Tracking cookies: how they work, why they’re controversial, and what comes next
You open a website, a banner slides up, and you hit “accept all” just to make it go away. Most of us do it several times a day without a second thought. But that one click quietly authorizes something bigger: small files attach themselves to your browser and start logging where you go, what you look at, and how long you stay, often long after you have left the site that set them.
For years, those files, tracking cookies, were the engine behind digital marketing: traffic analytics, ad campaigns, funnel optimization, audience segmentation. That era is ending. Privacy regulation and rising user awareness have turned cookie-based marketing into a source of ethical and compliance dilemmas, and it no longer works as well as it once did. Below, we look at how tracking cookies actually work, why they became controversial, and what businesses are using instead.
What are tracking cookies, and why do businesses care about them?
Tracking cookies are small text files with pieces of data stored on users’ browsers when they visit a website. There are two main categories of cookies:
- First-party tracking cookies: set by the visited website directly, this type of cookie is used to improve the user experience and display information as the user interacts with the web pages. For example, first-party cookies are used to remember language choices, session browsing history, or items added to the cart. First-party cookies track data only on the website itself.
- Third-party tracking cookies: set by ad networks, third-party cookies allow cross-site tracking. The information is collected persistently and is primarily used for marketing purposes, such as profiling and personalized advertising, and making granular sales funnel optimizations.
First-party cookies are mostly harmless convenience. Third-party cookies are where the controversy lives, and the easiest way to see why is to follow one through a normal day.
How cookies work: one visitor’s day
Imagine a visitor browsing a shoe store in the morning. She looks at three pairs of running shoes, adds one to the cart, and leaves without buying. The store’s cookies record the products she viewed, the order of pages, how long she stayed on each one, and the abandoned cart. They also pick up technical details: her device and browser, where she came from, her location, and her IP address.
At lunch, she reads the news. The news site has nothing to do with shoes, but it loads ads from the same ad network that placed a cookie on her browser at the store. The network reads its own cookie, recognizes her, and there they are: the exact running shoes she looked at that morning, in the sidebar next to the headlines.
In the evening, she watches a video. Same ad network, same cookie, same shoes, this time as a pre-roll ad. The cookie has followed her across three unrelated websites, and each stop added to her profile: interested in running shoes, reads news at lunch, watches videos at night.
For the shoe store, this is retargeting, a reminder that might recover an abandoned cart. For the visitor, it is the unsettling feeling that the internet is watching her shop.
Data aggregation and privacy challenges
The data collected by third-party cookies isn’t available only to the shoe store from our example. Anyone in the same ad network can use it to target the same visitor with ads.
Data brokerage is a large industry, and millions of internet users’ personal data are sold to businesses and ad networks daily. Personal data is so valuable that it is often called “the new oil.”
While it may be helpful for businesses to gain access to personal data about users who have not previously interacted with their brand, the amount of information collected and exchanged causes privacy concerns.
The legal paradigm shift
Personal data protection has long been recognized as part of the right to privacy, but the digital era demanded a more direct approach to address new technologies and rising concerns.
How the EU GDPR changed the privacy landscape
The real change came with the introduction of the General Data Protection Regulation (GDPR). Since it came into full force in 2018, explicit consent has been required for all personal data processing activities. It changed how cookies work, too, and cookie consent banners became mandatory.
However, explicit consent isn’t the only way GDPR affects third-party cookies. It also introduced several other data processing principles, including:
- Purpose limitation: Data can only be used for the specific purpose for which it was collected, which has to be clearly stated in the cookie policy.
- Data minimization: Only the necessary amount of data can be processed in line with the purpose.
- Storage limitation: Data can only be kept for as long as necessary for the initial purpose.
- Integrity and confidentiality: Personal data has to be processed in such a way that maintains its integrity and ensures confidentiality.
The GDPR also defined personal data as any information that can lead to the identification of an individual, whether on its own or in combination with other data. IP addresses are personal data, but profiling users and assigning unique identifiers, even without the classic personally identifiable information, is also considered personal data processing. That created more compliance issues for cookie-based tracking.
Offering data to third-party ad networks and brokers is hard to reconcile with these standards, and regulators have enforced them vigorously: cumulative GDPR fines now run into the billions of euros.
Other major legislators followed the GDPR’s approach, one of the most prominent being the California Consumer Privacy Act (CCPA). While the US doesn’t have a federal law, many states follow California’s example.
Large markets like Brazil also introduced privacy laws, showcasing a significant worldwide shift towards a more privacy-focused and consumer-first digital ecosystem.
Are tracking cookies still worth the risk?
Although legislative changes create compliance headaches, they are only a part of the concerns businesses relying on cookie-based advertising face:
Data accuracy concerns
Tracking cookies allowed accurate, granular segmentation and targeting, which was very useful for advertising purposes. Advertisers could identify funnel issues and A/B test changes, seeing how users behaved every step of the way.
However, many users feel uncomfortable when targeted ads “follow” them around the internet, which is why they are doing their best to protect their privacy. Privacy-aware users will not only click the “reject all cookies” button but will use tools such as VPNs, ad blockers, incognito modes, and private browsers to protect their data and block tracking cookies.
As a result, it is becoming increasingly complex for cookie-based analytics to show reliable data.
More legislators are expected to introduce stricter privacy regulations while users increasingly take conscious steps to protect their personal information. That will make compliance even harder while reducing the effectiveness of cookie-based tracking, which is why many teams are already shifting their budgets toward cookieless marketing.
User experience (UX) friction
To avoid non-compliance fines, cookie consent banners must allow users to refuse cookies just as easily as they accept them. That can be especially problematic for mobile phones due to the screen size.
However, cookie notifications and prompts take the attention away from your website content, creating friction and interrupting the user experience.
That leaves businesses with a dilemma: skip the full consent banner and risk hefty GDPR fines, or show it and pull attention away from the content.
Erosion of trust
Even with easy, compliant opt-outs, the fact that visitor data may end up with third-party brokers raises ethical concerns for privacy-aware users. Over time, that erosion of trust weakens brand reputation, and users who feel watched will look for alternatives, possibly with your competition.
Strategic risk
Trust erodes gradually, but the factors above can also combine into a sudden, serious blow.
In cases of non-compliance, the fine itself is often not the central issue. The reputational damage that follows can hurt far more, and lost customer trust is hard to win back, particularly in competitive markets.
However, non-compliance isn’t the only risk. If you process personal data on your servers, you are also at risk of hacks and data leaks. Even if you prove that you did all you could to prevent the data leak, the affected users will hardly continue to use your services and products after the incident.
A move towards a cookieless future
The reputational risks, compliance issues, and privacy concerns are gradually reshaping the world of user tracking.
Even browser makers are taking action. Apple’s Safari and Mozilla’s Firefox block third-party cookies by default, and although Google shelved its plan to remove them from Chrome, the direction of travel across the industry is clear.
However, businesses still need accurate data, which creates space for cookieless analytics and software that respects user privacy.
Privacy-friendly analytics
Privacy-friendly analytics tools emerged in response to these concerns. They aim to reduce the amount of personal data collected and often avoid tracking cookies and persistent identifiers.
Instead, they rely on alternative tracking methods like IP hashing, anonymized session identifiers, or limited browser data to deliver website insights. While this approach reduces some privacy risks, many of these methods still count as personal data processing under laws like the GDPR, particularly when technical re-identification is possible.
Some also use fingerprinting, combining device or browser attributes to distinguish users. Even without names or email addresses, that kind of tracking is subject to consent requirements in most jurisdictions.
In short, privacy-friendly analytics are a step in the right direction, but they don’t eliminate all compliance or UX challenges when personal data is still processed in the background.
Privacy-first analytics
Privacy-first analytics go a step further than privacy-friendly software by eliminating personal data processing altogether. They are built without cookies, identifiers, IP hashing, or fingerprinting. This means that no consent banners are required, and there are no compliance risks or ethical concerns typically associated with traditional tracking.
Unlike cookie-based tools, which can be blocked or distorted by ad blockers, VPNs, or private web browsers, privacy-first solutions remain unaffected by these technologies. They deliver accurate, reliable website metrics without relying on invasive technologies.
By avoiding tools that use cookies and personal identifiers entirely, privacy-first analytics provide a cleaner, compliant, and user-friendly alternative for businesses that want to respect privacy without sacrificing insights.
mandera: accurate privacy-first analytics without tracking cookies
mandera is a privacy-first, agentic website growth system. Its analytics suite measures everything happening on your website without cookies or personal data, and the rest of the system turns that data into growth opportunities, strategies and content. Here’s how:
Built for privacy
Instead of processing personal data, mandera works with a small set of non-invasive signals:
- the page that was opened
- the traffic source, taken from the referrer or from campaign parameters such as utm_source
- the country, derived from the browser timezone, never from an IP address
- the language, from the browser setting
- screen and window size
- engagement, such as time on page, clicks and scroll depth
- the device, browser and operating system, in shortened form
mandera doesn’t process IP addresses. They are automatically removed from every request. You can read exactly what is measured, and how, in our documentation on how we track.
As a result, mandera can accurately measure visits without being able to identify individual users, making it GDPR compliant by design.
Accurate metrics with real user flows
Ad blockers, VPNs, private browsers, and incognito windows won’t interfere with mandera’s results, allowing us to show you accurate metrics.
You will have simple-to-understand yet actionable website use insights, allowing you to see which pages are the most popular, as well as traffic sources.
Furthermore, mandera’s User Flow maps the real paths visitors take through your site, aggregated and anonymous, so you see where people go next and where they leave. That makes it easy to spot the pages that need attention and to make optimizations based on how visitors actually move through your website.
Uninterrupted UX
Because mandera doesn’t process personal data, you don’t have to show consent banners.
As a result, the entire user experience will remain uninterrupted, and visitors can focus on your content, leading to improved user satisfaction and potentially more conversions.
Improved brand reputation
Privacy-aware users notice when a company protects their data. Choosing privacy-first software such as mandera demonstrates a commitment beyond mere compliance and proves your company puts its ethical standards into practice.
That can strategically differentiate your brand from the competition, giving you an advantage with the growing number of privacy-conscious users.
Beyond analytics
Measuring traffic is where mandera starts, not where it ends. Everything the analytics suite collects flows into mandera’s Agentic Engine, which surfaces growth opportunities from your own data and helps you turn them into strategies and content, while you approve everything that touches your site.
Frequently asked questions
Are tracking cookies illegal?
No. Tracking cookies are legal, but their use is regulated. Under the GDPR and similar laws, websites need informed consent before setting cookies that process personal data, and that consent must be as easy to refuse as it is to give. The legal risk comes from setting them without valid consent, not from the technology itself.
Does deleting cookies stop tracking?
It helps, but only partially. Deleting cookies removes existing identifiers, yet new ones are set the next time you accept a banner, and some sites fall back on techniques like fingerprinting that don’t rely on cookies at all. Regular deletion reduces tracking; it doesn’t eliminate it.
What replaces tracking cookies?
For analytics, cookieless tools measure traffic through anonymous, aggregated signals instead of personal identifiers. If you currently rely on cookie-based tools, a privacy-first Google Analytics alternative can deliver the same core insights without consent banners. On the browser side, Safari and Firefox already block third-party cookies by default, while Google walked back its plan to remove them from Chrome, so the shift is being driven by regulation and user behavior rather than by any single browser.
Our conclusion
While the use of cookies allowed businesses to optimize their marketing efforts, the privacy concerns they raised resulted in a chain reaction of significant shifts in legislation and user behavior.
As a result, cookie-based tracking is becoming less popular. Businesses seeking reliable analytics solutions that won’t create user friction or compliance issues are now exploring alternatives.
As a privacy-first solution, mandera displays accurate website traffic metrics without processing personal data. You will get actionable user insights without interrupting the UX with cookie banners or worrying about potential compliance issues.
Ready to see it on your own traffic? Subscribe to mandera and put the whole system to work on your growth. Your free trial includes 10 high-impact opportunities to get you started.
Last updated: 15 June 2026