How Websites Recognise You: Cookies, Ad IDs and Logins

Additional resource for the lesson “Cookies and Identifiers: How You Are Recognised” — Online Anonymity course

How websites recognise you is rarely a mystery of clever technology. Most of the time it comes down to a few ordinary links: a cookie your browser keeps, an advertising ID on your phone, and above all the accounts you are signed in to. This resource helps you see those links in one normal session, and loosen the ones you do not need.

A. Why this matters

In this course, privacy means deciding what others know about you; anonymity means being able to act without what you do being tied back to who you are. Recognition sits exactly between the two. A site that recognises you on your second visit can connect it to the first, and to everything it already knows.

That connection is not always unwelcome. It keeps your basket full and saves you logging in every morning. The question this resource asks is narrower: where is the link, who holds it, and does it reach further than you expected?

What the sources say

The European Commission, explaining EU data protection rules, lists “a cookie ID” and “the advertising identifier of your phone” among its examples of personal data, alongside a name or an email address. An identifier that recognises you is treated as being about you.

The Electronic Frontier Foundation (EFF), a digital rights organisation, defines cookies in its Surveillance Self-Defense glossary as a technology that lets “websites recognize your browser”. It adds that they enable tracking and profiling “even if you don’t have an account with that site, or aren’t logged in.”

In a 2019 report on corporate tracking, the EFF describes ad servers that “set third-party cookies into users’ browsers and track their activity across the network”. The same report observes that “log-in services are more reliable trackers than pixels or other simple widgets”.

Mozilla, which makes the Firefox browser, is clear about the limits of private browsing: “A Private Window doesn’t make you anonymous online.” And once you sign in, “that site knows it’s you for the rest of the session”.

B. Key concepts: how websites recognise you

Six ideas, from the lightest link to the strongest, and one way of separating them.

First-party cookies: the site’s own memory

A cookie is a small piece of data a website asks your browser to store and send back on your next visit. A first-party cookie belongs to the site in your address bar: it remembers your language, your basket or the fact that you are signed in. The Cyber Welfare glossary entry on cookies explains the basics and how to manage them.

Why it matters to you: First-party cookies link your visits to one site. Useful, and usually limited to that site, but deleting them is what usually makes a site “forget” you.

Third-party cookies and cross-site tracking

A third-party cookie is set by a company other than the site you are visiting, through an advert, a social button or an invisible piece of code on the page. If the same company is present on many sites, its cookie can recognise your browser on each of them. This is cross-site tracking: your visits to unrelated sites joined into one trail.

Why it matters to you: This is the link you see least, because the company holding it is not the one you chose to visit. It is also a link your choice of browser can loosen, as the Online Security resource below explains.

The advertising ID on your phone

Phones have a separate identifier for advertising, which apps can ask for. Google describes the Android advertising ID as “a unique, user-resettable and user-deletable ID for advertising”. Once it is deleted, Google explains that apps asking for it “will receive a string of zeros instead of the identifier.”

On Android, Google’s help page puts the options under Settings › Privacy › Ads. On iPhone, Apple explains that if you choose “Ask App Not to Track”, the app “can’t access the system advertising identifier (IDFA)”; the setting is under Settings › Privacy & Security › Tracking.

Why it matters to you: Resetting the ID gives apps a new number, although the EFF notes that trackers can sometimes connect the old and new ones through other identifiers, such as your IP address. Deleting it, or asking apps not to track, removes this particular link.

Being signed in: the strongest link

Cookies and ad IDs recognise a browser or a device. An account recognises a person, or at least a named profile. When you are signed in, every page you visit on that service can be tied to your account, whatever browser, network or device you use.

Why it matters to you: This is why the EFF calls log-in services more reliable trackers than pixels or other simple widgets. Signing out of services you are not using right now is one of the simplest ways to loosen the link.

“Sign in with…”: one account, many doors

Social login lets you open an account on a new site with an existing Google, Apple or social media account. It saves a form, but it also joins two services together.

Google’s help page says that the first time you use Sign in with Google, you agree to share “the name, email, and profile picture on your Google Account with the linked app.”

Why it matters to you: Each “Sign in with…” adds a door to the same identity. A separate email and password for a service you use rarely keeps that service apart.

Separating contexts: private windows, profiles and containers

Some tools keep one part of your browsing from being linked to another. A private window, Mozilla explains, deletes “the browsing history, cookies, and site data from that session” when you close it, but “doesn’t hide your IP address or your location.” A browser profile goes further: Firefox describes “complete separation of all data between profiles”, useful to “keep work and personal browsing separate”. Mozilla’s Multi-Account Containers extension works inside one profile and separates “only cookies, logins and site data”.

Why it matters to you: None of these makes you anonymous. Each one keeps two parts of your life from sharing the same cookies and sign-ins, which is often all you need.

C. A practical example: Elena’s Thursday browsing

Elena is 35 and works in marketing, so she knows the language of audiences and retargeting from the other side. On a Thursday she does nothing out of the ordinary. In the morning she checks work tools in her usual browser, where she is also signed in to her personal email and a social network. At lunch, in the same browser, she compares a few holiday flats by the sea. In the evening she downloads a recipe app on her phone and opens an account with one tap, using her social media login.

On Friday, adverts for seaside flats follow her onto a news site and into a free game on her phone. Elena is not alarmed; she is curious, because she cannot tell which link did it. It might have been a third-party cookie from the flat sites, her signed-in social account, or her phone’s advertising ID. That uncertainty is the point: several links were active at once, and all of them led back to her.

What changed when Elena counted the links

That weekend she did the exercise in section D, with a cup of tea rather than a sense of urgency:

• She counted eleven moments in one evening when she was recognised, and noticed that most of them came from one browser where work, email and social media all lived together.
• She created a second browser profile for personal browsing and left work in the first.
• On her phone, she reset the advertising ID and, in the recipe app, replaced the social login with its own email and password.

She kept what she valued: staying signed in to her work tools and her email. She did not try to cut every link; she simply made it less likely that a lunchtime search for a holiday would travel with the rest of her online identity.

D. Try it yourself: count the moments you are recognised (15 minutes)

Four short steps, during or just after an ordinary browsing session. There is no score to reach, and no right number.

Step 1 — Take one normal session (4 minutes)

• Use your usual browser, or your phone, as you normally would for ten minutes: news, email, shopping, social media.
• Then write down every site or app you opened, in order.
• Do not change anything yet. The aim is to see your usual habits, not a tidier version.

Step 2 — Mark each way you were recognised (4 minutes)

Next to each site or app, write one or more letters:

• S if you were signed in to an account there.
• L if you signed in with another account (“Sign in with…”).
• C if the site remembered something without a sign-in: your language, a basket, a cookie banner it did not ask about again.
• A if it was an app that shows adverts, where the advertising ID may be in play.

Step 3 — Find the links that cross contexts (3 minutes)

• Circle the moments where one link reaches across two parts of your life: the same account in work and personal browsing, or a social login used for a shopping app.
• Count how many letters are S or L. They are usually the strongest links on the page.
• Notice which single browser or account appears most often. That is where separation helps most.

Step 4 — Cut two links (4 minutes)

Choose two, and only two:

• Sign out of one service you are not actively using in your main browser.
• Open a second browser profile, or a second browser, for one part of your life, such as shopping or social media.
• Replace one “Sign in with…” with a separate email and password.
• Reset or delete your phone’s advertising ID (on Android, usually under Settings › Privacy › Ads), or, on iPhone, check Settings › Privacy & Security › Tracking.

Two links you chose to cut are worth more than a long list of settings you might change one day.

Already covered in the Online Security course

Privacy Focused Browser: The Setting You Use All Day
It covers choosing the browser you use all day with privacy in mind; this resource looks at the cookies, IDs and sign-ins that link your visits, whichever browser you choose.

Already covered in the Online Privacy course

Privacy Dashboard: What ‘Free’ Services Know About You
It shows how to look at what services already hold about you through their dashboards; this resource looks at the links that let them recognise you in the first place.

E. Videos, articles and further resources

Institutional sources first, then digital rights guides and official platform help pages. All in English.

Institutional sources

European Commission — Data protection explained
What counts as personal data under EU rules, with everyday examples including a cookie ID and your phone’s advertising identifier.
https://commission.europa.eu/law/law-topic/data-protection/data-protection-explained_en

Digital rights guides

Electronic Frontier Foundation — Surveillance Self-Defense glossary: Cookies
A short definition of cookies and how they allow tracking even without an account.
https://ssd.eff.org/glossary/cookies

Electronic Frontier Foundation — Behind the One-Way Mirror: A Deep Dive Into the Technology of Corporate Surveillance
A 2019 report on third-party tracking, advertising IDs (and why resetting them is not a clean break) and log-in services, with a link to the full text.
https://www.eff.org/document/behind-one-way-mirror-deep-dive-technology-corporate-surveillance

Platform documentation

Play Console Help (Google) — Advertising ID
What the Android advertising ID is and how a user can reset or delete it.
https://support.google.com/googleplay/android-developer/answer/6048248?hl=en-GB

Apple Support — If an app asks to track your activity
What “tracking” means on iPhone, what “Ask App Not to Track” changes and where the setting lives.
https://support.apple.com/en-kz/102420

Google Account Help — How Sign in with Google works
What is shared when you sign in with your Google Account, and how to review linked apps.
https://support.google.com/accounts/answer/12849458

Firefox Help (Mozilla) — How Private Windows protect you
What a private window deletes when you close it, and what it does not hide.
https://support.mozilla.org/en-US/kb/common-myths-about-private-browsing

Firefox Help (Mozilla) — Manage Firefox profiles
How separate profiles, and containers within one profile, keep cookies and sign-ins apart.
https://support.mozilla.org/en-US/kb/profile-management

Links checked in November 2026. If an address changes, searching for the title on the organisation’s site usually finds it.

F. The Cyber Welfare Framework: Skills, Awareness, Secure Behaviour

This resource sits on the Awareness pillar at level FL2 – Beginner: noticing the links that connect your visits before deciding which ones to keep.

Skills

• Telling a first-party cookie, a third-party cookie, an advertising ID and a sign-in apart.
• Finding the advertising ID or tracking settings on your own phone.
• Setting up a second browser profile or a container for one part of your life.

Awareness

• Understanding that being signed in is usually a stronger link than any cookie.
• Knowing that a private window deletes cookies when you close it but does not make you anonymous.
• Recognising that each “Sign in with…” joins two services to the same identity.

Secure Behaviour

• Signing out of services you are not using, especially in the browser you use for everything else.
• Keeping work, personal and shopping browsing in separate profiles where it helps.
• Resetting your advertising ID now and then, and asking apps not to track when they offer the choice.

G. Questions to sit with

• Which single account, if it were the only link left, would still tell a company the most about your week?
• Where does being recognised genuinely make your life easier, and where are you simply used to it?
• If your browsing were split into two separate profiles tomorrow, where would you draw the line?

H. What to do now

The recommendations (R) and security measures (MS) from the Cyber Welfare database that apply most directly here.

1. Accounts and sign-ins

• R31 — Limit social login: each “Sign in with…” links a new service to an account you already have. In your Google Account you can review the apps linked this way and remove the ones you no longer use.
• Sign out of accounts you are not actively using in the browser where you read, search and shop.

Minimum commitment: today, replace or remove one “Sign in with…” link for a service you rarely use.

2. Browser and phone

• MS5 — Use a privacy-respecting browser such as Firefox or Brave, so that fewer third-party links are made in the first place (see the Online Security resource above).
• MS11 — Use a service’s mobile website instead of its app where that works for you: the advertising ID is something apps ask for, and an app you do not install cannot ask for permissions.
• Reset or delete your phone’s advertising ID when the platform offers it, so that new activity is harder to connect to the old; deleting it removes the ID altogether.

Minimum commitment: this week, reset or delete your phone’s advertising ID once, or check that apps cannot ask to track you.

In short

• How websites recognise you comes down to a few links: cookies, advertising IDs, sign-ins and “Sign in with…”.
• Being signed in is usually the strongest link; third-party cookies are the least visible.
• Private windows, separate profiles and containers keep parts of your life apart, but none makes you anonymous.
• You do not have to cut every link. Cut the ones that reach further than you want.

Related resources in this course

• What Your IP Address Reveals: Location, Provider and Metadata
• Re-identification: Why a Few Details Can Identify You
• Browser Fingerprinting Test: Check Yours with Cover Your Tracks

Discover more companion resources from the online courses of the Protect Your Digital Privacy programme.