Advertisers don’t need your name to know a surprising amount about you. By combining signals like the sites you visit, your device details, approximate location, and in-app behaviour, adtech companies can infer interests, income brackets, shopping intent, and even whether you’re likely to subscribe, churn, or travel soon. If you’re searching for how advertisers track users, the short version is that tracking is rarely one tool—it’s a stack of technologies working together across websites, apps, and data partners. This article breaks down the most common methods, how profiles are stitched together, and what actually reduces exposure in the real world. You’ll also see where a VPN helps (and where it doesn’t), so you can make practical choices without falling for “one-click privacy” myths.
What a “user profile” means in modern advertising
Common identity signals advertisers try to collect
- Device and browser details (model, OS, language, screen size)
- Network identifiers (IP address, ISP, rough location)
- Web activity (pages viewed, searches, clicks, time on site)
- App activity (events like “added to cart”, “watched video”, “installed app”)
- Persistent IDs (cookies, mobile ad IDs, hashed emails)
- Purchase and demographic inferences (likely age range, interests, intent)
Why profiles are valuable
Profiles drive targeting (who sees an ad), measurement (whether it “worked”), and optimisation (who to bid more for). Most large ad platforms operate in milliseconds: an ad request can trigger an auction, select a creative, and load a personalised message in under a second. The more a platform “knows” about a user, the more confidently it can price impressions and predict conversions.
The main ways advertisers build detailed profiles
1) Cookies and tracking pixels (still everywhere)
Cookies are small pieces of data stored by your browser. First-party cookies help sites remember settings or login sessions. Third-party cookies (set by an embedded domain like an ad or analytics provider) historically enabled cross-site tracking—following you from one site to another. Even as third-party cookies face restrictions in modern browsers, many tracking pixels still work by recording page views and events, then connecting them to an identifier (cookie ID, hashed email, or another token). If you’ve wondered how advertisers track users across multiple sites, pixels and cookie-linked IDs are a big reason.
- Retargeting: you view a product on Site A, then see ads for it on Site B
- Conversion tracking: a “purchase” event is reported back to an ad platform
- Attribution: platforms estimate which ad or click led to an action
2) Mobile advertising IDs and app SDKs
On mobile devices, advertisers commonly rely on platform-provided advertising identifiers (for example, Apple’s IDFA and Google’s Advertising ID). Apps often include third-party SDKs for analytics, ads, crash reporting, and marketing attribution. Those SDKs can collect app events and device signals and share them with partners. Privacy controls like “Limit Ad Tracking” or “Ask App Not to Track” can reduce this, but they don’t stop all data collection—especially if an app can use first-party account data or other identifiers.
3) IP address tracking and location inference
Your IP address reveals your rough location and your ISP and can be stable enough to act like an identifier, particularly on home broadband. Advertisers can use IP-based signals to detect returning visitors, reduce fraud, localise ads, and infer household-level behaviour. This is one area where a VPN can meaningfully change what ad networks see by replacing your public IP with a VPN server’s IP. However, IP masking alone doesn’t stop cookies, fingerprinting, or logged-in tracking—so it’s only one piece of the puzzle in how advertisers track users.
4) Device fingerprinting (tracking without cookies)
Fingerprinting builds a probabilistic identifier from many small details: browser version, installed fonts, rendering quirks, time zone, language, screen resolution, CPU/GPU behaviour, and more. Even if a single attribute is common, the combination can be unique enough to recognise a device later. Unlike cookies, fingerprints are harder for users to see or delete.
For a practical demonstration of how uniqueness can emerge from device attributes, the EFF’s browser fingerprinting resource is a useful reference: https://coveryourtracks.eff.org/.
5) Account-based tracking and hashed emails
When you log into services (social platforms, email providers, retail accounts), your activity can be tied to an account identity. Many advertising ecosystems increasingly rely on “deterministic” identifiers like email addresses (often hashed before sharing). Hashing is not the same as anonymising: it can still be used to match the same email across datasets if both sides hash it the same way. This is why “I cleared my cookies but ads still know me” is common—your account sign-in reconnects the dots.
6) Data brokers and offline data
Advertising profiles aren’t built only from web browsing. Data brokers and partners can provide offline signals such as household composition, property data, purchase categories, and loyalty programme behaviour. These datasets may be used for audience segmentation, enrichment, or matching. Regulators have published overviews of broker practices and risks; the US Federal Trade Commission has a helpful starting point: https://www.ftc.gov/business-guidance/resources/data-brokers-call-transparency-accountability.
7) Cross-device tracking (phone, laptop, TV)
Cross-device graphs attempt to link multiple devices to the same person or household. Sometimes it’s deterministic (you log into the same account on phone and laptop). Sometimes it’s probabilistic (same IP range at night, similar location patterns, similar browsing behaviour). Smart TVs and streaming devices also add advertising identifiers and viewing telemetry into the mix, which can feed broader Online Privacy & Surveillance concerns beyond the browser.
Real-time bidding (RTB) and why data spreads so fast
Many websites and apps monetise with programmatic ads. In a typical real-time bidding flow, when a page loads, an ad request can be sent to an exchange that runs an auction among multiple buyers. To help buyers decide what to bid, the request may include signals like approximate location, device type, language, and audience segments. This often happens extremely quickly—commonly within tens to hundreds of milliseconds—so the page doesn’t feel slow.
- Speed reality: auctions must resolve quickly or ads won’t render, so systems prioritise automation and standardised data sharing.
- Privacy reality: more parties can receive parts of the request, increasing the number of entities that may learn something about you.
- Control reality: users typically have limited visibility into which partners received signals for a given page view.
This “broadcast” characteristic is one reason discussions about how advertisers track users often focus on the wider ecosystem, not just a single company.
What a VPN can and can’t do against ad tracking
What a VPN helps with
- Encrypting traffic on untrusted networks (public Wi-Fi), reducing passive snooping risks.
- Masking your real IP address from websites and ad partners, which can reduce IP-based linkage and location precision.
- Limiting what your ISP can see about your browsing content (the domains you visit may still be visible via DNS unless protected).
- Reducing some forms of price discrimination or content gating tied to IP location (results vary by site).
What a VPN does not solve
- Cookies and pixel tracking inside the browser once you accept them or remain logged in.
- Fingerprinting based on device and browser characteristics.
- Account-based tracking (Google/Meta/Amazon logins, retailer accounts, streaming accounts).
- Tracking inside apps that send data through their own SDKs (a VPN doesn’t change what the app chooses to share).
A VPN is best seen as a network privacy tool, not a complete anti-tracking system. If your goal is to reduce how advertisers track users, you’ll get the best outcome by combining a trustworthy VPN with browser-level and device-level controls.
VPN trade-offs that matter in practice
- Speed: encryption and routing add overhead. With modern protocols (like WireGuard), many users see modest slowdowns on nearby servers, but long-distance connections can increase latency noticeably.
- CAPTCHAs and flagged traffic: shared VPN IPs may trigger extra verification on some sites.
- Streaming compatibility: some platforms actively detect VPN IP ranges; results vary by provider and region.
- Dedicated IP options: can reduce CAPTCHAs, but may increase linkability if used consistently.
Practical steps to reduce Online Privacy & Surveillance (without breaking the web)
Browser and device settings that make a real difference
- Block third-party cookies where possible and regularly clear site data.
- Review site permissions (location, microphone, camera) and set “Ask” by default.
- On mobile, reset your advertising ID periodically and limit ad personalisation.
- Use separate browser profiles for shopping, work, and personal browsing to reduce cross-context linking.
Add-ons and network tools to reduce tracking
- Use a reputable content blocker to limit third-party scripts and pixels (balanced mode helps avoid breaking sites).
- Consider privacy-focused DNS or DNS filtering to reduce known tracking domains (note: DNS tools don’t stop first-party tracking).
- Use private windows for one-off searches, but don’t assume it makes you anonymous; it mainly limits local device history.
Choosing a VPN for privacy (what to look for)
If you’re adding a VPN as part of your privacy setup, prioritise verifiable practices over marketing slogans. Look for clear documentation and independent evidence.
- No-logs stance explained precisely (what is and isn’t stored), ideally supported by independent audits.
- Modern protocols (WireGuard or well-implemented OpenVPN) and strong encryption defaults.
- DNS leak protection and a reliable kill switch to reduce accidental exposure during network changes.
- Transparent jurisdiction and ownership details, plus a track record of handling legal requests responsibly.
- Performance: a broad server network can help you choose nearby locations for lower latency, which matters for video calls and gaming.
A high-quality VPN can reduce IP-based profiling and protect you on hostile networks, but it won’t erase your advertising identity if you continue to browse while signed into the same accounts. That distinction is central to understanding how advertisers track users in everyday browsing.
How to check whether you’re being tracked (simple, non-technical checks)
- Open your browser’s privacy report (if available) to see blocked trackers and frequent domains.
- Visit a fingerprinting test page to see how unique your browser appears and whether protections are working.
- Check your Google/Meta ad preferences pages to see inferred interests (it’s often eye-opening).
- Review app permissions and “data shared with third parties” disclosures in your mobile OS.
- Run a DNS leak test when using a VPN to confirm requests aren’t going to your ISP DNS servers.
These checks won’t reveal everything, but they help you validate whether changes (cookie blocking, VPN usage, tracker blocking) are reducing the most common forms of tracking.
Conclusion
Advertisers build detailed profiles by combining cookies and pixels, mobile ad IDs, IP-based signals, fingerprinting, account logins, and data broker enrichment. That’s why learning how advertisers track users is less about one “tracker” and more about an entire ecosystem designed to recognise and predict behaviour at scale. A VPN is useful for network privacy—masking your IP and protecting traffic on public Wi-Fi—but it won’t stop cookies, fingerprinting, or account-based profiling by itself. For meaningful reduction in Online Privacy & Surveillance, pair a reputable VPN with sensible browser controls, limited app permissions, and tracker blocking that you can verify with basic checks.
Frequently Asked Questions
Does a VPN stop targeted ads?
Not completely. A VPN can hide your IP address, but targeted ads can still be based on cookies, device fingerprinting, and logged-in accounts. Combine a VPN with cookie controls and a blocker for better results.
Why do ads follow me after I cleared cookies?
Many sites use account-based tracking, fingerprinting, or refreshed identifiers. If you’re logged in, platforms can reconnect your activity. Clearing cookies helps, but it’s not a full reset.
Is it legal for advertisers to track users?
It depends on the country and how consent is handled. Many regions allow tracking with disclosures and opt-outs, while others require explicit consent for certain cookies and data uses.
Will using a VPN slow down streaming or video calls?
It can. Nearby VPN servers usually have less impact than distant ones. Modern VPNs can be fast, but added encryption and routing may increase latency, which matters for calls and gaming.
Do free VPNs protect privacy from advertisers?
Some do, many don’t. Free services may log data, inject ads, or have weaker infrastructure. If privacy matters, evaluate the provider’s policies, audits, and business model carefully.
How can I reduce tracking on my smart TV?
Disable ad personalisation settings, limit telemetry options, and consider network-level blocking where possible. A VPN on the router may help with IP-based location signals, but won’t stop device identifiers.
