Cybersecurity Foundations (Grades 6–8) · lesson 30 of 48 · 10 min
Cookies, Tracking, and Your Digital Privacy
Every website you visit leaves a trail. Cookies, tracking pixels, browser fingerprints, and login trackers all work together to build a detailed profile of who you are, what you are interested in, and how you behave online. This data is worth billions of dollars to advertisers and data brokers.
Understanding how tracking works is the first step to controlling it. You cannot protect your privacy if you do not know what you are protecting it from.
By the end of this lesson you will be able to explain what cookies are and the different types, describe how cross-site tracking works, identify tracking methods beyond cookies, and apply practical steps to reduce tracking.
How much is your data worth?
The global data broker industry is worth over $200 billion annually. Your browsing history, location data, purchase history, and inferred interests are bought and sold without your knowledge. A detailed consumer profile can sell for as little as $0.001 — but multiplied across billions of users, it adds up to enormous profits. Understanding tracking helps you make informed decisions about what you share.
What Are Cookies?
A cookie is a tiny text file that a website saves on your browser when you visit. Cookies were invented to solve a simple problem: websites have no memory. Without cookies, you would have to log in again on every single page click.
Most cookies are harmless and useful — they remember your login, your shopping cart, or your language preference. But some cookies are designed specifically to track your behaviour across the internet, and those raise serious privacy concerns.
Analogy
Think of a cookie like a loyalty card stamp at a coffee shop. The shop stamps your card so it remembers you next time. A first-party cookie does the same — it helps the site remember you. A third-party cookie is more like a stranger following you from shop to shop, writing down everything you buy.
Types of Cookies
How Tracking Works Across Sites
When you visit a news site, it may load ads from an advertising network. That ad network sets a third-party cookie on your browser. When you visit a different site that also uses the same ad network, the network reads its cookie and recognises you — even though you have never directly visited the ad network’s own website.
Over time, the ad network builds a detailed profile: what news you read, what products you browse, what videos you watch. This profile is used to show you targeted ads and is often sold to data brokers.
How much data?
A single advertising network can track you across millions of websites. Studies have found that the average web page loads cookies from 10–20 third-party domains. A profile built from this data can include your approximate location, income bracket, health interests, political views, and shopping habits — all inferred from browsing behaviour.
Beyond Cookies — Other Tracking Methods
Cookies are not the only way you can be tracked. As browsers have added cookie controls, advertisers have developed alternative techniques:
What You Can Do
You cannot eliminate all tracking, but you can significantly reduce it:
Matching Activity
Cookie and Tracking Types
Knowledge Check
Cookies and Tracking
Which type of cookie is most responsible for cross-site advertising tracking?
- Session cookie
- First-party cookie
- Third-party cookie
- HttpOnly cookie
Answer: Third-party cookie
Third-party cookies are set by ad networks embedded in pages you visit, allowing them to track you across many different websites.
What is browser fingerprinting?
- Scanning your fingerprint to log in
- Using your browser settings and hardware details to identify you without cookies
- A type of phishing attack
- A method of clearing cookies automatically
Answer: Using your browser settings and hardware details to identify you without cookies
Fingerprinting combines details like screen resolution, fonts, and browser version into a unique identifier that persists even after cookies are cleared.
Clearing your cookies permanently prevents all future tracking.
- True
- False
Answer: False
Clearing cookies resets stored identifiers but does not prevent future tracking. Fingerprinting and other methods work without cookies.
What does an HttpOnly cookie protect against?
- Third-party tracking
- Cross-site scripting (XSS) stealing the cookie via JavaScript
- Browser fingerprinting
- Phishing attacks
Answer: Cross-site scripting (XSS) stealing the cookie via JavaScript
HttpOnly cookies cannot be accessed by JavaScript, so even if an attacker injects a script into a page, they cannot steal the session token.
A 1×1 invisible image used to log your IP address and timestamp is called a tracking _____.
Answer: pixel
Tracking pixels are tiny invisible images loaded from a tracker server. When your browser loads the image, the server records your IP, timestamp, and browser details.
Real-World Case Studies
Case 1: The Cambridge Analytica Scandal (2018)
Cambridge Analytica harvested personal data from 87 million Facebook users without their explicit consent, using a quiz app that collected not just the quiz-taker’s data but also their friends’ data. This data was used to build psychological profiles and target political advertising. The scandal revealed how much data social platforms collect and how it can be used for purposes users never anticipated. Facebook was fined $5 billion by the FTC. The lesson: data collected for one purpose can be used for entirely different purposes.
Case 2: The End of Third-Party Cookies
Google announced plans to phase out third-party cookies in Chrome by 2024 (later delayed to 2025). This followed Firefox and Safari, which had already blocked them by default. The advertising industry scrambled to find alternatives — including browser fingerprinting and Google’s Privacy Sandbox. The lesson: privacy protections improve over time, but the tracking industry adapts. Staying informed about new tracking methods is an ongoing responsibility.
Previous lesson: Browser privacy settings
Back to Cybersecurity Foundations (Grades 6–8)
Next lesson: Safe downloads and extensions