A single invisible image can record that you opened a page. Here is how tracking pixels worked with third-party cookies, what browsers changed, and what replaced them.
On this page
An image one pixel wide loads, and you never see it. A record is written, and you never agreed to it.
The most effective tracking tool on the web is also the least impressive to look at: a one-by-one pixel image, invisible on the page, that phones home the moment it loads. What that tiny request carries explains why so much of online tracking changed in recent years — and why the change was smaller than it first appeared.
What a tracking pixel is
A tracking pixel is an image tag, often an empty or transparent GIF, that points to a domain other than the one you are visiting. Because it is an image, the browser fetches it automatically. That single request is the payload.
Everything useful travels in the request itself: the address of the server, the page you are on, the referring page, the time, and any identifier the server has previously set for you. The server records it and now knows that this identifier was present on this page at this moment.
How third-party cookies tied it together
A pixel alone records one event. The thread that linked many events into a person was the third-party cookie. An advertising or analytics domain sets a cookie on its own address, then asks every participating site to include a pixel that points back to it. Each time the pixel loads, the browser attaches that domain’s cookie, and the server matches the visit to an existing identifier.
What the browsers changed
Browsers attacked the cookie layer rather than the pixel. Safari and Firefox blocked third-party cookies by default years before others did; more recently Chrome moved in the same direction, ending the long run of a cookie that could follow you between unrelated domains. Consent rules added another pressure, requiring many sites to ask before non-essential cookies were set at all.
What the change achieved
- The identifier that linked pixels across unrelated sites was removed
- Sites must ask before non-essential cookies are set
What it left in place
- The pixel itself still loads and still records
- A site can still record what happens on its own pages
Blocking the cookie removes the identifier that made pixels so valuable across sites, but it does not remove the pixel. Confirm what your browser still permits with the cookies enabled test, which shows whether storage functions at all.
How tracking filled the gap
When the shared cookie went away, trackers rebuilt the chain.
- First-party cookies set by the site you are visiting. A server can place its own cookie, then pass the identifier it holds to its partners behind the scenes. From the browser’s point of view there is no third party at all.
- Server-side tracking. Code on the site’s own server sends events directly to an advertising platform, so no browser request is ever made to that platform’s domain. There is nothing in the page for a blocker to catch.
- Server-to-server connections. Two servers exchange data between themselves, entirely outside your browser, using identifiers exchanged earlier through some other route.
- Fingerprinting as the fallback. When an identifier is deleted, a browser fingerprint can recompute a stable one from the device itself and reattach the history.
Each of these moves the identifying work one step away from the place you can see and control: enforcement pushes tracking out of the browser, and it reappears on the server.
What you can still do
The visible pixel is now the easiest thing to block and the least important part of the chain.
- Block the requests you can see. Content blockers stop pixels and third-party requests before they load, and an ad block detector tells you what your setup is actually blocking — useful, because a blocker with the wrong list enabled may be doing less than you think.
- Isolate what remains. Browsers that partition or clear cookies between sites limit how far a first-party identifier travels.
- Reduce the fingerprint fallback. Since the fingerprint is what reclaims you after a deletion, joining a large, ordinary crowd of browsers is the more durable defence, as covered in how to reduce your fingerprint.
Blocking pixels makes the visible machinery of tracking stop working, which is worth doing. But the identifier that matters most is now less likely to live in your browser at all, and assuming cleanup is the whole battle is the mistake this history keeps repeating.
The checklist to keep
- Block what you can see. Run the ad block detector to see what your browser is filtering.
- Check what storage remains. The cookies enabled test shows what a site can still set.
- Shrink the fingerprint. The device is the fallback identifier, so it is worth making ordinary.