You open an online store, look at a pair of headphones for a minute, close the tab — and for the next two weeks every website you visit shows you that same pair. It is not your phone listening in, and it is not the two sites conspiring. It is one advertising network that saw you on the store, stored a marker, and now recognises that marker everywhere else it runs ads.
Here is how that actually happens, step by step, and what the recent changes to web tracking mean for you.
What a single page request really contains
When you open any website, your browser does not just fetch the page text. It also fetches everything the page asks for: images, fonts, style files — and, on many sites, code and pixels from advertising networks.
One of those requests looks like this. The site's page includes a tiny image or script loaded from a domain such as ads.example-network.com. Your browser sends a request to that domain, and attached to that request is a small text file called a cookie that the network previously set on your browser. The network reads the cookie's unique ID, notes which site you are on, what time it is, and your IP address, and responds with the ad. The whole exchange takes a fraction of a second and never shows up as anything you notice.
The key detail: that ads.example-network.com domain appears on thousands of unrelated websites. So the same cookie ID is presented to the same network on all of them. That single shared ID is what lets the network recognise you across the web. Sites are not talking to each other; one middleman is watching all of them at once.
Two older tricks that still matter: pixels and fingerprinting
A tracking pixel is the invisible version of the same idea — a 1×1 image whose only job is to make your browser send that request so the network records the visit. Pixels are how a network learns you loaded a page, from which site, and when, even if you never click anything.
Device fingerprinting works without cookies at all. Your browser reports dozens of settings — version, screen size, installed fonts, time zone, language, hardware — and the combination is often specific enough to identify you. It survives clearing cookies and survives private windows, because nothing is stored; the browser simply reports these values on every request. The mechanics are covered in detail in our browser fingerprinting guide.
A third, less-discussed route is your logged-in accounts. If you are signed into a large platform while browsing, that company can tie your activity on other sites to your account directly — no cookie needed — because its own buttons, widgets, and analytics appear all over the web.
What actually changed in 2024–2026
The biggest shift is that the tracking industry's foundation is being dismantled, but not as quickly as once promised.
- Safari has blocked third-party cookies by default for years (Intelligent Tracking Prevention).
- Firefox blocks third-party tracking cookies by default (Enhanced Tracking Protection) and lets you see exactly what it blocked, site by site.
- Chrome abandoned its plan to fully deprecate third-party cookies and instead gives users control. You can now choose to allow, block, or limit third-party cookies in Chrome settings, and it ships a "third-party cookies limited" mode for most users.
- Edge has tracking prevention levels (Basic/Balanced/Strict).
- Google's Privacy Sandbox replaced the old cross-site tracking model with the Topics API: instead of a network building a profile from every site you visit, the browser itself assigns you a few broad interest topics (for example "Fitness" or "Automotive") and reveals only a small, rotating set to sites. Advertisers still get relevance; the per-site history no longer follows you.
The practical effect: third-party-cookie-based tracking is dying, but it is not gone. Some networks have moved to workarounds — most notably CNAME cloaking, where a site runs the tracker under its own first-party domain so the cookie is treated as a first-party cookie and is not blocked. Our third-party cookies explained piece goes into how these workarounds operate.
How this changes what you should do
The old advice — "just clear your cookies" — is now only part of the answer. A more useful framework, browser by browser:
- Chrome: Open Settings → Privacy and security → Third-party cookies, and choose Block third-party cookies (or keep the limited mode if you prefer less breakage). Then open the cookie site data list occasionally and clear the heavy hitters.
- Firefox: Firefox blocks tracking cookies by default. To confirm it is working, visit the shield icon in the address bar — it shows exactly what was blocked on that page. You can also tighten Enhanced Tracking Protection to Strict.
- Safari: Tracking prevention is on by default; nothing to configure. Safari also isolates cookies per site, so a network cannot read its cookie across different sites.
- Edge: Settings → Privacy, search, and services → set Tracking prevention to Strict.
Regardless of browser, these habits still matter:
- Browse logged-out. The single biggest remaining tracking vector is signed-in accounts linking your activity. Signing out of a large platform removes that link on the sites you visit.
- Use a content blocker (or a privacy-focused browser) for sites you do not trust. It stops both pixels and scripts, not just cookies.
- Be deliberate about notifications and logins rather than clicking "accept all" or "allow" out of habit.
When it is worth blocking, and when it is not
Blocking trackers has a real cost: many free sites and apps pay their bills with advertising revenue. If you block everything aggressively on every site, some sites will put up paywalls, break features, or show more obnoxious ads that are not personalised.
So treat it as a sliding scale, not an all-or-nothing decision:
- Default: Let your browser's built-in protection do the work (cookies blocked, tracking protection on). This covers most people with zero effort.
- For sensitive activity: browse logged-out, use a stricter blocker, and clear site data afterward. This is the right call for banking, healthcare, and research you would rather keep to yourself.
- For sites you value: you can whitelist them. A blocker that lets you allowlist trusted sites gives you the privacy and still supports the publishers you care about.
Quick answers
Is my phone actually listening to my conversations? Almost never. The "mentioned it, then saw an ad" effect is retargeting from earlier browsing, not microphone eavesdropping.
Do private or incognito windows stop tracking? No. They stop your history being saved locally. Trackers still see you in that window and can still link you to existing profiles.
Does clearing cookies stop all tracking? No — it stops cookie-based tracking. Fingerprinting and signed-in account linking still work, which is why logged-out browsing and browser-level blocking matter more.
Will ads disappear if I block trackers? No. You still see ads; they just stop following you. What you give up is the profile, not the adverts.
Written by Hassan Arshad, founder of UsefulOrbit. Last updated August 31, 2026. Sources: EFF Surveillance Self-Defense, FTC Consumer Advice, Google Chrome help: Manage cookies.