Someone browses a pair of hiking boots on one site, closes the tab, and never thinks about it again. An hour later, ads for those exact boots start appearing on a completely different website. Nothing about that felt like a coincidence, because it wasn’t one. Cookie tracking made the connection possible.

What does “cookie tracking” mean?

Cookie tracking means a website uses small text files, called cookies, to remember a visitor. It then follows that visitor’s activity across pages or sites. A cookie can store a login session or a shopping cart. It can also hold a unique ID that lets advertisers recognize the same browser later. Not every cookie tracks someone for advertising. Some just make a site function properly. The term applies once cookies get used to build a profile of behavior over time, not just to remember one session.

Where did the term come from?

The cookie itself dates to 1994. An engineer built it to solve a simple problem: websites couldn’t remember anything about a visitor between page loads. The name came from “magic cookie,” an older programming term for a small piece of data passed between programs. Advertisers soon realized the same mechanism could track browsing habits across many sites, not just one. That expanded use is what eventually made “cookie tracking” its own contested phrase.

How does cookie tracking actually work?

A first-party cookie comes from the site someone is actually visiting. It handles things like login status or cart contents, and it generally stays on that one site. A third-party cookie works differently. An ad network embeds it across thousands of unrelated sites. That lets the network recognize the same browser everywhere it has a presence.

Cross-site recognition is the entire mechanism behind the boots-that-follow-you effect. An ad network spots the same visitor ID on the hiking site and a news site visited later. It matches the two, then serves an ad based on that earlier browsing behavior. No website needed to share anything directly with another for this to work.

Browsers and regulators have both pushed back on third-party cookies specifically. They’re the part that enables tracking across unrelated sites. First-party cookies rarely draw the same criticism, since their function stays contained to the site that set them.

A concrete example

A shopper compares two pairs of hiking boots across several retail sites in one afternoon. Over the next several days, ads for those same boots start appearing on unrelated news sites and social feeds. Similar boots from other brands show up too. None of those sites sell footwear. They’re just running ad space through networks that placed tracking cookies during the original shopping session.

What it’s not

Cookie tracking isn’t the same as a data breach. Information here moves through an agreed advertising system rather than an unauthorized leak. It’s also not identical to a data broker’s work, though the two often connect, since brokers sometimes buy data that originated from cookie-based tracking. And it isn’t malware or a virus. A cookie is just a small text file. It can’t run code or damage a device on its own.

Where you’ll encounter it

Cookie-consent banners and browser privacy settings mention the term constantly. News coverage of regulations like GDPR, which require sites to disclose and get consent for tracking, brings it up too. And it surfaces whenever someone notices an ad following them across sites with no obvious connection to each other, long after they closed the original tab and moved on.

Related terms

• Shadow Banning (L24)
• Algorithmic Bias (L25)
• Data Broker (L26)