A consumer guide to web tracking

Dear Consumers,

It is nearly impossible to browse the web without triggering cookies and other tracking tools.  Hidden in nearly every website, these technologies allow businesses to offer features we use every day. 

But advertising companies can also use these technologies to follow your activity online by recording the webpages you visit, the links you click, and the items you add to your shopping cart. They can share, sell, or combine this information with other information about you, like your address or information about other members of your household. Using your personal information, businesses can develop and send you highly targeted ads. 

The good news is that you can take steps to protect your privacy. We created this guide to help you manage how businesses monitor you online. 

Sincerely,
New York State Attorney General Signature
Headshot of Attorney General Letitia James

Contents

How do websites track me?
What is a cookie pop-up?
How can I use cookie pop-ups?
How else can I limit online tracking?

How do websites track me?

Most tracking on the web relies on cookies, small text files created by your web browser when you visit a website. Cookies often contain an ID unique to your device. This ID helps online services recognize you as you click from one webpage to the next. The information companies collect through cookies can then be used to target ads specifically to you.  

Here's how it works:

blank webpage with URL bestshoes.com

1. You open a web browser and type in the web address of your favorite shoe store, Best Shoes.

Mock shoe shopping website

2. The Best Shoes webpage loads. 

Mock shoe shopping website with cookies and personalized ads

3. Code on the webpage visible only to your browser tells your browser to connect to a service run by an ad company, XYZ Ads.  

Mock shoe shopping website with cookies and personalized ads

4. XYZ Ads sends back a cookie with a unique ID. Your browser saves the cookie. 

Mock shoe shopping website with cookies and personalized ads

5. Later, you check the news on The World News website. The World News webpage loads with space for an ad. The World News webpage also contains code directing your browser to the XYZ Ads service. Your browser sends XYZ Ads the cookie it saved earlier.

Mock news website with cookies and personalized ads

6. XYZ Ads recognizes the cookie ID and knows you previously visited the Best Shoes website. XYZ Ads sends an ad for shoes to your browser, which is added to the World News webpage.  

What is a cookie pop-up?

A cookie pop-up is a pop-up box or banner that contains information about the cookies and other tracking technologies used when you visit a website. These pop-ups often appear the first time you visit a website. There are three ways that websites commonly use these pop-ups: 

Colored box with text: This website uses cookies to enhance and personalize your experience. For more information about our collection and use of your information, including our use of cookies, please check out our privacy policy.

Informational: Provides information about the cookies that are used or data that is collected while on the website. Clicking on a button dismisses the pop-up, but does nothing more.

Cookie Opt-Out example

Opt-out: Allows you to opt out of certain types of tracking. Opting out typically requires clicking on a button or link, which opens a window with controls that can be used to turn off certain cookies, like those used for advertising or social media. 

Colored box with text: We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking “Accept”, you consent to the use of ALL the cookies. You may visit Cookie settings to provide a controlled consent. Cookie Policy

Opt-in: Asks for your consent to use cookies or other forms of tracking, or to collect and use your data. The buttons may be labeled “Accept” and “Reject” or use similar language. Clicking on an “Accept” button is one way to give consent. 

How can I use cookie pop-ups to protect my privacy?

Some websites offer controls that can be used to disable cookies and other tracking technologies. These privacy controls can be useful, but they have limitations. Here are some things you should know about website privacy controls:

  • Opt-in vs. opt-out vs. informational only: Different websites handle cookie options in different ways. Be sure to read the website’s cookie banner or privacy notice carefully to understand your options. 
  • You may not be able to disable all cookies: Some websites let you choose which cookies to allow. But you will probably not be able to disable cookies that are necessary for the site’s operation.    
  • Opting out won’t delete existing cookies: On many websites, tracking cookies are created the moment the webpage loads. When you opt out of tracking, it may stop the website from creating new cookies, but it will not delete the cookies that already exist. This means you can receive targeted ads even if you have opted out!
  • Website privacy controls are not perfect: In a recent investigation, our office identified more than a dozen websites with broken privacy controls. While those controls have been fixed, other websites may have broken controls.
  • Websites may have other ways of tracking: Cookies are not the only way to track you online. For example, device fingerprinting can be used to uniquely identify your device by combining technical information the device shares with websites. A website’s privacy controls may not be configured to stop these other forms of tracking.
Gray box with text: Cookie Preferences, This website uses necessary cookies to make it work. We also like to set optional “performance” cookies to gather anonymous website visitation data and “marketing” cookies to help us understand which content visitors value most. By enabling these cookies, you can help us provide a better website for all users. For more information, view our cookie notice.

Pop-up showing users are unable to disable all cookies

What else can I do to limit online tracking?

Stopping online tracking completely can be challenging, but here are a few straightforward steps you can take to help protect your privacy: 

  • Use browser controls: Most web browsers offer privacy settings you can configure. 
    • One option is to block cookies. You probably don’t want to block all cookies, because that can prevent websites from functioning correctly. But you may be able to block third-party cookies while allowing cookies from the websites you visit (first-party cookies) without major issues. Some browsers, like those offered by Mozilla, Apple, and Brave, disable third-party cookies by default.  
    • You can also use your browser to delete existing cookies.
  • Use ad blockers and other browser plugins: You can download and install browser plugins to block ads, cookies, or other tracking technologies. A couple of things to keep in mind:
    • Using browser extensions to block ads or tracking technologies can affect some of the webpages you visit.
    • Browser extensions can have access to the webpages you visit and information you enter on those pages. So download only extensions you trust.
  • Disable browser-based tracking: Many companies are exploring ways to track users online without cookies. For example, a browser can monitor a user’s online activity to identify the user’s interests. The browser can then share that information with websites and other third parties as the user browses the web. You should be able to turn off this functionality using the privacy settings within the browser.

 

Last updated July 15, 2024.