Cookies and Ad Trackers: How to Limit Them

Every day you click "Accept" on cookie banners without reading them, and you probably wonder what you are agreeing to. Behind them stands an enormous industry that follows people from site to site to build profiles for advertising. In this lesson you will learn how cookies and trackers work, what the banner is really asking, and how to reduce tracking without breaking the web.

In the last lesson you discovered that the GDPR requires transparency and consent for the use of personal data. The cookie banner is where that principle meets everyday browsing.

What is a cookie?

A cookie is a small piece of text that a website asks your browser to store, and that the browser sends back on later visits. It is not a program and cannot "run" by itself. Its function is to give the website a memory: HTTP, the language of the web, forgets everything between two requests, and cookies are how a site remembers who you are.

Cookies have perfectly legitimate uses:

• Keeping you logged in, so you do not have to type your password on every page.
• Remembering your cart in an online shop.
• Saving preferences: your language, your theme, your region.
• Security: helping to detect fraudulent sign-ins.

The technical documentation on developer.mozilla.org explains them in detail for those who are curious.

First-party and third-party cookies

• First-party cookies are set by the site you visit. They are generally what makes the site work.
• Third-party cookies are set by another domain whose content is embedded in the page, such as an advertising network, a social "share" button or an analytics service. The same third party can be present on thousands of unrelated sites and so recognize you everywhere.

Imagine a shopkeeper who gives you a numbered ticket when you enter. That is a first-party cookie. Now imagine that a stranger stands at the entrance of thousands of shops, silently noting each time the same person enters. That is third-party tracking.

Beyond cookies: other tracking techniques

Blocking cookies is not the end of the story, because trackers use other tools:

• Tracking pixels and scripts: tiny invisible images or code snippets that report your visit to a third party.
• Browser fingerprinting: combining details about your device (screen size, fonts, language, system version, plugins) to produce an identifier that is surprisingly unique, without storing anything on your device.
• Mobile advertising identifiers that follow you across apps, which mobile systems let you reset or limit.
• Login-based tracking: when you are signed in to an account, your activity is tied to your identity, whichever cookies you block.
• Cross-device linking: matching your phone and your computer using shared accounts, addresses or behavior.

What is the cookie banner asking?

In the EU, rules on electronic communications (the ePrivacy rules) combined with the GDPR require consent before non-essential cookies and similar trackers are placed. Consent must be:

• Free and informed: you must be told what the trackers are for.
• Specific: for each purpose, such as measurement, personalization or advertising.
• Unambiguous: it needs an action; pre-ticked boxes do not count.
• As easy to withdraw as to give, and in France the authority insists that refusing must be as easy as accepting, for example with a "Refuse all" button as visible as "Accept all".

Strictly necessary cookies, such as those keeping your cart or your session, do not require consent. A site also does not have the right to deny access just because you refuse non-essential trackers, with certain exceptions where a clear alternative is offered.

In practice, many banners are designed to make acceptance easier than refusal: a big colored button for "Accept", a tiny grey link for "Settings". These manipulations are known as dark patterns. The authorities regularly sanction them.

How to handle the banners

1. Choose "Refuse all" or "Continue without accepting" when it is offered. If not, open the settings and untick everything that is not strictly necessary. Do it once; it takes ten seconds.
2. Look for the privacy settings link at the bottom of the page if you want to review or change your choice later.
3. Do not agree to "legitimate interest" tickboxes for advertising partners if you prefer not to be tracked. Many banners have a separate list for it.
4. Be wary of "pay or accept" choices. Read what is offered and decide whether the service is worth it.

Reducing tracking with your browser and tools

You do not have to rely on banners alone. A few settings do a lot of work:

• Browser tracking protection: modern browsers have built-in options to block third-party cookies and known trackers. Turn on the stricter mode and see whether it suits you.
• Content blockers: reputable open-source blocker extensions remove many ads and trackers, and speed up pages. Install from the browser's official store and keep their number small.
• Regular cleaning: set the browser to delete cookies and site data when it closes, and keep exceptions for the sites where you want to stay logged in. Use separate browser profiles for different activities if you wish.
• Privacy-respecting search engines that do not build a profile of your searches, as an alternative to the default one.
• Mobile advertising ID: reset it regularly or opt out of ad personalization in your phone's privacy settings, and decline "tracking" requests from apps when the system asks.
• Email privacy: block remote images in email so that tracking pixels do not report that you opened a message.
• Signal-based opt-outs: some browsers can send a "do not track" or "global privacy control" signal. Its honoring depends on laws and on the websites, but it costs nothing to enable.

Trade-offs and balance

Blocking everything can break websites: logins that do not work, embedded videos that do not load, carts that empty. If a site you trust does not work, you can allow it temporarily or add an exception, rather than lowering your guard everywhere. Remember also that advertising finances much of the free web. The aim is not to starve every website, but to make tracking something that you agree to knowingly, in a measure that suits you.

Your turn

Exercise. Open your browser's privacy settings. Turn on tracking protection, set cookies to be cleared at close with exceptions for your regular accounts, and visit three websites. On each, handle the banner by refusing non-essential cookies. Then open the cookie list for one site and identify one first-party and one third-party cookie.

See a solution

1. In the browser's settings, find "Privacy and security". Select the standard or strict protection against trackers, and block third-party cookies.
2. Enable "Clear cookies and site data when the browser closes", then add exceptions only for the few sites where you want to stay logged in.
3. On each site, use the "Refuse" or "Continue without accepting" option. If not available, open "Settings" and untick the optional purposes.
4. In the site information panel (the icon beside the address), open the cookie details. A first-party cookie belongs to the domain of the page you are on; a third-party cookie belongs to another domain, often an advertising or analytics service.

Add to your Security Notebook

Under "5. Privacy and law", write your cookie policy for yourself ("I refuse non-essential cookies by default"), the browser protections you have switched on, and the date on which you will review your extensions.

Cookies are only one part of the privacy picture. The next lesson looks at the privacy settings of the everyday services you use.