Category: Tracking Technologies
ETag Tracking
Also known as: Entity Tag Tracking, ETag Fingerprinting
Simply put
ETag tracking is a technique that repurposes a standard web feature, the ETag, to identify and follow users across visits to a website. The ETag is normally used to help browsers cache content efficiently, but because a server can assign a unique value to each user's browser and read it back later, it can act like a hidden identifier even when cookies are disabled. This makes it a form of tracking that many users may not be aware of and cannot easily control through common privacy settings.
Formal definition
An ETag (entity tag) is an HTTP response header value that a web server assigns to a specific version of a resource, primarily to support cache validation. In ETag tracking, a server assigns a unique or user-specific ETag value to a cached resource; on subsequent requests the browser returns that value (typically via conditional request headers), allowing the server to re-identify the client. Because this mechanism can persist and be read back independently of traditional cookies, sources describe it as capable of tracking users across sessions despite changing IP addresses or disabling JavaScript and cookies. Where such tracking involves storing or accessing information on a user's device and processing personal data, it may fall within the same legal regimes that govern cookies and similar technologies, generally the ePrivacy rules on device storage/access and, separately, data protection law such as the GDPR for any resulting processing of personal data. The applicability, consent requirements, and whether a given ETag use is exempt (for example, as strictly necessary caching versus tracking) depend on the specific purpose and facts and are not resolved by this definition; jurisdictional scope and enforcement positions may vary.
Why it matters
ETag tracking illustrates a broader challenge in privacy compliance: identifiers can be built from standard web infrastructure that was never designed for surveillance. Because the ETag header exists primarily to help browsers validate cached content, a server can quietly assign each visitor a unique value and read it back on later requests. This means a site can potentially re-identify a user even when that user has disabled cookies and JavaScript, cleared traditional tracking mechanisms, or changed IP addresses. For privacy officers and compliance teams, this matters because it undermines the assumption that consent controls and cookie-clearing behavior give users meaningful control over tracking.
Who it's relevant to
Privacy Officers and Data Protection Professionals
ETag tracking is relevant when auditing how a site or its vendors identify users, because it can persist even where cookie consent has been withdrawn or cookies disabled. Where an ETag is used for tracking rather than legitimate caching, it may engage ePrivacy rules on device storage and access and, separately, the GDPR for any resulting processing of personal data. Because this depends on purpose and facts, these teams should assess ETag uses case by case rather than assuming non-cookie technologies are out of scope.
Web Developers and Engineering Teams
Developers configure the caching behavior that determines whether ETags serve their intended validation function or could be repurposed as persistent identifiers. Understanding the distinction helps teams avoid inadvertently building identifier-like behavior into caching headers and helps them explain to compliance stakeholders how ETags are actually used on their systems.
Legal Counsel and Compliance Teams
Counsel advising on tracking technologies should recognize that consent and disclosure obligations generally follow the purpose of a technology rather than its label. ETag tracking may fall within the same regimes governing cookies and similar technologies, but the applicable requirements, exemptions, and enforcement positions can vary across the EU, the UK, and other jurisdictions, so fact-specific legal judgment remains necessary.
Marketing and Analytics Compliance Teams
Teams relying on third parties for measurement or advertising should confirm whether any vendor uses ETag-based re-identification, since such techniques can operate outside standard consent controls and may not be captured by common privacy settings. This is important for ensuring that vendor practices align with the consent choices users have actually made.
Inside ETag Tracking
ETag (Entity Tag)
An HTTP response header originally designed for cache validation, allowing a browser and server to determine whether a cached resource is still current. The server assigns a unique identifier to a resource, and the browser returns it on subsequent requests via the If-None-Match header.
Repurposing for tracking
Because a server can embed a unique per-user value in an ETag and read it back when the browser revalidates a resource, the mechanism can be misused to persistently identify a device or user without setting a traditional cookie. This is often described as a form of 'supercookie' or covert tracking technique.
Storage and access on the user's device
ETag values are cached by the browser on the user's terminal equipment. Reading them back involves accessing information stored on that device, which in most EU jurisdictions brings the technique within the scope of the ePrivacy rules governing the storing of and gaining access to information on a user's device.
Relationship to personal data
Where an ETag identifier is used to single out or re-identify an individual or their device, the resulting values may constitute personal data. In that case the GDPR generally applies to the subsequent processing, in addition to the ePrivacy obligations that govern the access to the stored value.
Cookieless and resistant-to-deletion characteristics
Unlike standard cookies, ETag tracking does not rely on cookie storage and may persist even after a user clears cookies, because the value resides in the browser cache. This is a commonly cited concern with such techniques, though behavior depends on browser caching and cache-clearing behavior.
Common questions
Answers to the questions practitioners most commonly ask about ETag Tracking.
Is ETag tracking exempt from consent because ETags are a standard part of the HTTP caching mechanism rather than cookies?
No. The fact that ETags serve a legitimate technical purpose in HTTP caching does not exempt their use for tracking from consent obligations. In most EU jurisdictions, the ePrivacy Directive as implemented nationally governs the storing of, or gaining access to, information stored on a user's device, and this is generally understood to be technology-neutral. Where an ETag is repurposed to identify or re-identify a user across requests, it typically falls within the same rules as cookies, regardless of the underlying caching functionality. The relevant question is the purpose for which the ETag value is accessed, not whether the mechanism is labelled a cookie. Whether a specific ETag use qualifies for the strictly necessary exemption depends on the facts and is not resolved by the caching label alone.
Does deleting cookies or blocking cookies protect users from ETag tracking?
Not necessarily. ETag tracking does not rely on the cookie store, so clearing cookies or refusing cookie-based tracking may leave ETag-based identifiers unaffected. This is one reason ETag tracking is sometimes discussed alongside other cookieless techniques. It should not be assumed that a consent choice expressed through a cookie banner, or a user's cookie deletion, automatically extends to ETag-based tracking unless the consent management setup and the underlying implementation actually account for it. From a compliance standpoint in the EU, the same consent standard generally applies to ETag tracking as to cookies where personal data or device access is involved; the technical persistence of ETags does not create a lawful basis on its own.
How should an organization identify whether ETag tracking is present on its own or third-party services?
ETag tracking is not surfaced by tools that inspect only the cookie store, so identification generally requires examining HTTP response and request headers to see whether ETag values are being used to distinguish or re-identify users rather than solely to validate cached resources. Reviewing how caching headers are configured, and auditing third-party scripts, SDKs, and content delivery configurations, may help. Because behaviour depends on server-side logic that is not always visible from the client, a technical audit may need input from engineering teams or vendors. This entry does not cover specific tooling, and identification approaches vary by environment.
How can ETag tracking be brought under a consent management platform (CMP)?
Because ETags are handled at the HTTP header level rather than through the cookie store, standard CMP mechanisms that gate cookie-setting scripts may not automatically control ETag-based tracking. Bringing it under consent management generally requires ensuring that any ETag use intended for identification is suppressed or not activated until a valid consent signal is present, which may involve server-side or configuration changes rather than client-side script blocking alone. Organizations should not assume that deploying a CMP resolves ETag tracking without verifying that the specific implementation is actually governed by the consent state. A CMP supports compliance but does not by itself guarantee it.
What records should be kept regarding ETag tracking for accountability purposes?
Where ETag tracking involves device access or personal data processing that requires consent in the relevant jurisdiction, the same record-keeping and demonstrability expectations that apply to other tracking technologies would generally apply. This may include documenting the purpose of the ETag use, how it is disclosed to users, and how consent (where required) is obtained and logged. Because ETag tracking is less visible than cookies, clear internal documentation of where and why it is used can support accountability. The precise records required depend on the applicable legal regime and the facts of the deployment, which are outside the scope of this definition.
How should ETag tracking be reflected in a cookie or tracking notice?
If ETag tracking is used for purposes beyond strictly necessary caching, in most EU jurisdictions it may need to be disclosed to users in the same informed manner as cookies and similar technologies, even though it is not literally a cookie. Notices that reference only cookies by name may be incomplete where cookieless techniques such as ETags, pixels, local storage, or fingerprinting are also in use. Whether and how ETag tracking must be described depends on its purpose, the applicable jurisdiction, and current regulatory guidance, and this entry does not provide notice wording or resolve contested questions about the boundary of the strictly necessary exemption.
Common misconceptions
Because ETags are not cookies, cookie consent rules do not apply to ETag tracking.
In most EU jurisdictions the ePrivacy rules apply to the storing of and access to information on a user's device regardless of the technology used. Where an ETag is accessed for tracking rather than a strictly technical purpose, consent may be required just as it typically would be for a non-essential cookie.
ETags are purely a technical caching mechanism and therefore always exempt from consent.
The consent analysis generally turns on purpose, not on the technical label. An ETag used solely for genuine cache validation may fall within an exemption for strictly necessary functionality, but the same header used to persistently identify users would typically not qualify for that exemption.
Users can fully avoid ETag tracking simply by deleting their cookies.
ETag values are stored in the browser cache rather than in cookie storage, so clearing cookies alone may not remove them. The extent to which they persist depends on browser and cache behavior, and clearing the cache or other measures may be needed.
Best practices
Inventory whether ETags or similar caching headers on your properties carry per-user identifiers, and document whether they serve a genuine technical purpose or are being used to identify devices or users.
Assess ETag tracking under both the ePrivacy rules governing access to information on the device and, where identifiers relate to individuals, the GDPR that may apply to the resulting processing; do not treat the two regimes as interchangeable.
Where ETags are used for non-essential tracking in the EU, obtain prior consent meeting the standard of a clear affirmative action before deploying them, rather than relying on the cache mechanism operating silently.
Limit ETag values used for legitimate caching to non-identifying content so they are not capable of singling out individuals, and avoid encoding unique per-user tokens unless a lawful basis and any required consent are in place.
Include ETag-based and other non-cookie storage techniques in the scope of your consent management platform or equivalent controls, since a CMP configured only for conventional cookies may not cover them.
Consult qualified legal counsel on the scope and enforcement position in each relevant jurisdiction, as requirements differ between the EU, the UK, and individual US states, and guidance on covert tracking techniques continues to evolve.
