The Half of Tracking That Lives on Your Machine

Fingerprinting reads your device. Cookies and storage put something on it. Both follow you — and the difference decides what "clear my data" actually clears.

4 min readNot yet reviewed

Wrenlearner

Last lesson you said fingerprinting needs nothing stored. So what is actually stored, then? What am I clearing when I "clear my data"?

Rookmentor

Good question, and most people cannot answer it. There are two kinds of cookie, and only one of them is the problem.

First-party versus third-party

A cookie is a small note a site asks your browser to keep and hand back next time. The site's own cookie — first-party — is what keeps you logged in and remembers your cart. Useful, and yours. The tracking cookie is third-party: set not by the site you are visiting but by something embedded in it.

1You visit news.example (first party)
2  news.example sets: session=... (keeps you logged in — fine)
3  embedded ad from tracker.ad sets: id=7f3a... (third party)
4
5You visit shop.example, unrelated
6  it also embeds tracker.ad
7  tracker.ad reads back id=7f3a...  -> "same person, now shopping"

Line 2First-party: the site you chose, remembering you. This is the good and necessary kind.
Line 3Third-party: the same tracker embedded on both sites, so its one cookie links your visits. This is the mechanism, not the fine print.
Line 7No login required. The shared third party recognises its own note and stitches your two visits into one profile.

Browsers are now blocking third-party cookies by default. Problem solved?

Cookies are not the only thing stored

"Clear cookies" misses the rest of the cupboard. Browsers also keep localStorage, IndexedDB, cache, and service workers — each a place an identifier can hide and be read back later. This is why "delete cookies" is not the same as "start fresh".

The storage a single site can hold, beyond cookies

# in a browser's dev tools, under Application > Storage
Cookies         : 4
Local Storage   : 11 keys  (one is a 32-char id...)
IndexedDB       : 2 databases
Cache Storage   : 38 MB
Service Workers : 1 registered
# clearing only cookies leaves the id in Local Storage untouched

You are logged into your email. You delete all third-party cookies to stop tracking. What happens to your email login?

What "clear my data" should mean

The illusion of a clean slate

- Delete cookies only
- Assume private mode wipes everything on close (it wipes storage, not your
  fingerprint)
- Forget that cache and service workers persist

Actually resetting

- Clear cookies AND site storage (localStorage, IndexedDB, cache)
- Block third-party cookies as the standing default
- Remember the un-clearable part is the fingerprint — for that, blend in
- For a real reset against a real adversary, a fresh browser profile or Tor

Storage-based tracking you can delete; device-based tracking you can only blend into. Knowing which is which is the whole skill.

Wrenlearner

So there are two problems, and clearing data only touches one.

Magpieadversary

Exactly. Take away my cookies and I reach for your fingerprint. Take away both and I reach for the account you logged into. It is layers, and you now know the bottom two.

Legal

This explains how your own browser stores and reveals data, so you can control it. Extracting or correlating other people's stored identifiers without authorisation is out of bounds.

So: cookies and storage are the tracking you can delete, and third-party cookies are the part worth deleting. Pair "block third-party, clear storage, stay logged in where you want" with the fingerprinting defence of looking ordinary, and you have covered how the browser follows you. Next: private browsing — what "incognito" actually clears, and the much longer list of things it quietly does not.