Skip to main content
Cookie Gate
Category: Tracking Technologies

Cache-Based Tracking

Also known as: Cache-Based User Tracking, Browser Cache Tracking
Simply put

Cache-based tracking is a technique that identifies or follows a user by relying on data stored in a device's temporary storage (cache), rather than on conventional cookies. Because browsers and systems keep local copies of data to load content faster, that stored data can be manipulated or read to recognize a returning user. This makes it a form of tracking that can operate even when a user has not accepted cookies.

Formal definition

Cache-based tracking encompasses a family of techniques that abuse caching mechanisms, such as browser HTTP caches or DNS stub resolver caches, to assign and later re-read a persistent, statistically unique identifier tied to a user's device. Documented variants include DNS cache-based tracking, which places a statistically unique combination of DNS data in the user's stub resolver cache (Klein), and HTTP cache header abuse, which exploits cache-control and expires headers to identify and follow users (Mishra 2021). As a device-side identification and access mechanism that is not literally a cookie, this technique would generally fall within the same EU legal framework as cookies: in most EU jurisdictions, the ePrivacy rules govern the storing of, and gaining access to, information on a user's device, and where the technique processes personal data the GDPR applies in addition. Its consent and lawfulness treatment therefore typically mirrors that of other non-cookie tracking technologies, though specific regulatory guidance addressing cache-based methods directly is limited and interpretations may vary by jurisdiction; the evidence here describes the technical mechanism rather than settled legal treatment, which is out of scope for this definition.

Why it matters

Cache-based tracking matters because it can identify or follow a user without relying on conventional cookies, and can therefore operate even where a user has declined cookie consent or cleared their cookies. For privacy officers and compliance teams, this undermines the assumption that managing cookies alone is sufficient to control tracking on a website or service. Because caching mechanisms exist to make content load faster and are a normal part of how browsers and systems work, tracking techniques that abuse them can be harder to detect and to explain to users than a standard cookie.

From a legal standpoint, the significance is that a device-side identification mechanism that is not literally a cookie would generally fall within the same EU framework that governs cookies. In most EU jurisdictions the ePrivacy rules govern the storing of, and gaining access to, information on a user's device, and where personal data is processed the GDPR applies in addition. This means cache-based tracking cannot be treated as outside the scope of consent obligations simply because it does not use a cookie file; its treatment typically mirrors that of other non-cookie tracking technologies such as pixels, local storage, and fingerprinting.

That said, specific regulatory guidance directly addressing cache-based methods is limited, and interpretations may vary by jurisdiction and evolve over time. The documented work in this area, such as the DNS cache-based tracking technique described by Klein and the HTTP cache header abuse reported by Mishra (2021), describes the technical feasibility of these methods rather than settling their legal status. Organizations should therefore treat the compliance analysis as fact-dependent and subject to the same care they would apply to any other device-side tracking technology.

Who it's relevant to

Privacy and data protection officers
Cache-based tracking is relevant because it can identify users without cookies, meaning a cookie-only view of tracking on a site may be incomplete. In most EU jurisdictions the ePrivacy rules on storing and accessing information on a device, and the GDPR where personal data is processed, would generally apply to such techniques, so they should be considered when assessing consent obligations and vendor practices.
Web developers and engineers
Developers work directly with the caching layers, HTTP cache headers such as cache-control and expires, and DNS resolution, that these techniques abuse. Understanding how caching can be repurposed to store and re-read a statistically unique identifier helps in auditing whether a site or third-party component may be enabling tracking beyond conventional cookies.
Legal counsel and compliance teams
Because a cache-based identifier is a device-side mechanism that is not literally a cookie, its consent and lawfulness treatment typically mirrors that of other non-cookie tracking technologies. Counsel should note that direct regulatory guidance on cache-based methods is limited, interpretations may vary by jurisdiction, and any analysis will depend on facts such as whether personal data is processed.
Marketing and analytics compliance teams
Teams relying on consent management for tracking should be aware that a technique operating through the cache may function even where a user has not accepted cookies. This is relevant to ensuring that tracking deployed for marketing or analytics purposes is subject to the same consent controls applied to other non-cookie technologies, consistent with applicable rules in the relevant jurisdiction.

Inside Cache-Based Tracking

ETag tracking
A technique that repurposes HTTP entity tags, which browsers cache to validate resources, as a persistent identifier. Because the browser returns the stored ETag value to the server on subsequent requests, it can function as a covert identifier even where conventional cookies have been cleared.
Cache-Control and Last-Modified abuse
The use of caching headers and cached resource metadata to store or reconstruct identifying values on a user's device, exploiting standard caching behaviour to persist information rather than to improve performance.
Client-side storage in the browser cache
Information written to and read from the browser's cache to identify or re-identify a device or user. This constitutes storing or gaining access to information on the user's terminal equipment, which in most EU jurisdictions falls within the scope of the ePrivacy rules regardless of whether a literal cookie is used.
Personal data processing consequences
Where cache-based identifiers are used to single out, profile, or track an individual across visits or sites, the resulting activity typically involves processing of personal data and, in the EU/UK, engages the GDPR in addition to the ePrivacy rules.
Relationship to other non-cookie techniques
Cache-based tracking sits alongside pixels, local storage, SDKs, and fingerprinting as a technology that is not a cookie but is generally treated under the same consent framework when it stores or accesses information on a device.

Common questions

Answers to the questions practitioners most commonly ask about Cache-Based Tracking.

Is cache-based tracking exempt from consent because it doesn't set a cookie?
No. The consent obligations under the ePrivacy Directive apply to the storing of, or gaining access to, information on a user's device, regardless of the specific technology used. Cache-based tracking relies on reading or writing information to the browser or device (for example, exploiting cached resources or ETag values), which generally falls within the same rules as cookies. The absence of a literal cookie does not exempt the technique. Where the purpose is not strictly necessary to provide a service the user has requested, prior consent is typically required in most EU jurisdictions. This is separate from any GDPR obligations that apply where personal data is processed as a result.
Does blocking cookies stop cache-based tracking?
Not necessarily. Cache-based tracking is designed to operate independently of conventional cookie storage, so cookie-blocking or cookie-clearing controls may not prevent it. Some techniques persist across cookie deletion by relying on cached resources, ETags, or other browser storage mechanisms. Users and organizations should not assume that managing cookies alone addresses this category of tracking. Mitigations depend on the specific technique and the browser or platform controls available, which vary and evolve over time. This answer describes the general nature of the technology and is not an assessment of any particular product's effectiveness.
Does a consent management platform (CMP) automatically handle cache-based tracking?
A CMP can support the management of consent for tracking technologies, but it does not automatically detect or control every technique. Cache-based tracking may not be surfaced by a CMP's standard cookie scan, since it does not always present as a conventional cookie. Organizations generally need to identify where such techniques are used, map them to the CMP's consent categories, and ensure the relevant scripts or resources are gated appropriately. A CMP supports compliance but does not replace legal judgment or a technical audit of the tracking actually in use.
How should cache-based tracking be treated when categorizing technologies for a consent banner?
As with other tracking mechanisms, categorization should reflect the purpose rather than the technical label. If a cache-based technique serves analytics, advertising, or other non-essential purposes, it generally belongs in a category that requires prior consent under EU law, alongside cookies and similar technologies. If it is genuinely strictly necessary to deliver a service the user has requested, it may fall within the exemption, but that assessment depends on the specific facts and should be made carefully. The appropriate treatment also depends on the applicable jurisdiction, since obligations differ between the EU, the UK, and individual US states.
What should be included when logging consent that covers cache-based tracking?
Consent records should generally capture the same elements documented for other technologies: what the user was told, the specific purposes consented to, when and how consent was given, and the ability to demonstrate a clear affirmative action. Where cache-based tracking is deployed for a non-essential purpose, its presence and purpose should be reflected in the information provided to the user and in the record of consent, so that the log accurately represents what was actually consented to. Record-keeping expectations can vary by regime, so organizations should align their logging with the guidance applicable in the relevant jurisdiction.
How can teams identify whether cache-based tracking is present on their site?
Because cache-based techniques may not appear in a standard cookie scan, identifying them typically requires a broader technical review, including inspection of network requests, caching headers such as ETags, and the behavior of third-party scripts and SDKs. Collaboration between web developers and privacy or compliance staff is usually needed to map how these techniques operate and for what purpose. The scope and reliability of such a review depend on the tools and expertise available, and this description does not endorse any specific detection method or guarantee that all techniques will be found.

Common misconceptions

Cache-based tracking is not covered by cookie consent rules because no cookie is set.
The ePrivacy rules in most EU jurisdictions apply to the storing of, or access to, information on a user's device by any means, not only to cookies. Cache-based techniques that store or read identifying information generally fall within the same consent requirements, and separately may trigger GDPR obligations where personal data is processed.
Because cache-based tracking is technical and invisible to users, it can be treated as strictly necessary and exempt from consent.
The consent exemption for strictly necessary or essential purposes is narrow and tied to the purpose of the processing, not to the technology used. Tracking, profiling, or re-identifying users through the cache is typically not essential to providing a service the user has requested, so prior consent is generally required under EU law.
Clearing cookies or blocking cookies stops this form of tracking, so it need not be disclosed.
Cache-based identifiers can persist independently of cookies and may survive cookie deletion, which is part of why they raise heightened transparency concerns. This does not remove disclosure or consent obligations; if anything, the covert and persistent nature makes informed consent and clear information more important, not less.

Best practices

Inventory all mechanisms that store or read information on users' devices, including cache-based techniques such as ETags, alongside cookies, pixels, local storage, SDKs, and fingerprinting, so that non-cookie technologies are not overlooked in consent management.
Assess each cache-based technique against both the ePrivacy storage-and-access rules and, where personal data is processed, the GDPR, treating them as separate legal questions rather than assuming consent under one satisfies the other.
Where cache-based tracking is used for analytics, advertising, or profiling in the EU or UK, obtain prior consent through a clear affirmative action before deploying it, and do not rely on the strictly necessary exemption unless the purpose genuinely qualifies.
Disclose cache-based tracking specifically in your cookie or privacy notice rather than describing only cookies, so that consent can be treated as informed given the covert and persistent nature of the technique.
Configure your consent management platform so that cache-based tracking scripts and resources are blocked until valid consent is recorded, and maintain consent logs to evidence the basis for using them.
Tailor deployment to the applicable jurisdiction, recognising that opt-in expectations in the EU and UK differ from the opt-out approach under US state laws such as the CCPA and CPRA, and seek legal advice where the treatment of a specific technique is unsettled.