Browsing, Search and Email: How You Are Followed and How to Cut It

A web page can carry a dozen companies along with it, and a marketing email can carry a pixel that reports when you opened it. Most of that can be cut with settings and one free extension, once you know which setting answers which leak.

The threat: how you get followed

Cookies, first party and third party

A cookie is a small file a website stores in your browser so it can recognize you next time. A first-party cookie comes from the site you chose to visit, and it is what keeps you logged in and remembers your cart. A third-party cookie comes from somebody else. Google's Chrome Help puts it simply: a page can load ads, images or text from other domains, and those domains can set cookies that follow your activity across sites to tailor ads and content.

So when a news site and a shoe store embed the same ad company, it sees one cookie show up on both and learns that the same browser read about a road bond and priced running shoes. Multiply by thousands of sites and you get an interest profile no one ever filled out. Chrome Help says third-party cookies are blocked in Incognito by default. Outside Incognito, you have to choose.

Trackers riding along on the page

Pages also load scripts, invisible images and "like" buttons from outside companies. Each one makes your browser contact that company, revealing your IP address, the page and your browser, whether or not you click. Safari's Privacy Report, covered below, shows how many a single page carries.

Fingerprinting: tracking without cookies

Delete every cookie you have and a tracker can still recognize you. EFF's Cover Your Tracks project explains how: some details, like your browser name and version, go out with every request, and tracking scripts collect more, like screen resolution, installed fonts and time zone. Together they can single out one device. Because the fingerprint is built from hardware and settings, not a stored file, clearing cookies leaves it intact. EFF also says private and Incognito modes don't stop it.

This matters more now. On December 19, 2024, the United Kingdom's privacy regulator, the Information Commissioner's Office, said Google was dropping its ban on fingerprinting by organizations using its advertising products, effective February 16, 2025, and called the change "irresponsible." The ICO said fingerprinting relies on device signals people can't easily wipe and that browsers find it harder to block.

EFF says Tor Browser tries to make every user look the same, while Brave randomizes its fingerprint so sessions can't be linked. Changing one setting by hand can backfire, since an unusual mix of tweaks stands out.

Your search history and your accounts

A search engine you are logged into keeps a diary of what you asked, often for years, and people type symptoms, debts and names into search that they would never post. None of this needs a tracker. You handed it over by being signed in. Numbers instead of names don't save you, either. In August 2006 AOL posted about 20 million search queries with each user labeled only by a number, and The New York Times identified user No. 4417749 from the searches alone.

Your internet provider and DNS

Your internet provider carries every packet you send. The FTC's October 21, 2021 staff report studied six providers covering about 98 percent of the mobile internet market and found they had access to all of a customer's internet traffic and real-time location, combined web browsing with app usage and personal data to target ads, and grouped some customers by traits such as race and sexual orientation.

HTTPS hides what is inside a page from your provider. Where you went still shows, and part of the reason is DNS. Before your browser can load a site, it asks a DNS server to translate the name into an internet address. Mozilla says those lookups are traditionally sent in plain text, which makes it easy for third parties to see what website you're about to visit. Your provider, or anyone on the coffee shop Wi-Fi, can read the list.

Email tracking pixels

Marketing email often includes a tracking pixel: an image one pixel wide, usually invisible, with a web address made unique to you. When your mail app loads images, it fetches that address from the sender's server. The request itself is the report. It tells the sender this copy was opened, when, and from what IP address, which can suggest a rough location. Links can carry a code that reports the click, too.

When the privacy tool is the leak

Products sold as protection can collect the most. On February 22, 2024, the FTC said Avast collected browsing information, including searches and the pages people visited, through its antivirus software and browser extensions, and stored it indefinitely. The FTC said Avast sold that data through its subsidiary Jumpshot to more than 100 third parties from 2014 to 2020, while marketing its products as protection against tracking. The order bans Avast from selling browsing data from its own products for advertising and requires it to pay $16.5 million. Any extension or VPN you install sees what you do, so choose few.

What a VPN and Tor actually change

VPN ads promise protection from hackers, governments and trackers. EFF's VPN guide, reviewed in July 2026, says those ads vastly oversell the product. A VPN routes your connection through someone else's network, and EFF says that is what it is best suited for. Your ISP and the hotel Wi-Fi stop seeing where you go. The VPN company starts seeing all of it.

A VPN hides	A VPN does not hide
Your browsing from your ISP	Your browsing from the VPN company
Your traffic from the local Wi-Fi owner	Cookies, tracking pixels, fingerprinting and GPS
Your IP address from websites	Anything you do while logged into an account
	History saved in your browser or search account

EFF adds that most traffic now uses HTTPS, so a VPN on public Wi-Fi matters less than it once did, and that VPN companies face legal demands like ISPs.

The Tor Project says Tor Browser sends your traffic along a random path through several volunteer relays, building the circuit one hop at a time with a separate set of encryption keys for each hop. Each relay knows only the relay that handed it data and the one it passes data to. No single relay ever knows the whole path, so no one company sits in the VPN's position of seeing both who you are and where you go. EFF says anyone who can see your network activity can see that you're using Tor, and that exit nodes, the last relay before the website, may be monitored. And Tor protects only what you do inside Tor Browser.

Who is most at risk

Anyone whose searches would hurt them if tied to their name, such as people researching a health condition, a divorce or a shelter. Also reporters and sources.

How to reduce it, level by level

Level 1 Everyday

This level answers third-party cookies, search history and email pixels. Blocking third-party cookies breaks the simplest form of cross-site tracking. Switching search engines, or setting your Google history to auto-delete, stops the diary from growing forever. Turning off remote images in mail stops the pixel from firing. Firefox needs less work: its default Standard mode already blocks social media trackers, cross-site tracking cookies, cryptominers and fingerprinters, and Mozilla says Total Cookie Protection, which keeps each cookie confined to the site that made it, is on by default. DuckDuckGo's privacy policy says it does not save your search history or store your IP address with your searches.

What Level 1 does not stop: fingerprinting, script trackers, your provider's view of your DNS lookups, and tracked links in email.

Level 2 Careful

This level goes after embedded trackers, DNS and your real email address. Privacy Badger is free and made by EFF, a nonprofit, for Chrome, Firefox, Edge, Opera and Brave. EFF says it blocks trackers that follow you across sites, and it sends the Global Privacy Control signal by default. Global Privacy Control tells sites you want to opt out of having your data sold or shared; under California's privacy law and similar state laws, covered companies must honor it. In August 2022 California's attorney general settled with Sephora for $1.2 million, saying the retailer had ignored opt-outs sent by the signal. Firefox, Brave and the DuckDuckGo browser also support it. Firefox's Strict mode blocks all cross-site cookies and tracking content in every window, though Mozilla warns it can break logins, forms, payments, comments and videos.

Encrypted DNS hides your list of site lookups from your provider and anyone on your Wi-Fi. Mozilla finished turning on DNS over HTTPS by default for U.S. desktop Firefox users in 2019. The catch: your DNS provider sees the lookups instead, so pick one on purpose. Mozilla also notes it can bypass parental controls or malware filtering on your network, and Firefox checks for those and holds off when it finds them.

Email aliases answer the address-selling problem. Firefox Relay gives everyone five free email masks and can strip common trackers from forwarded mail. DuckDuckGo Email Protection is free, removes several kinds of hidden email trackers, and lets you make unlimited private addresses. When an alias starts getting spam, turn it off, and you learn who leaked it.

Level 3 Private

Paid tools move your trust from one company to another, on purpose. With a paid iCloud+ plan, Private Relay sends Safari traffic through two separate relays, so, Apple says, websites don't see your IP address and your network provider doesn't see your Safari browsing. It is not available in every country, and some sites that check IP addresses will complain. Hide My Email gives you Apple-made aliases.

A VPN belongs here too, if you need one for travel or networks you distrust. Read its privacy policy and transparency reports first; you are handing it the view your provider had.

A private email provider protects stored mail. Proton Mail and Tuta are two examples. Proton says messages in a Proton Mail inbox are stored with zero-access encryption, and body and attachments are end-to-end encrypted. Subject lines and sender and recipient addresses are encrypted, but not end to end. Mail you send to a Gmail or Outlook user arrives without end-to-end encryption by default, so their provider can read it. The cost is a paid plan for full features and changing your address everywhere.

Level 4 Hardened

Tor Browser is the tool for browsing where who you are and where you connect from must stay apart. It answers the network observer, the website's view of your IP address, and much of fingerprinting. It does not answer your own logins. Keep separate browser profiles for separate lives: real-name accounts in one, sensitive research in another, never logged in.

Level 5 Hyper-vigilant

At this level, sensitive browsing happens only in Tor Browser, often on a separate machine or on a live operating system such as Tails. The risk at this level is mostly you: one login to a real account from the wrong window links your identities for good. Hyper-Vigilance covers compartmented identities and how they fail.

The legal line is simple. Tor, VPNs, aliases and encrypted email are lawful privacy tools. Using them does not make an illegal act legal, and none of them is a shield against lawful process. Messaging, which has its own leaks, is covered in Messaging and Calls.

The ladder for this topic

Level	What to do	Cost or tradeoff
Level 1 Everyday	Block third-party cookies, switch search engine, auto-delete history, block email pixels	Free; a few sites need exceptions
Level 2 Careful	Privacy Badger with GPC, Firefox Strict, encrypted DNS, free email aliases	Some broken pages; alias upkeep
Level 3 Private	iCloud+ Private Relay and Hide My Email, a VPN chosen carefully, private email provider	Subscriptions; moving accounts
Level 4 Hardened	Tor Browser for sensitive work, separate browser profiles	Slow, blocked sites, strict habits
Level 5 Hyper-vigilant	Tor-only sensitive browsing on a separate machine or Tails	One slip links everything