What is Cross-Site Tracking?

No single website knows much about an anonymous visitor. But a tracker embedded across thousands of sites sees the same browser everywhere: the news articles read, products browsed, prices compared, videos watched. Linked by a common identifier, those observations become a longitudinal behavioral profile — the raw material of programmatic advertising, audience segments, and data-broker files.

The classic mechanism was the third-party cookie, but the technique long ago diversified: tracking pixels that report page context to a central server, browser fingerprinting that derives a stable identifier from device characteristics, link decoration that passes IDs through URLs, and identity graphs that join activity through hashed email addresses collected at login or checkout.

Privacy law treats cross-site tracking as a distinct harm. The CPRA created a named category for it — 'cross-context behavioral advertising' — and gives Californians the right to opt out of having their data 'shared' for that purpose, a right also delivered through the Global Privacy Control browser signal. EU rules require opt-in consent before the underlying trackers run. Browser vendors, meanwhile, treat it as an adversary: Safari and Firefox block third-party cookies and fight fingerprinting by design.

For businesses, the operative question is not whether you think of yourself as a tracker but whether data about your visitors flows to parties who can combine it with data from other sites. If it does, opt-out rights, consent requirements, and disclosure obligations all attach.