Category: Tracking Technologies

Cross-Site Tracking

Also known as: cross-site tracking, cross-domain tracking

Simply put

Cross-site tracking is the practice of monitoring a user's online activity across multiple, separate websites and linking it together into a single profile tied to a browser or device. This allows organizations to build a picture of a person's browsing behavior over time and across different domains, often for advertising, measurement, or profiling purposes. Many web browsers now offer settings that attempt to limit or block this kind of tracking by default.

Formal definition

Cross-site tracking refers to the collection, correlation, and linking of a user's activity across distinct websites or domains into a unified browser- or device-level history, typically to enable measurement, profiling, and targeted advertising. It is commonly implemented through third-party cookies, but similar outcomes can be achieved with pixels, local storage, SDKs, browser fingerprinting, and other identifiers that fall within the same regulatory scope even though they are not literally cookies. In most EU and UK jurisdictions, the placing of or access to such tracking identifiers on a user's device is generally subject to the ePrivacy Directive's prior-consent requirement, while any resulting processing of personal data is separately governed by the GDPR; consent obtained under one framework does not automatically satisfy the other. Requirements differ elsewhere, for example under US state privacy laws such as the CCPA/CPRA, which typically rely on opt-out mechanisms rather than opt-in consent. This definition addresses the concept generally; whether a specific tracking implementation is lawful depends on jurisdiction, the technology used, the consent obtained, and evolving regulatory guidance, and is out of scope here.

Why it matters

Cross-site tracking sits at the center of many cookie consent and compliance obligations because it typically involves placing or accessing identifiers on a user's device and then processing personal data about their browsing behavior. In most EU and UK jurisdictions, the placing of or access to such identifiers is generally subject to the ePrivacy Directive's prior-consent requirement, while any resulting processing of personal data is separately governed by the GDPR. These are distinct legal tests, and consent obtained under one framework does not automatically satisfy the other, so organizations relying on cross-site tracking need to consider both.

The practice is also significant because it increasingly runs against the grain of browser defaults and user expectations. Major browsers now offer settings intended to limit or block cross-site tracking, and some enable protections of this kind by default. For example, Safari includes an option to prevent cross-site tracking, and Firefox has published guidance describing cross-site tracking as companies collecting browsing data across multiple websites. As these controls become more common, tracking approaches that depend on third-party cookies may become less reliable, which has practical consequences for measurement, profiling, and advertising strategies.

Beyond technical friction, cross-site tracking raises heightened compliance risk because it links activity from separate websites into a single browser- or device-level profile. Requirements differ by jurisdiction: EU and UK regimes generally rely on opt-in consent, whereas US state privacy laws such as the CCPA/CPRA typically rely on opt-out mechanisms. Whether any specific implementation is lawful depends on the jurisdiction, the technology used, the consent obtained, and evolving regulatory guidance, and that fact-specific assessment is outside the scope of this entry.

Who it's relevant to

Privacy and data protection officers

Cross-site tracking typically triggers both ePrivacy consent obligations and GDPR processing obligations in the EU and UK, so DPOs need to assess each framework separately and confirm that consent obtained for one purpose is not assumed to cover the other. They also need to account for the profiling dimension when the practice links activity from multiple sites into a single browser or device history.

Legal and compliance counsel

Because obligations differ across jurisdictions, generally opt-in in the EU and UK, and often opt-out under US state laws such as the CCPA/CPRA, counsel must map where users are located and which regimes apply before concluding that a given tracking approach is permissible. Whether a specific implementation is lawful is fact-specific and depends on evolving regulatory guidance.

Web developers and engineers

Developers implementing tracking through third-party cookies, pixels, local storage, SDKs, or fingerprinting need to understand that these technologies may fall within the same consent rules even when they are not cookies. They also need to design for browser environments where cross-site tracking may be limited or blocked by default, which can affect how reliably identifiers persist across domains.

Marketing and advertising compliance teams

Teams relying on cross-site data for measurement, profiling, or targeted advertising should anticipate that browser protections and jurisdiction-specific consent requirements may constrain what data can be collected and linked. Tools such as consent management platforms can support compliance, but they do not replace the legal judgment needed to determine whether a specific tracking practice is appropriate.

Inside Cross-Site Tracking

Third-Party Cookies

Cookies set by a domain other than the one the user is directly visiting, historically the primary mechanism enabling a single entity to recognize a user across multiple unrelated websites. Their placement and access generally require prior consent under the ePrivacy regime in most EU jurisdictions where they are not strictly necessary.

Pixels and Tracking Beacons

Small embedded resources (often invisible images or scripts) that fire when a page loads, allowing a third party to log the visit and associate it with a user. Although not literally cookies, they fall within the same ePrivacy rules on storing or accessing information on a device and may involve GDPR-regulated processing of personal data.

Fingerprinting

Techniques that combine device and browser characteristics (such as configuration, fonts, or screen attributes) to identify or re-identify a user without necessarily storing a conventional identifier. Where fingerprinting involves accessing information on the device, it is generally treated under the same ePrivacy and GDPR analysis as cookies.

SDKs and Local Storage

Software development kits embedded in apps and browser storage mechanisms (such as localStorage) that can carry identifiers used to link activity across contexts. These technologies typically attract the same consent considerations as cookies where they are used for tracking rather than strictly necessary purposes.

Cross-Domain Identifiers

Shared or synchronized identifiers passed between domains or advertising partners (for example through cookie syncing) to build a profile of a user's activity across sites. The processing of any resulting personal data is subject to the GDPR in the EU, and the underlying storage or access is subject to ePrivacy rules.

Purpose of Tracking

Cross-site tracking is commonly used for advertising, audience measurement, and profiling. In most EU jurisdictions these purposes are generally not considered strictly necessary and therefore typically require prior, specific consent, whereas some US state frameworks may allow an opt-out approach instead.

Common questions

Answers to the questions practitioners most commonly ask about Cross-Site Tracking.

Does blocking third-party cookies stop cross-site tracking entirely?

No. While third-party cookies have historically been a primary mechanism for cross-site tracking, blocking them does not eliminate the practice. Similar outcomes can be achieved through other technologies that fall within the same regulatory framework, such as tracking pixels, browser fingerprinting, SDKs in mobile apps, and server-side or first-party data-sharing arrangements. Any evaluation of cross-site tracking should therefore consider the full range of techniques rather than focusing solely on third-party cookies.

Is cross-site tracking automatically lawful if a user has clicked 'accept' on a cookie banner?

Not necessarily. In most EU jurisdictions, two distinct legal requirements can apply: the ePrivacy rules govern the placing of and access to information on a user's device, while the GDPR governs any subsequent processing of personal data. A single banner click may not, on its own, demonstrate that consent was freely given, specific, informed, and unambiguous for each purpose and each party involved in the tracking. Whether particular cross-site tracking is lawful depends on facts beyond a single interface interaction, and requirements differ under other regimes such as the US state privacy laws, which often rely on opt-out mechanisms.

What consent standard generally applies before cross-site tracking can occur in the EU?

In most EU jurisdictions, cross-site tracking for purposes such as advertising or analytics typically requires prior consent that meets the GDPR standard: freely given, specific, informed, and unambiguous, expressed through a clear affirmative action. Pre-ticked boxes, implied consent from continued browsing, and cookie walls are widely considered non-compliant in the EU. Because multiple parties may be involved in cross-site tracking, organizations generally need to consider how consent is obtained and communicated across those parties. This is a general description and not a substitute for jurisdiction-specific legal advice.

How should organizations handle cross-site tracking for users in US states such as California?

Requirements differ from the EU. Frameworks such as the CCPA and CPRA in California often rely on an opt-out approach rather than prior opt-in consent, and may treat certain cross-context behavioral tracking as activity users can decline. Practical implementation frequently involves honoring opt-out signals and providing clear mechanisms for users to exercise their rights. Because obligations vary between individual US states and continue to evolve, the applicable rules should be confirmed for each jurisdiction in scope.

What role do Global Privacy Control signals play in managing cross-site tracking?

Global Privacy Control (GPC) is a browser or extension-based signal through which users can communicate a preference to opt out of certain data practices, including forms of cross-site tracking. In some US state frameworks, honoring such signals may be relevant to opt-out obligations. GPC is a supporting mechanism rather than a complete compliance solution; how it should be interpreted and acted upon depends on the applicable legal regime and evolving regulatory expectations, so its treatment should be assessed against the specific requirements that apply.

What should be documented when relying on consent for cross-site tracking?

Where consent is the basis for cross-site tracking, organizations generally maintain records that can demonstrate how and when consent was obtained, what purposes and parties it covered, and how users can withdraw it. Consent management platforms (CMPs) and frameworks such as the IAB Transparency and Consent Framework (TCF) can assist with capturing and communicating these choices, but they support compliance rather than guarantee it and do not replace legal judgment. The specific record-keeping expectations vary by jurisdiction and should be confirmed against applicable guidance.

Common misconceptions

Removing third-party cookies eliminates cross-site tracking.

Third-party cookies are only one method. Pixels, fingerprinting, SDKs, local storage, and cross-domain identifier syncing can also enable tracking across sites, so the same consent analysis may apply even after third-party cookies are phased out.

If a user consented to cookies, cross-site tracking is automatically lawful everywhere.

Consent under the ePrivacy regime concerns the storing of or access to information on the device, while any subsequent processing of personal data is governed by the GDPR. Consent obtained under one does not automatically satisfy the other, and requirements differ by jurisdiction; for example, some US state laws rely on opt-out rather than opt-in.

Because a technology is not technically a cookie, it is outside the consent rules.

In most EU jurisdictions, the rules apply to storing or accessing information on a user's device regardless of the specific technology, so pixels, local storage, SDKs, and fingerprinting used for tracking are generally treated similarly to cookies.

Best practices

Inventory all cross-site tracking technologies in use, including third-party cookies, pixels, SDKs, local storage, and fingerprinting, rather than focusing only on conventional cookies.

In EU and UK contexts, obtain prior, freely given, specific, informed, and unambiguous consent through a clear affirmative action before deploying non-essential tracking, and avoid reliance on pre-ticked boxes, implied consent, or cookie walls.

Map each tracking purpose to the applicable legal regime, distinguishing the ePrivacy basis for placing or accessing information on the device from the GDPR basis for any resulting processing of personal data.

Account for jurisdictional differences by configuring behavior appropriately for regions that may rely on opt-out mechanisms, such as certain US state frameworks, and honor recognized preference signals where applicable.

Use a consent management platform to present choices and maintain records of consent, while treating the tool as support for, not a substitute for, legal judgment about lawfulness.

Document the contested or fact-dependent aspects of any tracking arrangement, and seek qualified advice where the treatment of a specific technology or purpose is unsettled under evolving regulatory guidance.