How ad tracking actually works (and why it's so hard to stop)

It’s not just ads…It’s your identity

Most people think ad tracking is about cookies and annoying ads. In reality, it’s something much more powerful—and much harder to escape.

Behind the scenes, companies are:

  • Collecting data from multiple sources
  • Connecting that data across devices
  • Building a persistent identity profile tied to you

This is why even after you:

  • Clear cookies
  • Use private browsing
  • Install ad blockers

…you still see eerily relevant ads. Because ad tracking isn’t just about tracking activity—it’s about tracking identity.

The building blocks of ad tracking

Ad tracking works by collecting small pieces of information and combining them into a larger picture. Here are the main ways it happens:

1. Cookies (the basics)

Cookies are small files stored in your browser that track:

  • Pages you visit
  • Items you click
  • Time spent on sites

There are two main types:

  • First-party cookies (set by the site you visit)
  • Third-party cookies (set by advertisers across multiple sites)

These allow companies to follow your activity across the web.

Device fingerprinting (the invisible tracker)

Even without cookies, your device can be identified using:

  • Browser type and version
  • Screen size
  • Installed fonts and plugins
  • Operating system

Combined, these create a unique “fingerprint”. Unlike cookies, you can’t easily delete or block this.

3. Email tracking

When you open emails, companies can track:

  • When you opened it
  • Where you were located
  • What links you clicked

This is often done using invisible tracking pixels. Your email becomes a persistent identifier tied to your behavior.

4. Phone number linking

Your phone number is one of the strongest identifiers you have. It’s often used to:

  • Link accounts across platforms
  • Match data from different sources
  • Verify and reinforce identity profiles

Once your number is connected, it becomes a backbone for tracking.

5. Cross-device tracking

Companies don’t just track one device; they track all of them. They connect your:

  • Phone
  • Laptop
  • Tablet

Using shared signals like:

  • Login credentials
  • IP addresses
  • Behavioral patterns

This creates a unified view of your activity across devices.

Privacy Iceberg

How it all comes together: Identity linking

Each of these methods alone is useful. But the real power comes from combining them. This process is called identity linking or identity stitching.

Here’s how it works:

  1. You browse a product on your laptop
  2. You log into an app on your phone using the same email
  3. You verify your account with your phone number
  4. A data broker matches these signals

Now everything is connected.

  • Your browsing behavior
  • Your purchases
  • Your interests
  • Your devices

All tied to a single identity.

Why this makes tracking so hard to stop

Most privacy tools focus on blocking individual tracking methods. But identity stitching bypasses that.

Even if you:

  • Block cookies → fingerprinting still works
  • Hide your IP → account logins reconnect you
  • Use private browsing → your email ties everything together

As long as your identity stays consistent, tracking can rebuild itself.

The shift: From tracking data to tracking people

Ad tracking has evolved. It’s no longer just about:

  • “What page did you visit?”

It’s about:

  • “Who are you across every context?”

That shift changes everything. Because instead of tracking sessions, companies now track:

  • Individuals
  • Behaviors over time
  • Patterns across platforms

Why this matters

When everything is connected:

  • Your data becomes more valuable
  • Your profile becomes more accurate
  • Your privacy becomes harder to maintain

And that data doesn’t just stay in one place. It’s:

  • Shared
  • Sold
  • Aggregated

Often without your knowledge.

The key insight: Identity is the weak point

The entire tracking system depends on one thing…a consistent identity across contexts. If that identity stays intact:

  • Data can be linked
  • Profiles can grow
  • Tracking persists

But if that identity is broken apart the system loses its power.

Where this leads next

To actually reduce tracking, you need to do more than block signals. You need to prevent your identity from being connected in the first place. That’s where:

  • Data brokers come in
  • Traditional tools fall short
  • And new approaches (like using multiple identities) become critical