Betrayed by Your Browser: How Third-Party Tracking Systems Are Following You Online and What to Do

Security researcher Mike Landeck opens with his research into third-party trackers on websites where people look for health help, which he says turned up 187 distinct ways a browser can be followed. He explains the basics first: cookies, hidden iframes, zero-pixel image requests, and browser fingerprinting built from details such as the user agent, screen size and default font. He points out that tracking usually depends on weakening protections a healthy cookie should have, including expiry, encryption, HttpOnly, and same-site scope.

He then walks through a case study of a family-planning website, where one page load produced hundreds of requests to dozens of domains, many of them tracking services. Some of the outside content came from a component with a known exploitable flaw, so a trusted site inherits the risk of every third-party script it loads. He compares browsers and notes that Brave's fingerprint protection can break sites that use fingerprints for session handling, which is why he personally favours Firefox with privacy extensions and a VPN, while accepting that these are only partial layers.

For AppSec and privacy teams, the closing advice is to treat tracking code as part of design, privacy impact assessments and testing, to check tags against the EFF's published tracker list, to use Content Security Policy to restrict what scripts can do, and to re-review third-party code after release. He also shows simple configuration changes, such as anonymizing IP addresses in Google Analytics.