Skip to main content
Panopticlick

How Online Tracking Works

CLASSIFIED
top secret

Anatomy of Tracking

Dissecting the surveillance machinery piece by piece

November 30, 2025

Every time you open a browser, you broadcast hundreds of data points about yourself. Advertisers, data brokers, and surveillance systems have built an entire industry around collecting these signals. Here's exactly how they do it.

"The best way to defeat a system is to understand it completely."— Security Researcher Axiom

Tracking Techniques Exposed

The Tracking Ecosystem

┌─────────────────────────────────────────────────────┐
│                  YOUR BROWSER                        │
│  ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌───────────┐  │
│  │ Canvas  │ │ WebGL   │ │ Audio   │ │ Behavior  │  │
│  └────┬────┘ └────┬────┘ └────┬────┘ └─────┬─────┘  │
│       │           │           │             │        │
│       └───────────┴───────────┴─────────────┘        │
│                       │                              │
│              [FINGERPRINT HASH]                      │
└───────────────────────┬─────────────────────────────┘
                        │
                        ▼
┌─────────────────────────────────────────────────────┐
│               DATA COLLECTION LAYER                  │
│  ┌─────────────┐ ┌─────────────┐ ┌─────────────┐   │
│  │ 1st Party   │ │ 3rd Party   │ │ Supercookie │   │
│  │ Trackers    │ │ Scripts     │ │ Mechanisms  │   │
│  └─────────────┘ └─────────────┘ └─────────────┘   │
└───────────────────────┬─────────────────────────────┘
                        │
                        ▼
┌─────────────────────────────────────────────────────┐
│                 DATA BROKER NETWORK                  │
│         $0.005 - $0.50 per profile per day          │
└─────────────────────────────────────────────────────┘

Quick Stats

99.7%
Browsers are Uniquely Identifiable
$200B+
Annual AdTech Market Size
80+
Fingerprinting Dimensions
Intel Report
Handle with Care

The $595 Billion Industry Built on Your Data

Let's put some numbers on this. The global programmatic advertising market hit $595 billion in 2024. That's the industry built on tracking you. The industry that needs to know who you are, where you go, what you buy, and what you think.

Every major website participates. Google, Facebook, Amazon — obviously. But also news sites, shopping sites, game sites, weather apps, fitness trackers. If it's free, you're not the customer. You're the product.

The tracking industry has evolved faster than regulation can keep up. While lawmakers debate cookie consent banners, the industry moved to fingerprinting. While privacy advocates push for transparency, data brokers operate in shadows.

The Tracking Industry by Numbers

MetricValueYear
Global programmatic ad market$595B2024
Data broker industry size$319B2024
Average data points per user profile1,500+2023
Websites using fingerprinting25%+2024
Third-party trackers on avg. website172024

Sources: eMarketer, Statista, Princeton WebTAP, DuckDuckGo Privacy Research

How Tracking Has Evolved

The first web trackers were simple. A cookie with a unique ID, sent to an ad server on every page load. Easy to understand, easy to block. Delete your cookies, and the tracking stopped.

Then came third-party cookies — cookies set by domains other than the one you're visiting. Suddenly, one tracker could follow you across millions of websites. But browsers started blocking these, and users installed ad blockers.

The industry adapted. Fingerprinting emerged as the cookie alternative. Instead of storing an ID on your device, it calculates an ID from your device's characteristics. No storage, no consent required, no way to delete.

Evolution of Web Tracking

1994
Cookies invented — Simple text files stored by browsers
2007
Flash cookies — Persistent tracking via Adobe Flash (now dead)
2010
Canvas fingerprinting — EFF publishes Panopticlick research
2014
AudioContext fingerprinting — New dimension discovered
2018
GDPR enacted — Cookie consent banners appear everywhere
2020
Third-party cookie death — Browsers start blocking by default
2024
Fingerprinting dominates — Cookie alternative goes mainstream

The Three Pillars of Modern Tracking

1. Browser Fingerprinting

Your browser is unique. The combination of your screen resolution, installed fonts, timezone, language, plugins, and hardware configuration creates a fingerprint that identifies you among billions of users. No cookies required. Works in private browsing. Can't be deleted.

2. Supercookies

Supercookies exploit browser features to store persistent identifiers. HSTS supercookies abuse security features. Favicon caching creates unique patterns. ETag headers store identifiers server-side. These survive cookie deletion, private browsing, and sometimes even browser reinstallation.

3. Behavioral Analysis

How you type, how you move your mouse, how you scroll — these create a behavioral signature as unique as a fingerprint. Machine learning can identify you from a few seconds of interaction. No personal data needed, just patterns.

What Happens to Your Data

Tracking is just the first step. Your data enters a complex ecosystem of buyers and sellers:

  • Data brokers buy and sell user profiles. Companies like Acxiom, Oracle, and LiveRamp maintain profiles on billions of people.
  • DSPs (Demand-Side Platforms) help advertisers bid on users in real-time auctions.
  • DMPs (Data Management Platforms) combine data from multiple sources to create comprehensive profiles.
  • Credit bureaus integrate browsing data with financial information.
  • Insurance companies use data to assess risk and set premiums.
  • Political campaigns target voters based on their digital profiles.

Your browsing history, combined with purchase data, location data, and social media activity, creates a profile that knows you better than you know yourself. And this profile is bought and sold thousands of times per day.

See Your Fingerprint

Run our browser fingerprint scan to see exactly what data you're exposing and how unique your browser is.

Run the Fingerprint Scan →