If we use a web browser like Chrome, Firefox, Internet Explorer, Edge, or Safari, then we have probably picked up a few cookies along the way. Cookies are used to remember things about websites: Our login information, what we have in our shopping cart, what language we prefer. They are created by websites and sit in our browser until they expire.
Some cookies
are harmless, but others remain active even on websites that they didn’t
originate from, gathering information about our behavior and what we click on.
These are called third-party
persistent cookies or, more colloquially, tracking cookies.
Tracking
cookies can be so invasive that many antivirus programs classify them as
spyware. Despite their bad reputation, they have become so ubiquitous that it
is nearly impossible to avoid them. In this blog, we will go into detail and
explain how tracking cookies record our web activity, why they are so popular,
and how to stop them.
Types of Cookies Explained
Whenever we go into our browser settings and
clear our cookies, we are deleting the persistent cookies.
Session cookies
The
most basic type of cookie is a session cookie. Session cookies only exist in
temporary memory and are deleted when we close the browser. Any cookie created
without an expiration date is automatically a session cookie. A common use for
session cookies includes remembering what is in our shopping cart on an
ecommerce site (although most modern ecommerce sites now store this info in a
database on their servers).
First-party persistent cookies
Persistent
cookies are written onto our device’s memory and come with an expiration date.
They are only used by the website that created them and can last however long
the website dictates. They remain on our device even after we close our web
browser. Our web browser uses first-party persistent cookies for many
quality-of-life enhancements, like remembering that we are signed in, so we do
not need to log in every time we visit the same site.
Third-party persistent cookies
Third-party
persistent cookies, also known as tracking cookies, are the focus of this blog.
These cookies are stored in our device’s memory and have a set expiration date.
Unlike the first-party variety, however, third-party persistent cookies are
accessed on websites that did not create them. This allows the cookie’s creator
to collect and receive data any time the user visits a page with a resource
belonging to them.
Where do tracking cookies come from?
Websites
today are rarely made up solely of code and content created by the website
owner or Administrator. Instead, they use resources from other sites to build
and Add functionality to their web pages. These resources are often useful and
even essential for a website to compete. Unfortunately, those same resources
are often the biggest perpetrators of online tracking. Some of the most common
resources that use tracking cookies include:
- Advertisements
- Social media widgets (Like and
Share buttons, comments sections, etc.)
- Web analytics
We do
not even need to click on an Ad or social media sharing button for a tracking
cookie’s information about we to be transmitted back to a server owned by the
person or company who created it. As soon as we load the page, the cookie is
sent to the server where it originated. If no cookie exists yet, the resource
can create one.
Let
us say I write a blog post an include an image that is hosted on another
website. The other website can create a cookie or send and existing one to its
server, even though I am not actually on that website; I am just loading a
resource from it. Similarly, most Ads and widgets are not hosted by the
websites they reside on. They are just resources pulled from third parties, and
they all use cookies.
According to The Guardian, some of the biggest companies using
tracking cookies include:
- AddThis
- ADXS
- DoubleClick
- Facebook
- Google
- QuantServes
- Scorecard Research
- Twitter
- Yield manager
What do track cookies know about me?
Tracking
cookies are usually used for Advertising purposes, retargeting. Retargeting is
a tactic that often relies on tracking cookies to show Ads to people who have
previously visited a specific site or shown interest in a particular product.
If we have ever bought or even looked at a product on Amazon and then started
seeing Ads for similar products on other websites, we have been retargeted.
Here
is a simplified step-by-step explanation of how retargeting works:
1. We pick up a tracking
cookie on our favorite blog or shopping site. That cookie contains a unique ID
that does not identify we personally but does identify our web browser.
2. The owner of the shopping
site signs up and pays for an Advertising platform like Google.
3. Google’s Ads aren’t static;
when we visit other websites that use Google Ads to make money, the website
sees the cookie and sends it to Google through the Ad. Google sees the unique
ID stored in the cookie and recognizes that it came from our favorite shopping
site.
4. Google then shows an Ad for
the shopping site accordingly.
Likewise,
other Advertisers on Google’s Ad network can use that cookie, too, if our Advertising
profile meets their criteria of the target audience. It does not only benefit
the site where we picked up the cookie.
This
might seem harmless at first, but those tracking cookies can start racking up a
lot of information about how we browse the web. Google’s Ads are everywhere,
and while it is the largest online Advertising company in the world, there are
many, many others. Because of this, Advertising companies can collect a history
of what websites we visit, in what sequence, and for how long. When cookies are
sent back to their servers, they often include information about the previous
site that a user visited, called a referrer URL.
Browsing history is just the start. Tracking cookies can record all kinds of information: search queries, purchases, device information, location, when and where we saw previous Advertisements, how many times we have seen an Ad, and what links we click on.
