Refusing cookies is a good start, but it does not explain why an advert seems to "know" what you looked at yesterday on another site. Online tracking has evolved into less visible techniques that leave no recognisable file in your browser. Knowing them helps you understand which choices really make a difference.
The main tracking techniques
Third-party pixels and tags
Many pages contain small invisible elements loaded by outside companies, often advertising platforms or social networks. When the page opens, your browser contacts their servers and reports which page you are visiting, from which device and at what time. If you are logged into the social network in the same browser, that visit can be linked to your profile.
Browser fingerprinting
Fingerprinting combines apparently harmless characteristics: browser model, operating system, screen resolution, language, time zone, installed fonts. Taken one by one they are common; combined, they can form a set rare enough to recognise you among a very large number of users, without saving anything on your device.
Link parameters
When you click a link in a promotional email or on social media, the address often carries a string of characters after the question mark. Some of those parameters only identify the campaign; others contain an identifier that ties the click to you.
Always-on accounts
The most effective tracking is also the simplest: if you use the same account for email, search, videos and the browser, and stay logged in all the time, the provider needs no sophisticated technique to connect your activities.
What the law says
The key point is that the consent rule is not just about cookies. Article 5(3) of Directive 2002/58/EC, transposed in Italy by Article 122 of the Privacy Code, applies to storing information on the user's device and accessing information already there, by whatever technique. The Italian authority's cookie guidelines expressly cover other tracking tools as well, fingerprinting included: passive identifiers used for profiling purposes require the same safeguards as profiling cookies.
Moreover, when tracking leads to building a profile, the GDPR applies: you have the right of access under Article 15, the right to object to profiling for marketing under Article 21 and the right to erasure under Article 17.
How to leave fewer traces
There is no single solution, but a combination of habits greatly reduces exposure.
| Tracking technique | Practical countermeasure |
|---|---|
| Third-party pixels and tags | Browser with tracking protection enabled; extensions that block trackers |
| Fingerprinting | Browsers that standardise or vary the characteristics they expose |
| Link parameters | Open the site by typing the address, or delete the part after the question mark when it is not needed |
| Always-on accounts | Log out when not in use, or use a separate browser profile |
| Third-party cookies | Block them in settings and refuse them in banners |
Account settings worth checking
Major online service providers offer dashboards where you can:
- turn off ad personalisation;
- pause web, search and video activity history;
- set history to be deleted automatically after a given period;
- see and remove the interests that have been attributed to you.
It is worth spending ten minutes on these dashboards once a year: options change and new activities are often switched on by default.
What does not work as people think
- Incognito mode keeps history off your device, but the sites you visit, the employer running the network and your internet provider can still see your activity.
- The "Do Not Track" signal is a request that sites may ignore; on its own it blocks nothing.
- Aggressively blocking everything can make your browser more recognisable, because it stands out from the crowd. A widely used browser with built-in protections is often more effective.
A concrete example
You receive an email from a shop, click on an offer and buy nothing. The next day you see the same product in an advert on a social network. The link parameter told the shop that the click came from your email address; the social network's pixel on the product page recorded the visit and linked it to your profile. Opening the site without going through the link, and using a browser that blocks third-party trackers, would have broken both steps.
In short
- Tracking also relies on pixels, fingerprinting, link parameters and always-on accounts.
- The consent rule in the ePrivacy Directive and national implementing law applies to any technique, not just cookies.
- A browser with tracking protection and logging out of accounts greatly reduce exposure.
- Check your ad personalisation and history dashboards once a year.
- Incognito mode and "Do Not Track" protect less than people believe.