Recognition without cookies
Cookies are disappearing from browsers – recognition is not. Fingerprinting, tracking pixels and server-side methods do the same job, are harder to notice, and fall under the same rules.
The debate about the end of third-party cookies suggests that tracking ends with them. In fact it has moved. The successor methods reach the same goal by routes that appear in no cookie list in the browser and cannot be removed by deleting anything.
How hard the methods are to notice
Fingerprinting: the device as its own identifier
Every browser reveals numerous small details on request: screen resolution, time zone, language setting, installed fonts, graphics card, supported features. Individually none of this is telling. Taken together they often form a combination that occurs in exactly that shape on only one device.
The difference from a cookie is fundamental: nothing is stored. Deleting does not help, because there is nothing there. And the combination stays largely stable across sessions.
Pixels and the detour through own addresses
A tracking pixel is an image one pixel wide loaded from an external server. The request itself is the report: it transmits IP address, time and the page the image sat on. In e-mail this has been the usual way of counting opens for decades.
A step further is CNAME cloaking: the measurement service is embedded via a subdomain of the site's own address – something like stats.example.com. To the browser that looks like the site's own address, which is why blocklists and browser protections often fail to catch it. Legally nothing changes: whoever receives the data is still the same external party.
Server-side forwarding
With server-side tagging it is no longer the browser that reports to the measurement service but the site's own server. The browser talks only to the site visited; what is passed on from there is no longer visible from outside.
There are legitimate reasons for this – fewer scripts, faster pages, more control over the fields transmitted. But it shifts what can be checked: what a blocker in the browser cannot see, it cannot stop, and what an auditor cannot see in the network log has to be taken on the operator's word.
The need for permission attaches to access to the device, not to the form of storage. A method does not become lawful by being harder to detect.
For taking stock this means a plain cookie list falls short. It becomes complete only when it covers, alongside cookies, local storage, embedded content, pixels, subdomains pointing at external services, and server-side forwarding – the last of which can only be established internally, never by inspection from outside.