Dark green background, "Weak Application Security Can Cost You Millions," 3 slanted images of fingers pointing to digital locks, and a "Learn the Basics" button

Category: Tracking Technologies

Supercookies

Simply put

A supercookie is a persistent tracking mechanism used to identify and follow a user across websites, often in ways that are harder to detect and remove than ordinary cookies. Unlike standard cookies stored as small files that users can typically clear from their browser, supercookies may be inserted at the network level or stored in less obvious locations, allowing a tracker to link together visits to different sites. The term covers a range of techniques rather than a single technology.

Formal definition

"Supercookie" is a general term for a range of persistent tracking techniques that assign and retain a unique identifier for a user or device in a manner more resistant to deletion than conventional HTTP cookies. Documented mechanisms include identifiers injected into HTTP headers at the network layer to observe browsing activity, as well as browser fingerprinting approaches that store or reconstruct an identifier through browser features such as favicons, enabling re-identification even after standard cookies are cleared. Because these techniques store information on, or access information about, a user's device and can be used to build cross-site profiles, they generally fall within the same legal regimes as cookies: the ePrivacy Directive (and its national implementations) governs the storing of or gaining access to information on the device, while the GDPR governs any resulting processing of personal data. Where such tracking is not strictly necessary for a service requested by the user, prior consent is typically required in most EU jurisdictions, though the precise treatment of any given technique depends on its technical operation and on evolving guidance from data protection authorities. The evidence provided describes the concept and example techniques but does not establish enforcement positions, so the lawfulness of specific supercookie implementations is out of scope for this definition.

Why it matters

Supercookies matter because they can undermine the transparency and control that cookie consent frameworks are designed to provide. When a tracking identifier is inserted at the network level within HTTP headers, or reconstructed through browser features such as favicons, it can persist even after a user clears their standard cookies. This means a user who takes deliberate steps to reset their tracking preferences may still be re-identified and followed across websites, defeating the choices that consent mechanisms are meant to honor.

For compliance teams, supercookies are significant because they generally fall within the same legal regimes as ordinary cookies. In most EU jurisdictions, the ePrivacy Directive (and its national implementations) governs the storing of or gaining access to information on a user's device, while the GDPR governs any resulting processing of personal data. A technique being harder to detect than a conventional cookie does not place it outside these rules; where the tracking is not strictly necessary for a service the user has requested, prior consent is typically required. Organizations that rely on such techniques, or whose vendors do, may therefore carry consent and transparency obligations they have not accounted for.

The practical challenge is that supercookies are not a single technology but a family of techniques, and their treatment depends on how each one operates. The evidence here describes the concept and example mechanisms but does not establish enforcement positions, so the lawfulness of any specific implementation cannot be assumed and depends on facts and on evolving guidance from data protection authorities.

Who it's relevant to

Privacy officers and data protection professionals

Supercookies can persist beyond the tracking choices a user makes, which raises questions about whether consent and transparency obligations are being met. Privacy teams may need to inventory the tracking techniques used across their own properties and by third-party vendors, and to assess whether any non-essential techniques require prior consent, which is typically the case in most EU jurisdictions.

Legal counsel and compliance teams

Because supercookies generally fall within the ePrivacy Directive for device access and the GDPR for any resulting processing of personal data, counsel may need to evaluate specific implementations against these regimes. The lawfulness of a particular technique depends on its technical operation and on evolving guidance from data protection authorities, so assessments should be treated as fact-specific rather than settled.

Web developers and engineering teams

Developers should understand how techniques such as network-level header injection or favicon-based fingerprinting operate, since these can persist even after standard cookies are cleared. Awareness helps teams avoid unintentionally deploying tracking that bypasses user controls and helps ensure that consent decisions are actually enforced at the technical level.

Marketing compliance teams

Marketing teams relying on measurement or targeting vendors should confirm what tracking mechanisms those vendors use, as supercookie techniques may carry consent obligations that ordinary cookie tooling does not surface. Tools support compliance but do not replace legal judgment, so vendor claims should be verified against how each technique actually works.

Inside Supercookies

Persistent tracking identifiers

Supercookies rely on identifiers that are difficult for users to remove through ordinary browser controls, distinguishing them from conventional HTTP cookies that can typically be cleared through browser settings.

Network-level injection

Some supercookies take the form of unique tracking headers or tokens inserted by an internet or mobile network operator into outgoing web requests, operating outside the storage mechanisms of the browser itself.

Alternative storage and recreation techniques

Supercookies may exploit mechanisms such as local storage, cached data, or other device-side persistence to store or regenerate identifiers, and in some cases can restore deleted conventional cookies (behavior sometimes associated with 'zombie' or respawning cookies).

Regulatory scope under the ePrivacy Directive

To the extent supercookies involve placing or accessing information on a user's terminal equipment, they generally fall within the ePrivacy Directive's rules (as implemented nationally in the EU), which typically require prior consent unless a specific exemption applies. Network-injected identifiers may raise distinct legal questions depending on how and where they operate.

Interaction with the GDPR

Where supercookies enable identification of an individual or the processing of personal data that follows, the GDPR applies to that processing in addition to any ePrivacy obligations. Satisfying one regime does not automatically satisfy the other.

Common questions

Answers to the questions practitioners most commonly ask about Supercookies.

Are supercookies just another type of browser cookie that users can delete like normal cookies?

No. Despite the name, supercookies are not standard HTTP cookies stored in the browser's cookie store, and they generally cannot be removed through the browser's ordinary cookie-clearing controls. The term is used loosely to describe persistent tracking mechanisms that survive normal cookie deletion, such as those relying on data stored outside the conventional cookie file or reconstructed from other identifiers. Because they resist standard deletion, treating them as equivalent to regular cookies for user-control purposes is misleading.

Do supercookies fall outside cookie consent rules because they are not technically cookies?

Not in most EU jurisdictions. The ePrivacy Directive's rules on storing or accessing information on a user's device are generally understood to apply by function rather than by the literal use of a cookie file, so similar technologies can fall within the same consent requirements even though they are not literally cookies. Where a supercookie technique involves storing information on or reading information from the user's device, prior consent may be required unless a recognized exemption applies. Any resulting processing of personal data would separately engage the GDPR. Scope and enforcement positions can vary by jurisdiction and by the specific technique involved.

How can an organization detect whether supercookie-style tracking is present on its own properties?

Detection typically involves auditing what a site and its third-party components store on or read from the user's device beyond the standard cookie store, and testing whether identifiers persist or are reconstructed after cookies are cleared. This can include reviewing third-party scripts, SDKs, and network-level behavior. Because these techniques can be obscured and may be introduced by vendors, an audit generally requires both technical inspection and vendor due diligence. This description is general; the appropriate method depends on the specific technologies in use.

Should supercookies be handled through the same consent management platform used for ordinary cookies?

Where a supercookie technique triggers consent obligations, it generally should be governed by the same consent logic and records as other non-essential technologies, meaning it should not fire before valid consent is obtained where consent is required. However, a consent management platform can only control mechanisms it is configured to recognize and block; techniques operating outside its visibility may not be governed by it. A CMP supports compliance but does not by itself guarantee that all such tracking is captured, and legal judgment remains necessary.

What should be done if a third-party vendor is found to be using supercookie-style tracking?

Typical steps include identifying the technique and its purpose, assessing whether it triggers device-access consent requirements and any GDPR processing obligations, and reviewing the contractual and disclosure arrangements with the vendor. Organizations may need to require the vendor to disable or modify the technique, ensure it is not triggered before any required consent, and update transparency notices accordingly. The appropriate response depends on the facts, the applicable jurisdiction, and the role each party plays.

How should supercookies be described to users in a cookie or tracking notice?

Where these techniques are used and disclosure is required, notices should generally describe the tracking in terms users can understand, including its purpose and persistence, rather than omitting it because it is not a conventional cookie. The standard of informed consent under the GDPR requires that users be given clear information before any required consent is sought. The exact wording and placement depend on the technique and the applicable jurisdiction's transparency expectations, which can differ between the EU, the UK, and individual US states.

Common misconceptions

Deleting cookies in the browser removes supercookies.

A defining characteristic of supercookies is that they are generally not removed by ordinary cookie-clearing controls, because they may rely on alternative storage, regeneration techniques, or network-level injection that sits outside standard browser cookie management.

Because supercookies are not standard HTTP cookies, they escape cookie consent rules.

In most EU jurisdictions, the ePrivacy rules on placing and accessing information on a user's device are technology-neutral and can apply to techniques that are not literally cookies. Where a supercookie stores or accesses information on the device, consent may be required, and network-injected identifiers can raise separate legal questions rather than a blanket exemption.

Supercookies are simply a more effective form of the same tracking and carry the same compliance treatment as ordinary analytics cookies.

Their persistence and, in some cases, network-level operation can make meaningful user control and withdrawal of consent harder to achieve, which may complicate compliance with requirements that consent be freely given and revocable. The precise treatment depends on the specific technique, the jurisdiction, and evolving regulatory guidance.

Best practices

Inventory all tracking technologies in use, not just conventional cookies, so that supercookies, alternative storage mechanisms, and any network-level identifiers are identified and assessed.

Assess each technique against both the applicable ePrivacy implementation and, where personal data is processed, the GDPR, treating the two regimes as separate obligations rather than assuming one satisfies the other.

Avoid deploying persistence or respawning techniques that recreate identifiers after a user has cleared them or withdrawn consent, as these can undermine the requirement that consent be revocable and that user choices be honored.

Where consent is required, obtain it before the technology places or accesses information on the device, using a clear affirmative action rather than pre-ticked boxes or implied consent, and provide an equally accessible means to withdraw it.

Confirm the geographic scope of your user base and map obligations accordingly, since requirements differ between the EU, the UK, and individual US states, and enforcement positions continue to evolve.

Document the technologies used and the legal basis relied on, and seek legal review for contested or novel techniques such as network-injected identifiers, recognizing that consent management tooling supports but does not replace legal judgment.