Every website you visit leaves a trail—here's how to cut it off

You've heard for years about browser tracking, fingerprints, and cookies, but what do they all mean? How and why do tracking companies identify you? And more crucially, what is the most straightforward way to protect yourself? I cover all of these so you can resist intrusions into your digital life, and it's much easier than you think.

The modern web is overflowing with invasive tracking technology, and unless you're an expert with a lifetime to spare, you can't avoid all forms forever. You're opposed by thousands of specialists with billions of dollars at their disposal who work tirelessly through technical specifications and an endless sea of ideas, all financially motivated to sell you products. To do that effectively, they need to know all about you. This is the core idea that drives commerce on the modern web, and it's part of the broader and aptly named topic of surveillance capitalism.

The tracking pixel

A beacon that closely monitors your interactions

There are many avenues to gain access to our data, so it's difficult to know where to start. Let's start with a classic.

The tracking pixel—aka web beacon or spy pixel—traces its roots back to the 90s, known then as a "web bug." It was a tiny, imperceptible image (1x1 or 0x0) rendered on web pages to track visitors. When loading the page, the browser fetched the image and included connection information—like a timestamp, web browser, operating system, etc. Since then, the tracking pixel has long evolved into a much more powerful tracking script using the browser's JavaScript engine.

Trackers monitor how you interact with a web page. They observe what you do, what you click, and generally what your interests are. For example, if you add something to a shopping basket, then remove it, the tracker typically records it. This information is extremely valuable to marketers because it makes you more predictable and easier to sell to.

Website owners use trackers to support their ad campaigns and retarget visitors. For example, Meta Pixel is a script that allows Meta to correlate web page visitors to pseudonymous Facebook accounts. When a user leaves a web page without a purchase, the owners can retarget their Facebook account (through Meta) with highly relevant ads.

Meta is not the only company in the game. The biggest offender in this space is Google, whose reach is around 70% of all websites. There's data that shows websites on average contain 7 trackers and account for around 40% of all traffic.

Over days or even years, tracking companies incrementally build a comprehensive picture of your digital life without your knowledge. They know where you go, what you do, what you're interested in, when you're doing it, and for how long—all possibly linked to your real identity.

Supercookies

Like normal cookies, but more evil

You may have heard of cookies—a value stored on your machine that can uniquely identify you—but have you heard of supercookies? The concept is simple: they're cookies stored in places you may not think to look. There are many places to store values in a browser, and some are remarkably clever.

Evercookie is the classic supercookie tool, which has 17 storage locations at its disposal. When you delete your normal cookies, Evercookie restores them from many hidden places, ensuring your assigned ID is harder to erase.

Browser fingerprints

A persistent identity that's difficult to get rid of

Fingerprints are patterns that uniquely identify a single person. In the same vein, browser fingerprinting measures the unique properties of your web browser.

The span and complexity of this space are vast, so I will spare you the gory details. However, techniques to infer system fonts, installed web extensions, time zone, screen resolution, browser version, JavaScript commands (aka the API), and more all combine to provide a highly effective and unique pattern for your web browser.

You can determine your browser's uniqueness by running EFF's Panopticlick (or the newer Cover Your Tracks), which scans your browser using well-known techniques. Tracking companies use these methods when more direct approaches become unreliable, such as storing supercookies. So if you think disabling cookies will save you, think again.

Protect yourself

Randomize your fingerprint and never store tracking information

Given that tracking companies are leaning towards fingerprinting methods, we should focus on resolving that. The implication is that supercookies, while effective for a long time, are becoming less reliable than measuring the innate characteristics of your browser.

So what can we do about it? People typically load up their web browser with anti-tracking web extensions, but that's not the often-recommended advice. Because web extensions modify web pages, tracking scripts can probe the rendered page to infer what extensions you use, consequently making your fingerprint more unique. Not only that, but some web extensions that claim to combat fingerprinting actually end up making your fingerprint more unique by emitting impossible information about your browser.

Conventional anti-fingerprinting methods have taken a different approach: blending into the crowd. The more similar you are to everyone else, the harder you are to distinguish—that's the idea. You cannot achieve this through a web extension, and so the most frequent advice is to find a web browser vendor who is on your side—the more popular, the better.

Firefox, Brave, LibreWolf, and the Mullvad Browser are all popular choices in the alternative browser market, so let's look at them.

Using Panopticlick, we can see that they all have a low privacy score, and each has an alarmingly unique fingerprint. What's worse, if you install extensions to improve it, you become more unique. This is where Brave outshines everyone else.

I've long believed that randomizing fingerprint data is the way to go. If every request you made changed your fingerprint, how could they track you across browser sessions? This is what Brave does with its farbling feature—it introduces random noise into often-targeted points in your browser, frequently changing its unique identity.

You can see that Brave returns a unique value between two browsing sessions using FingerprintJS, a popular and often-used fingerprinting tool.

The second thing that we need to address is the persistent state stored by tracking scripts. Remember when I said supercookies can exist in multiple locations? Well, the best remedy for that is to browse in private mode, which deletes all persistent state when the window closes—cache, cookies, site settings, and more. None of them survive.

You can use private mode for general browsing and normal mode for websites where state matters—for example, when logged into YouTube or Facebook.

Hide your IP

Wearing a mask is useless if you give out your real name

The last thing I recommend is that you hide your IP address. Your IP address uniquely identifies your home network on the internet, and every website you visit has access to that information.

I use Proton VPN. It's reliable, fast, and even has a "secure core" feature, which is a 2-hop service. Instead of connecting directly to one VPN server, Proton routes your connection through one server and out of another. So, you connect to a service in Switzerland, and the exit node could be in France or Germany. This is an extra layer of protection from snoopers listening on the network.

Be careful not to skip this essential step.

While I haven't used Mullvad VPN, I've heard good things about them.

I could not cover everything in a single article even if it were 10 times longer—there are simply too many moving parts. Browsers are complex, and as stated in the introduction, you'd have to be a full-time expert to combat tracking on your own. The best we can do is to rely on the professionals: the browser vendors.

I've chosen Brave for its farbling feature. I think it's much easier to create random noise (entropy) than it is to make everything the same. In addition, it allows us to install one or two extensions because uniqueness matters slightly less. I'd recommend an ad blocker, and if you want to amplify your noise, you can use AdNauseum, which generates fake ad interactions, corrupting the profiles tracking companies build on you—but uBlock Origin is what I use.

In short:

• Use Brave
• Install an ad blocker to block tracking scripts (Brave has one built-in called Brave Shields)
• Use private mode for everyday web browsing
• Use a VPN to hide your IP

Are these methods perfect? No, but they're the best we have and the most straightforward.

For more detailed information on privacy, you can visit the Privacy Guides website, which has comprehensive advice and guides.

If you're interested in furthering your knowledge of privacy, you may find my DNSCrypt introduction useful. It covers how to hide your web domain requests (like example.com) from snoopers using encryption. It's eye-opening if nothing else.