behavioral layers.
"A padlock icon means the site isn't tracking me." HTTPS is about transport encryption. It says nothing about what the destination collects after the request arrives.

Only one row in the table is fixable by a blog-level tool. Safelinks reduce referrer information. Everything else requires browser-level or purposeful changes on the user's side.

Five Practical Steps

  1. Use a browser that blocks third-party cookies by default. Firefox, Brave, and Safari already do. Removing layers 2 and most of layer 3 is the biggest single leverage point.
  2. Install one content blocker. uBlock Origin with standard filter lists cuts a large fraction of tracker scripts before they can reach layers 3 through 6.
  3. Choose a browser with active anti-fingerprinting. Firefox strict mode and Brave default shields randomise parts of layer 4. No mainstream browser fully removes it.
  4. Clear storage periodically — and know what it does and does not reset. Storage clearing resets layers 1 through 3 for the next visit. It does not reset your fingerprint or your IP.
  5. For links to untrusted destinations, prefer a channel you control. Read the URL, use the official app, or route through an intermediate check. This reduces referrer and phishing exposure, not the broader tracking surface.

The Broader Picture

Tracking on the web is not inherently malicious. Analytics helps site owners understand their audience. Fraud prevention needs some form of device identification. The problem is the scale at which tracking has been commercialized, and the lack of transparency about what gets collected, how long it is kept, and who else sees it. Every layer in this article supports legitimate uses and illegitimate ones, and the same field that lets a site remember your language preference also lets it follow you across domains.

You will never have full visibility into that. You can have enough of it to make deliberate choices about which sites you trust and which tools you carry with you. The next time you land on an unfamiliar page, the six-layer map above is what is happening beneath the loading spinner — before you have read a single word.

Tags: