How cookies can track you (Simply Explained)

So we’ve all heard how companies like Facebook and Google can use cookies to follow us around the internet and keep track of what we’re interested in. They do this to sell targeted ads or in some cases even share that data with others without our permission. In recent months, there has been a lot of fuss around the fact that Facebook tracks its users across the internet. So how do they do this? Before we dive in, let’s look at what cookies are and why they exist. Let’s start with some quick history. The cookie was created in 1994 by an employee of Netscape Communications, the same company that made the browser. He was creating an online shop, and he didn’t want to store the contents of the shopping cart on the server. Instead, he wanted a way to save it on the computers of the visitors, right until they made their purchase.

The reason for this is simple: if the server doesn’t have to keep track of everyone’s shopping cart, it has less work and can save money. In 1994 the Netscape browser implemented cookies and the next year Internet Explorer followed suit. However two years later – in 1996 – the first concerns were raised when it was discovered that cookies could potentially invade our privacy. That would turn out to be very true, but we’re getting ahead of ourselves here. Let’s take a look at how cookies work. Let’s imagine we have a website that requires people to log in to see the contents of the site. When you log in, your browser sends your username and password to the server, who verifies them and – if everything checks out – sends you the requested content.

However, there is a small caveat. The HTTP protocol – which is what we use to browse the internet – is stateless. That means that when you make another request to that same server, it has forgotten who you are and will ask you to log in again. Can you imagine how time-consuming it would be to browse around a site like Facebook and having to log in again every time you click on something? So cookies to the rescue! You still log in to the website, and the server still validates your credentials. If everything checks out, however, the server not only responds with the content but also sends a cookie to your browser. The cookie is then stored on your computer and submitted to the server with every request you make to that website. The cookie contains a unique identifier that allows the server to “remember” who you are and keep you logged in. As you can see, cookies are very useful, and they make our lives a lot easier. But it doesn’t stop there! Besides keeping you logged in, cookies can also be used to store your settings.

Let’s say you change the number of results your favorite search engine should return. Chances are high that they save this preference in a cookie and not on their servers. But there are also some restrictions on the use of cookies. Most browsers only allow websites to store a maximum of 300 cookies and they cannot contain a lot of data (just 4096 bytes). The biggest limitation, however, is the fact that cookies set by one website, cannot be read by another. And that restriction raises the question: how can companies use cookies to track us around the internet? Especially if a cookie from one website cannot be read by another. How can Facebook for instance track what sites we visit? Well, the whole process starts when you log in to Facebook. To remember that you’re logged in, Facebook stores a cookie on your computer, nothing unusual about that, many other sites do the same thing.

This cookie is scoped, or bound to Facebook’s domain name, meaning that no one else besides facebook.com can read what’s in the cookie. Let’s now imagine that you browse away and you land on someone’s blog. The blog cannot read your Facebook cookie, and the scope prevents that. Facebook also can’t see that you’re on this blog. All is well. But let’s now assume that the owner of the blog places a Facebook like button on his website. To show this like button, your browser has to download some code from the Facebook servers, and when it’s talking to facebook.com, it sends along the cookie that Facebook set earlier. Facebook now knows who you are and that you visited this blog. I’m using Facebook as the example here, but this technique is used by many other companies to track you around the internet. The trick is simple: convince as many websites as possible to place some of your code on their sites.

Facebook has it easy because a lot of people want a like or share button on their website. Google also has an easy job because many websites rely on its advertisement network or on Google Analytics. At this stage, cookies are getting out of hand. I read the cookie policy of a few popular websites. Here is an overview of how many cookies they expose you to. Reading some tech news on CNET: 100 cookies Finding a song on last.fm: 82 cookies. Reading The New York Times: 57 cookies Finding a job or connecting with your network on LinkedIn 28 cookies. And then some companies take it to the extreme. The company behind Yahoo mentions that their websites could use up to 455 third-party cookies. 455! That’s just outrageous! Granted, not all of these cookies track you around.

In fact, a handful of them are essential for the site to work correctly, like a session cookie to remember that you’re logged in. However, the majority of cookies on these websites don’t serve the user. They are there to track you or to display more targeted ads. So what can we do to prevent these cookies from tracking us on the internet? As a user, you can protect yourself from trackers by installing a browser extension that blocks them like Privacy Badger or Ghostery. You could also switch to a browser with built-in privacy protection tools like Brave or Safari. And if you don’t want to do anything, the law is on your side. More and more politicians realize that cookies are a threat to privacy and that the use of trackers should be regulated. In Europe, we have the GDPR which requires websites to be transparent about their use of cookies and requires sites to offer users a simple way to opt-out. You’ve probably seen these annoying cookie banners asking for your permission. Next time you see them, don’t just click on accept but look at what cookies the website wants to place on your computer and for what purpose.

So to summarize: cookies were invented to make our lives easier and allow us to stay signed into websites or remember the settings that we changed. However, the downside is that cookies, along with other techniques, can be used by large corporations to follow us around on the internet and gather data about us that they can potentially sell to others. I hope you found this video interesting and that you learned something from it. If you did, you can support me by subscribing to this channel and giving this video a thumbs up. Thank you so much for watching, and I’ll see you in the next one!.