Why Online Tracking Is Worse Than You Thought

Most people know that websites use cookies. Fewer realize how many other techniques follow them across the internet, or how many companies receive data from a single page view. Open an ordinary news article and dozens of third parties may load in the background, each seeing your IP address and some details about your device. This article explains how tracking works in 2026, why the old Do Not Track setting failed and what actually reduces tracking now.

1. How you are tracked

Cookies. Small files that sites and third parties place in your browser to recognize you. First-party cookies help a site remember your login or cart. Third-party cookies, set by advertising and analytics firms, follow you across sites. Many browsers now limit third-party cookies, but tracking has moved to other methods.

Tracking pixels and scripts. Tiny images or code snippets embedded in pages and emails report when you load them. Social media pixels can send your activity on a retail site to a platform. See Facebook tracking explained and email tracking.

Browser fingerprinting. Sites collect details such as your browser, operating system, screen size, fonts, language, time zone and graphics settings. The combination can be unique enough to recognize you without any cookie.

Logged-in tracking. When you sign in to a platform, your activity on its services and on partner sites can be linked to your account.

IP addresses and network data. Your IP address reveals approximate location and can link sessions.

Mobile identifiers. Advertising IDs and device identifiers let apps share data. See smartphones constantly send personal information.

Cross-device linking. Companies infer that a phone, laptop and tablet belong to the same person using shared accounts, networks and behavior.

Data brokers. Online activity is combined with offline records such as purchases and addresses. See the data brokers selling your personal information.

2. Why it is worse than you think

Scale. A single page can contact dozens of third-party domains. Over a day, thousands of tracking requests can occur.

Invisibility. Tracking happens in the background, and most people never see it.

Sensitive inferences. Browsing health, finance or relationship topics can lead to inferences about conditions, income or orientation. Those inferences may be shared widely.

Data persistence. Profiles built over years can follow you across devices and services.

Spillover into real life. Online profiles connect to addresses and phone numbers, feeding people-search sites, ad targeting and sometimes pricing.

Security risks. More data collected means more to breach. The FBI’s IC3 logged 67,456 personal data breach complaints in 2025; see ic3.gov.

Curious what’s already out there? Wiperts’ 100% Free Diagnosis shows which data brokers are listing your name, home address and phone number. Check your exposure free — it takes about a minute.

3. The Do Not Track experiment

In the early 2010s, browsers added a Do Not Track setting that sent a signal asking websites not to track you. It looked like a simple solution. But it had no legal force. Sites and advertisers were free to ignore the signal, and most did. Industry and regulators never agreed on what “not tracking” meant, and the signal itself could be used as a fingerprinting data point. Over time, browsers removed or de-emphasized it, though the idea remained popular. The Federal Trade Commission supported the concept in policy discussions, but without a legal mandate, adoption failed. See ftc.gov for the agency’s privacy work.

4. What replaced it: Global Privacy Control and laws

Global Privacy Control (GPC) is a browser signal that tells websites you do not consent to the sale or sharing of your personal information. Unlike Do Not Track, GPC is recognized as a valid opt-out request under several state privacy laws, and regulators have enforced it. If you live in a state with such a law, a business that receives GPC must honor it for the browser or device. You can enable GPC in some browsers by default or by installing an extension.

State privacy laws. About twenty states give residents rights to opt out of the sale, sharing and targeted advertising of their data. See opt-out privacy benefits.

Platform controls. Mobile operating systems let you deny tracking requests by app and reset advertising IDs.

Regulation of brokers. Registries and California’s DROP address downstream sales.

5. What actually reduces tracking

Use a browser with tracking protection that blocks third-party cookies and known trackers, and limits fingerprinting.
Turn on Global Privacy Control.
Add a content blocker for scripts and ads, but choose well-known tools and keep them to a minimum.
Use separate browser profiles or containers for banking, shopping, social media and work.
Log out of platforms when you finish, or avoid staying signed in on other sites.
Reject non-essential cookies and decline “personalized ads.”
Reset your phone’s advertising ID and deny app tracking.
Block remote images in email to defeat tracking pixels.
Avoid unnecessary apps. See why you should cut back on app downloads.
Consider a VPN carefully. It hides your IP address from sites but does not stop cookies, fingerprints or logins.

Our guide to stopping websites from tracking your clicks goes step by step.

6. Deal with the offline side of tracking

Even with strong browser settings, data already compiled by brokers continues to circulate. Opt out of people-search sites through official pages such as spokeo.com/optout, suppression.peopleconnect.us and thatsthem.com/optout. California residents can use DROP at privacy.ca.gov/drop. Ask Google to remove personal results. Use a PO box and a secondary phone number for forms. Freeze your credit at IdentityTheft.gov. Recheck every 60 to 90 days.

7. Why we still need a “do not track” right

The idea behind Do Not Track remains important: you should be able to say no once and have it respected everywhere. GPC and state laws come closer than the original, but coverage is partial, enforcement is uneven and there is no federal rule. People who value privacy can help by using GPC, supporting stronger laws and choosing services that respect the signal. The Consumer Financial Protection Bureau and Federal Trade Commission pages at consumerfinance.gov and consumer.ftc.gov explain consumer rights in related areas.

8. A worked example

Pia installs a browser with tracking protection, turns on GPC, blocks remote images in email, resets her phone’s advertising ID and sets ad personalization off. She uses separate profiles for banking and shopping. She opts out of eight people-search sites and sends a deletion request to a retailer under her state law. Her browsing feels the same, but ads become less eerily specific and the cold calls fall.

9. Myths about tracking

“Incognito stops tracking.” It does not. “I have nothing to hide.” Tracking affects pricing, targeting and security. “Cookie banners protect me.” Many are designed to get consent. “A VPN solves tracking.” Only part of it.

10. Tracking in email, messages and smart devices

Tracking is not limited to web pages. Marketing emails often include invisible images that report when and where you opened a message, and links that carry identifiers. Messaging apps and smart TVs record usage and, on some devices, identify what is on screen. Voice assistants and connected appliances log interactions. To reduce this, block remote images in your email client, avoid clicking tracked links when you can type an address instead, review the privacy menus on your TV and turn off viewing data collection and personalized ads, and delete voice recordings regularly. The Federal Trade Commission’s consumer pages at consumer.ftc.gov explain common tracking methods and settings.

11. A short buyer’s guide to tracking protection

When choosing tools, favor simplicity. A privacy-focused browser with built-in tracker blocking handles most needs without add-ons. Add Global Privacy Control, and if you want more, one reputable content blocker. Avoid installing many extensions, because each can read the pages you visit and some collect data themselves. Check how a tool is funded, whether its code is open to review and whether it has a record of updates. Keep your browser and operating system current, since updates close the holes that fingerprinting and malicious ads exploit. The Cybersecurity and Infrastructure Security Agency at cisa.gov recommends these basics.

12. Three scenarios

Scenario 1: You are researching a sensitive topic. Use a separate profile, sign out and use tracking protection.

Scenario 2: You are shopping for a big purchase. Use private profiles to limit price tailoring and follow-up ads.

Scenario 3: You share a computer. Use separate user accounts and profiles.

13. What to expect: a realistic timeline

Action	Time to do	When it takes effect
Browser protection and GPC	15 to 30 minutes	Immediate
Email and phone settings	30 minutes	Immediate
Separate profiles	30 minutes	Immediate
Broker opt-outs	2 to 4 hours	Days to 4 weeks
Rechecks	15 to 30 minutes	Every 60 to 90 days

14. Common mistakes

Relying on incognito mode.
Stacking many blockers that conflict.
Staying logged in everywhere.
Ignoring mobile tracking.
Forgetting data brokers.

15. How Wiperts helps with the offline side of tracking

Wiperts scans more than 100 data brokers and people-search sites, submits removal requests, asks Google and Bing to remove personal results, blurs your home on maps and monitors 24/7 so relisted data is removed again, targeting where tracked data ends up.

See where the data trail leads.

100% Free Diagnosis: Check Your Exposure

Find out what data brokers have on you. Enter your details in the free scanner on the Wiperts homepage:

First Name
Last Name
Select State
Email Address
Website

Scan Databases Now — no payment is needed to see your exposure report.

16. Key takeaways

Tracking uses cookies, pixels, fingerprints, logins and data sharing, and it is pervasive.
Do Not Track failed because it was optional; GPC and state laws are stronger.
Use tracking protection, GPC, separate profiles and fewer logins.
Remove broker listings and recheck regularly.

Pick the Wiperts plan that fits your household

Plan	Covers	One-time deep scrub	Then
Individual	1 person	$89	$14/month
Couples (most popular)	2 people	$149	$24/month
Family	Up to 4 people	$199	$39/month

Every plan includes removal of your name, date of birth, salary, home address and phone number from 100+ data brokers and people-search sites, Google and Bing search-result removal, home blurring on maps, and 24/7 monitoring that re-removes your data if it reappears. See plans and start your removal

17. Frequently Asked Questions

How do websites track me?

Through cookies, tracking pixels, scripts from ad and analytics companies, device fingerprinting, login accounts, IP addresses and data sharing between apps and websites.

What was Do Not Track?

A browser setting that sent a request not to be tracked. It failed because websites were not legally required to honor it, so most ignored it.

What is Global Privacy Control?

A signal sent by supported browsers and extensions that tells sites not to sell or share your data. Several state laws require companies to treat it as an opt-out request.

Does private browsing stop tracking?

Not really. It prevents your browser from saving local history, but sites, ad networks and your internet provider can still see activity.

Can I stop tracking completely?

No, but you can reduce it substantially with tracking protection, GPC, fewer logins, separate profiles and opt-outs.

What is browser fingerprinting?

A technique that combines details such as your device, fonts, screen size and settings to recognize you without cookies.

Sources

Ready to erase your footprint?

Stop letting data brokers profit from your personal life. Start your removal today.

Start Removing