Most people expect online tracking to look like obvious ads or cookie pop-ups. In reality, a lot of tracking happens quietly in the background, stitched together from technical signals you rarely see: your device settings, network metadata, app identifiers, and even the way your browser renders a page. These online tracking methods are used for advertising, fraud prevention, analytics, and sometimes more invasive profiling, depending on the company and the laws where it operates. If you care about Online Privacy & Surveillance, it helps to know what’s actually being collected, who can collect it (sites, ad networks, ISPs, apps), and what tools can realistically reduce exposure. A VPN can be part of that toolkit, but it’s not a magic cloak: it mainly protects your traffic from local networks and hides your IP from websites, while other identifiers can still follow you.
1) Third-party cookies and “cookie syncing”
How it works
Third-party cookies are set by domains other than the site you’re visiting (for example, ad and analytics partners). They can recognise you across different websites. Cookie syncing takes it further: ad-tech companies share identifiers between each other so one tracker can “recognise” the ID set by another.
- What it collects: a unique ID, visited pages, referral sources, ad clicks, and inferred interests.
- Why you don’t notice: it runs behind the scenes through scripts and invisible pixels.
What actually reduces it
- Use a browser that blocks third-party cookies by default, or enable that setting.
- Clear cookies regularly, but note this is a partial fix if other identifiers remain.
- Use separate browser profiles for different activities (work, personal, shopping).
2) Browser fingerprinting (tracking without cookies)
What fingerprinting measures
Fingerprinting combines many small signals into a probabilistic “signature” of your device and browser. Even if no single signal is unique, the combination often is.
- Device and browser details: user agent, OS version, screen size, language, time zone.
- Rendering quirks: canvas/WebGL output, font lists, audio processing behaviour.
- Hardware hints: CPU/GPU characteristics, memory, and performance patterns.
Why cookie blocking isn’t enough
Fingerprinting can persist after you clear cookies because it relies on how your device behaves, not stored data. This is one of the most overlooked online tracking methods because nothing obvious is saved on your machine.
To see how fingerprintable your browser is, the EFF’s test tool is a useful starting point: https://coveryourtracks.eff.org/.
3) IP address tracking and network identifiers
What an IP can reveal
Your IP address can indicate approximate location (often city/region), ISP, and whether you’re on mobile, home broadband, or a workplace network. Sites also log connection metadata such as timestamps, device types, and error patterns.
Where a VPN helps and where it doesn’t
- Helps: hides your real IP from websites and reduces linkability across sites when you change VPN servers.
- Helps: reduces exposure on public Wi-Fi by encrypting traffic between you and the VPN server.
- Doesn’t help: if you log into the same accounts, your identity is still obvious to those services.
- Doesn’t help: fingerprinting can still identify you even on a different IP.
In Online Privacy & Surveillance discussions, this is the key nuance: a VPN reduces network-level tracking, not account-based tracking.
4) DNS tracking (the “phone book” of the internet)
Why DNS is valuable to trackers
DNS requests reveal which domains your device is trying to reach. Even if the webpage content is encrypted with HTTPS, DNS can still expose browsing patterns to whoever handles DNS resolution (often your ISP or a third-party resolver).
What to look for in privacy tools
- Encrypted DNS: DNS over HTTPS (DoH) or DNS over TLS (DoT) reduces passive monitoring on local networks.
- VPN DNS handling: ideally, the VPN app uses its own DNS servers and prevents “DNS leaks”.
- IPv6 considerations: some setups leak queries over IPv6 if not handled correctly.
Many reputable VPNs include leak protection and private DNS, but performance varies by server load and distance. A closer VPN server usually means lower latency, which matters for browsing responsiveness and video start times.
5) Mobile app SDKs and advertising IDs
Why apps can track you more persistently than browsers
Mobile apps often include third-party SDKs (analytics, ads, crash reporting). These SDKs can collect device and app usage data and associate it with platform advertising identifiers.
- On iOS: IDFA (if allowed) plus device signals and account data.
- On Android: Google Advertising ID plus app install/referrer data.
- Common extras: IP address, coarse location, app events, and device model.
Practical ways to limit it
- Reset or limit ad tracking in your OS privacy settings.
- Review app permissions (location, Bluetooth, contacts) and remove anything unnecessary.
- Prefer web versions of services when apps are overly invasive.
A VPN can mask your IP from SDK endpoints, but it won’t stop an app from sending identifiers you’ve allowed it to access.
6) Location tracking beyond GPS
How location is inferred
Even with GPS disabled, location can be inferred using nearby Wi-Fi networks, Bluetooth beacons, and cell tower data. Many devices also share “coarse” location for analytics, weather, or content localisation.
- Wi-Fi positioning: nearby SSIDs and signal strengths create a location estimate.
- Bluetooth: beacon IDs can identify venues and movement patterns.
- IP geolocation: less precise, but still useful for region-level profiling.
What a VPN changes
A VPN mainly changes IP-based location signals seen by websites, which can help reduce IP-based profiling and can affect which regional content you’re offered. It won’t override GPS, Wi-Fi positioning, or location services if you grant permission to apps.
7) Email tracking pixels and link rewriting
What’s happening when you open an email
Many marketing emails include a tiny invisible image (tracking pixel). When your email client loads it, the sender learns you opened the message, when you opened it, and sometimes your approximate location (via IP).
- Open tracking: “Did you read this?” and “At what time?”
- Click tracking: links are often rewritten through tracking domains.
How to reduce exposure
- Disable automatic image loading in your email client where possible.
- Be cautious with “one-click unsubscribe” pages that ask for extra information.
- Use separate email addresses for sign-ups vs personal communication.
8) Smart TVs, streaming devices, and “household graphs”
Why streaming hardware is a tracking hub
Smart TVs and streaming sticks can collect viewing behaviour, app usage, and device identifiers. Ad-tech can also build a “household graph” that links devices on the same home network (TV, phones, laptops) to infer who lives together and what they watch.
What you can and can’t do about it
- Do: review TV privacy settings (ad personalisation, automatic content recognition where applicable).
- Do: keep firmware updated; older devices often have weaker security defaults.
- Maybe: use a VPN on your router to cover devices that can’t run VPN apps.
- Limit: apps can still track via logged-in accounts, device IDs, and viewing profiles.
If your goal is streaming access while keeping reasonable privacy, focus on VPNs that are stable on streaming endpoints and offer router support, but remember that streaming services still see your account activity.
9) Data brokers and identity resolution
How data leaves the websites you’re visiting
A lot of profiling doesn’t rely on a single site tracking you forever. Instead, data is bought, sold, and matched. “Identity resolution” links signals like hashed emails, phone numbers, device IDs, and browsing behaviour into a unified profile.
- Examples of matching keys: email hashes, phone number hashes, login events, and address data.
- Why you don’t notice: the transaction happens between companies, not in your browser.
What helps in real life
- Minimise reuse: don’t use the same email for every service.
- Be careful with quizzes, discount pop-ups, and lead forms that ask for phone numbers.
- Opt out of broker lists where available in your region, although it can be time-consuming.
10) Account-based tracking (single sign-on and embedded widgets)
Why logins are the strongest identifier
When you log into a platform, that identity can follow you across its services and embedded widgets (login buttons, comment systems, video embeds). This is powerful because it doesn’t require guessing who you are.
Compartmentalisation strategies
- Use separate browser profiles for different accounts.
- Avoid using the same “sign in with” provider everywhere.
- Log out when you’re done if you don’t need persistent sessions.
This is also where a VPN has clear limits: it can reduce IP-based correlation, but it can’t prevent a service from recognising your account.
11) Public Wi-Fi tracking and captive portals
What networks can see
On public Wi-Fi, the network operator can often see connection metadata and potentially observe unencrypted traffic. Captive portals can also collect personal details (email, phone number) in exchange for access.
How a VPN changes the risk profile
- Protects against local snooping: traffic between your device and the VPN server is encrypted.
- Reduces ISP-style logging by the hotspot operator: they see a VPN connection, not every site you visit.
- Doesn’t fix unsafe behaviour: phishing sites and malicious downloads still work if you click them.
For remote workers and travellers, this is one of the most practical benefits of a VPN, especially when combined with a kill switch and leak protection.
A practical checklist to reduce online tracking (without breaking everything)
If you want fewer surprises from online tracking methods, focus on changes that reduce identifiers, limit data sharing, and keep performance usable.
- Browser: block third-party cookies; use strict tracking protection; limit extensions (some increase fingerprint uniqueness).
- Fingerprinting: use privacy-focused browsers or settings; avoid unnecessary custom fonts and exotic configurations.
- DNS: enable encrypted DNS; ensure your VPN routes DNS through the tunnel to avoid leaks.
- VPN basics: choose providers with clear no-logs language, independent audits where available, modern protocols (often WireGuard), a kill switch, and IPv6/WebRTC leak protection.
- Accounts: separate emails and browser profiles; avoid single sign-on everywhere.
- Mobile: reset/limit advertising ID; restrict app permissions; uninstall apps you don’t trust.
- Streaming devices: review ad personalisation settings; consider router-level controls if your device can’t run privacy apps.
For encryption context, AES is a widely used standard in secure VPN tunnels; the specification is published by NIST here: https://csrc.nist.gov/publications/detail/fips/197/final.
Conclusion
Tracking isn’t just about cookies anymore. The most persistent techniques combine device fingerprints, account logins, app identifiers, and network metadata into profiles that are hard to see and harder to erase. For Online Privacy & Surveillance concerns, a VPN is still worth considering because it reduces IP-based tracking and protects you on untrusted networks, but it won’t stop trackers that rely on logins, device IDs, or fingerprinting. The best results come from layering tools: privacy-aware browser settings, sensible account separation, encrypted DNS, and a reputable VPN with strong leak protection and transparent policies.
Frequently Asked Questions
Do VPNs stop all online tracking methods?
No. A VPN mainly hides your IP address from websites and encrypts traffic on your local network. Trackers can still use cookies, fingerprints, and account logins to identify you.
Will using private/incognito mode prevent tracking?
It helps a little by limiting stored cookies and history on your device, but it doesn’t hide your IP, stop fingerprinting, or prevent websites from tracking you while the session is active.
Can a VPN improve streaming privacy?
It can reduce IP-based profiling and protect viewing traffic on public Wi-Fi. But streaming apps still track what you watch inside your account, and smart TVs may collect device-level analytics.
Does encrypted DNS replace a VPN?
No. Encrypted DNS protects DNS lookups, but it doesn’t hide your IP from websites or encrypt all traffic. A VPN covers your broader connection and typically includes DNS protection too.
Why do ads still follow me after clearing cookies?
Because tracking can rely on fingerprinting, logged-in accounts, or app identifiers. Clearing cookies removes one type of identifier, but it doesn’t reset everything that can link activity together.
What should I look for in a trustworthy VPN?
Clear no-logs statements, independent audits if available, modern protocols, leak protection, a kill switch, and a track record of handling security issues transparently.
