A guide to browser privacy

Websites can track users through first-party accounts, cookies, embedded third parties, tracking pixels, browser fingerprinting, IP addresses, tagged links, and server-side records. Some tracking supports essential functions or security; other tracking connects activity for analytics, advertising, attribution, or profiling. The method and purpose matter as much as the word “tracking.”

What can a website know about you?

A website typically receives information needed to establish a connection and deliver a page. Depending on the site, browser, permissions, account state, and embedded services, it may also observe:

• the IP address and approximate network location;

• browser and operating-system information;

• language, time zone, screen, and device characteristics;

• pages viewed, links clicked, and referral source;

• cookies and other browser storage;

• account identity and activity when signed in;

• information submitted through forms, searches, purchases, or messages;

• advertising and analytics identifiers;

• combinations of characteristics used for browser fingerprinting.

Not every website collects every signal. A reliable privacy notice should explain what is collected, why, how long it is retained, and which parties receive it.

First-party tracking

First-party tracking is measurement performed by the website or service the user intentionally visits. It can remember a cart, keep an account signed in, detect fraud, measure which pages are useful, or personalize content.

First-party does not automatically mean harmless. A large signed-in platform can connect activity across many sessions, devices, and services. Users should distinguish a necessary function from optional profiling and review the service's controls and privacy policy.

Third-party cookies

Third-party cookies are created or accessed by a domain other than the site shown in the address bar. When the same third party appears on many websites, a cookie can help recognize the same browser across those sites.

Browsers can block or partition third-party storage to make cross-site linkage harder. This may affect embedded logins, payment tools, maps, videos, or customer-support widgets, so useful controls should support narrow site exceptions.

Follow the practical guide to block third-party cookies on Android.

Tracking pixels and embedded resources

A tracking pixel is usually a tiny image or network request loaded from a page, email, or message. When it loads, the receiving server can record information such as the time, IP address, browser details, referring page, and an identifier included in the request.

Pixels are not limited to visible images. Scripts, fonts, ads, social buttons, video players, and other embedded resources can also create requests to third-party domains. Tracker blockers identify and restrict supported resources based on known lists, patterns, or browser rules.

Tracking scripts

JavaScript can measure page views, clicks, scrolling, form interactions, errors, media playback, advertising events, and device capabilities. Some measurement improves usability or security; some creates detailed behavioral profiles.

Blocking every script would break much of the modern web. A practical browser therefore needs targeted tracker protection and understandable site-level controls rather than a single indiscriminate block.

Browser fingerprinting

Browser fingerprinting combines characteristics exposed by a browser and device to create a pattern that may recognize the same environment again. Signals can include language, time zone, screen settings, fonts, Canvas output, WebGL behavior, audio processing, and browser APIs.

Fingerprinting can work without a traditional stored cookie, which is why clearing cookies or opening a private window does not necessarily stop it. Read what browser fingerprinting is and how browser fingerprinting protection can reduce supported risks.

IP addresses and network information

A website generally receives the IP address used to connect to it. The address can reveal the network provider and an approximate location, although accuracy varies. Networks, DNS services, proxies, and VPNs may also process connection information.

Changing an IP address does not automatically change cookies, account identity, or browser fingerprints. Network privacy and browser privacy are related but distinct layers.

Link tracking and redirect parameters

Links can include campaign, affiliate, click, or user identifiers. When a person follows the link, the destination can record those parameters and connect the visit with a campaign or source.

Redirect services can add another observation point. A link first passes through an intermediary, which records the click before sending the browser to the final destination. Removing unnecessary tracking parameters can reduce this data, but some parameters support legitimate attribution or site functions.

Signed-in account tracking

When users sign in, the service can associate activity with the account regardless of whether the browser is in private mode. A browser cannot make a signed-in YouTube, social-network, email, or shopping account anonymous to the company operating that account.

Separate browsing contexts can reduce accidental mixing of activities, but they do not override the identity intentionally provided to a service.

Server-side tracking

Not all tracking code is visible in the browser. A first-party server can record requests and send selected events to another system from the server side. This can make browser-level blocking less effective because the third party may not appear directly in the page.

Server-side systems still have to operate under applicable policies, contracts, and laws. From a user's perspective, transparency and data minimization remain important because browser controls alone cannot inspect every downstream use.

Does private or incognito mode stop website tracking?

Private mode mainly changes what the browser stores locally for that session. Websites can still receive connection information, observe page activity, identify signed-in accounts, and potentially use fingerprinting. The exact cookie and tracker protections vary by browser.

Private mode is useful for limiting local history on a shared device. It should not be described as complete online anonymity.

How to reduce website tracking

Use several layers rather than relying on one switch:

1. Choose a browser with documented tracker, cookie, and fingerprinting controls. Verify defaults and limitations.

2. Keep the browser and operating system updated. Protections and web compatibility change.

3. Restrict third-party cookies. Use site exceptions only when a trusted function requires them.

4. Review site permissions. Limit location, camera, microphone, notifications, and other sensitive access.

5. Audit extensions. Remove unused extensions and avoid unnecessary broad permissions.

6. Separate signed-in and sensitive browsing when useful. Do not assume private mode hides an account identity.

7. Avoid unnecessary tracking links. Remove optional campaign parameters before sharing URLs.

8. Read privacy policies for important services. Browser controls cannot prevent every first-party or server-side use.

9. Use a trustworthy network layer when the IP address is part of your concern. Understand that it does not replace browser protections.

Online tracking methods compared

How Quetta approaches browser privacy

Quetta Privacy Guard combines supported tracker prevention, cookie controls, fingerprinting protection, secure-connection preferences, site permissions, script controls, GPC signaling, and protected local browser data. Exact behavior can differ by platform and version, so review the current settings and documentation rather than relying on a general privacy label.

Explore Quetta Privacy Guard, or see how the controls fit into a private browser for Android.

Frequently asked questions

Can websites track what I do on other websites?

They may be able to connect activity when the same third party, account, identifier, or fingerprint is present across sites. Blocking cross-site cookies and known trackers can reduce this, but signed-in services, first-party systems, fingerprinting, and server-side data may create other links.

Can websites track me if I reject cookies?

Rejecting optional cookies can reduce cookie-based tracking, but it does not necessarily stop fingerprinting, IP-address logging, signed-in activity, server records, or information submitted directly. Cookie choice is one privacy layer, not a universal opt-out from every data flow.

Can a website see my browsing history?

A normal website cannot simply read the browser's complete history. It can observe activity on its own pages and may infer or connect other activity through accounts, trackers, links, embedded third parties, or fingerprinting. Browser vulnerabilities or excessive permissions create different risks.

Does deleting browser history stop tracking?

Deleting local history removes a record stored in the browser, but it does not delete copies held by websites, account providers, analytics systems, network operators, or other services. It also does not necessarily change a browser fingerprint.

Is all website tracking bad?

No. Some measurement is necessary for sign-in, security, payments, reliability, and understanding whether a page works. The important questions are whether collection is proportionate, transparent, secure, limited in duration, and under meaningful user control.