Skip to content
ScanMyPrivacy
Menu

Privacy and leak tests

Full Privacy ScanDNS Leak TestWebRTC Leak TestBrowser Fingerprint TestAm I Using a VPN?HTTP Headers ViewerUser Agent CheckerOpen Port Checker

Online safety assistant

Website Safety CheckerSuspicious Link CheckerScam and Phishing Message CheckerBrowser Security GuideMobile App Safety CheckPersonal Security Checkup

IP and network lookups

IP LookupMy IP LocationWhat Is My Public IP?What Is My IPv6 Address?Reverse DNS LookupDNS Lookup
Online safety Guides API About

Tracking

How Websites Track You Without Cookies

Updated · 2 min read

Written by the ScanMyPrivacy team. How we write and check guides · Report a correction

Try it yourself:Browser Fingerprint TestHTTP Headers ViewerFull Privacy Scan

Blocking third-party cookies helps, but it does not stop tracking. Advertisers and analytics companies have a toolbox of other methods that identify you across websites. Here are the main ones.

1. Your IP address

Every request carries your public address. It does not identify you alone, because households and mobile users share addresses, but combined with other data it links your visits. Our home page shows what sites see, and a VPN changes it (see how to hide your IP).

2. Browser fingerprinting

Scripts read your screen, fonts, graphics card and other details to build an identifier with no stored data. It survives cleared cookies and private mode. See what browser fingerprinting is.

3. Tracking IDs in links

Ad platforms add click identifiers to URLs, for example fbclid or gclid, that can be attached to your activity on the destination site. Some browsers strip known tracking parameters automatically. You can also remove them by hand before sharing a link.

4. Logging in

When you sign in, a site knows who you are. Many sites then pass a hashed version of your email address to advertising partners, which lets them link your activity across devices and sites even without cookies.

5. First-party and server-side tracking

Blockers target well-known third-party domains. Sites can move analytics to their own domain, or use a server-side setup or DNS tricks (CNAME cloaking) so that tracking looks like part of the site. Browsers and blockers are adapting, but it is an ongoing contest.

6. Browser storage other than cookies

localStorage, IndexedDB and cached files can hold identifiers too. Clearing "cookies" alone may leave them. Browsers have been partitioning this storage per site to limit its use for cross-site tracking.

7. Cache and network-level tricks

Past techniques used browser cache behaviour or the way resources load to recognise returning visitors. Modern browsers partition caches by site, which removes most of this.

How to limit it

  1. Use a browser with built-in tracking protection: Firefox, Brave or Safari. Keep it updated.
  2. Turn on Global Privacy Control. It tells sites not to sell or share your data and is legally binding in some US states. Firefox, Brave and DuckDuckGo send it by default or on request, and extensions add it elsewhere. Our privacy scan checks that it is on.
  3. Block trackers with a reputable content blocker.
  4. Use a VPN to mask your IP address, bearing in mind it does not stop fingerprinting.
  5. Separate browsing: use different browsers or profiles for logged-in accounts and for general browsing.
  6. Check yourself. See exactly what your browser sends with the headers viewer and fingerprint test.

Tools that can help

Privacy-focused browsers

What it does: Block many trackers by default and reduce some fingerprinting. What it does not do: Make you anonymous. Logging in, cookies you accept and unusual settings can still identify you.

  • FirefoxFreeNo commissionOpen-source browser with tracking protection built in. Visit site
  • BraveFreeNo commissionChromium-based browser with built-in tracker and ad blocking and some fingerprinting defences. Visit site

Browser extensions

What it does: Block ads and trackers, or help manage passwords inside the browser. What it does not do: Come without risk: every extension can read pages you visit, so install few and only well-known ones.

  • uBlock OriginFreeNo commissionOpen-source content blocker for ads and trackers. Works best on Firefox and desktop Chromium browsers. Visit site
  • Privacy BadgerFreeNo commissionFree extension from the Electronic Frontier Foundation that learns and blocks trackers. Visit site

We list free and built-in options first. How we choose.

Keep reading

What Is Browser Fingerprinting?Browser fingerprinting identifies you without cookies by combining screen size, fonts and graphics. How it works, who uses it and how to reduce it.How to Hide Your IP AddressFive practical ways to hide your IP address, from VPNs and Tor to proxies and hotspots: what each protects, what it does not, and how to verify.What Is an IP Address?What an IP address is, how it works, what websites can learn from yours and what they cannot. Explained simply, with a tool to see your own.Canvas Fingerprinting ExplainedHow canvas fingerprinting works, why the same drawing produces different pixels on different devices, who uses it, and how browsers defend against it.How to Prevent Browser FingerprintingPractical ways to reduce browser fingerprinting: the browsers and settings that help, the tricks that backfire, and how to test whether your changes worked.Static vs Dynamic IP AddressStatic IPs stay the same, dynamic IPs change. How each works, why providers use dynamic addresses, and what it means for privacy and hosting.

Frequently asked questions

Does private browsing stop tracking?

It stops your own device from keeping history and cookies afterwards. Sites can still see your IP address and fingerprint during the session.

What is Global Privacy Control?

A browser signal (Sec-GPC: 1) that asks websites not to sell or share your personal data. Some laws, such as California's CCPA, require sites to treat it as an opt-out.