Tracking

What cross-site tracking actually is

Cross-site tracking is the practice of recognising the same browser across unrelated websites and combining that activity into one profile. It usually needs two things: a stable identifier, and a party present on many sites to observe it.

Tracking pixels

A tracking pixel is a tiny image — often one transparent pixel — loaded from a third-party server. The image is irrelevant; the request is the point. It carries a cookie, your IP address, the page you were on via the referrer, and any identifier appended to the URL. Pixels work even when scripts are blocked, which is why they remain popular.

The identifiers in your links

Look at a link from a newsletter or a social post and you will often find parameters that have nothing to do with the content:

• utm_source, utm_medium, utm_campaign — campaign attribution
• gclid — Google click identifier
• fbclid — Meta click identifier
• msclkid — Microsoft click identifier
• mc_eid — Mailchimp subscriber identifier, which can identify you specifically

These often survive being shared. Forwarding a link with mc_eid in it can hand the recipient an identifier tied to your email address. Stripping them is usually safe — but only the known ones. Removing arbitrary parameters breaks pagination, search, and checkout flows, which is why Sessyn only removes parameters it has evidence for.

What a tracker can and cannot see

Be precise about this, because overstatement is how privacy advice loses credibility. From a third-party request, a tracker typically observes:

Observed	Not observed from that request alone
Your IP address	Your name, unless you told them
The page URL, via the referrer	What you typed on the page
Their own cookie identifier	Other companies' cookies
Your browser and OS	Files on your computer
Rough location from IP	Precise location without permission

A cookie holds an identifier, not a dossier. The dossier — if one exists — lives on that company's servers, keyed to the identifier. This is why Sessyn says an identifier "may allow the provider to associate this browser with information stored on its servers" rather than claiming to know what that information is.

Last reviewed: 2026-09-12