Website Tracking Technologies & Privacy

Modern websites can collect information about visitors almost instantly. Some of this technology performs routine functions, such as keeping users logged in or remembering items placed in a shopping cart. Other tools can record how someone interacts with a webpage, identify a returning device, transmit information to outside companies, or help connect website activity to an advertising profile.

Much of this happens in the background.

Cookies, tracking pixels, session replay software, analytics scripts, browser fingerprinting, and similar technologies can all play a role in website data collection. The use of these tools is not automatically unlawful, but privacy concerns can arise depending on what information is collected, where it is sent, what the user was told, and whether applicable law required consent or placed restrictions on the collection or disclosure.

Net Law Advocates represents individuals nationwide in matters involving website tracking and other forms of digital privacy and cyber law.

What Are Website Tracking Technologies?

Website tracking technologies are pieces of code, files, scripts, or other technical tools that collect information about visitors and their interactions with a website.

The information collected varies considerably. A technology might simply record that a webpage was viewed. Other tools can potentially capture clicks, searches, form interactions, device information, identifiers, and other details about a visitor’s activity.

The U.S. Department of Health and Human Services describes tracking technology generally as script or code used on a website or mobile application to gather information about users or their actions. HHS identifies cookies, tracking pixels, session replay scripts, and fingerprinting scripts among technologies commonly used on websites.

Different technologies also perform different functions, which is why understanding what is actually operating on a website can be important when evaluating a potential privacy issue.

Cookies Can Recognize Browsers Over Time

Cookies are small pieces of information stored through a user’s web browser.

Some cookies exist only during a browsing session and disappear when the session ends. Others remain on a device and can allow a website or service to recognize the same browser during later visits.

Cookies can serve useful functions. They may remember login information, preserve shopping-cart contents, store preferences, or help a website operate correctly.

They can also be used for tracking.

The Federal Trade Commission explains that persistent cookies can record information across visits, while cookies more generally can collect information about pages viewed and activities performed on a website.

Whether a particular cookie creates a privacy concern depends on its purpose, the information associated with it, who can access that information, and how the information is ultimately used.

Tracking Pixels Can Transmit Information to Third Parties

Tracking pixels can be much less visible to users.

Historically, a tracking pixel could take the form of a tiny image embedded in a webpage. The term now encompasses broader forms of code capable of collecting and transmitting information when someone interacts with a website.

Pixels are commonly used for advertising measurement, audience analytics, conversion tracking, and retargeting.

For example, a company advertising through a social media platform might place that platform’s tracking technology on its website. A visitor takes an action on the site, and information about the interaction may be transmitted back to the platform.

Depending on how the technology is configured, transmitted information could potentially include details about pages viewed, purchases, searches, or information entered into a webpage.

The FTC has specifically examined the privacy implications of pixels, noting that they may operate invisibly and can transmit personal or identifying information to third parties.

That becomes particularly significant when a visitor is interacting with sensitive content.

Session Replay Can Reconstruct How Someone Used a Website

Session replay technology is designed to give website operators insight into how visitors interact with individual pages.

Rather than simply recording that a page received a visit, session replay software may capture a sequence of user interactions. HHS describes session replay scripts as technologies capable of recording activities such as mouse movements, clicks, and typing while someone uses a webpage or app.

Businesses can use this information to diagnose website problems and understand user behavior. But depending on the configuration, the technology can also create privacy concerns about the level of detail being captured and whether visitors understood that their interactions were being recorded.

The relevant facts may include which pages were monitored, what information could be captured, whether sensitive fields were excluded, which company operated the replay software, and whether information was transmitted to a third-party provider.

Browser Fingerprinting Can Recognize a Device Without a Traditional Cookie

Cookies are not the only way to recognize a returning visitor.

Browser or device fingerprinting uses characteristics of a browser or device to distinguish it from others. HHS describes fingerprinting as using a browser’s or device’s unique configurations and settings to track user activity.

Depending on the technique, characteristics such as browser configuration, operating system, screen settings, installed features, and other technical attributes can contribute to an identifier.

This matters because simply blocking or deleting cookies does not necessarily prevent every form of tracking.

The broader practice of following activity across websites, apps, devices, and services is addressed separately in Net Law Advocates’ discussion of online tracking and privacy.

Analytics Scripts Can Collect More Than Page Views

Website analytics tools help businesses understand how visitors use their sites.

Basic analytics may answer relatively ordinary questions: How many people visited a page? How did they arrive there? How long did they remain? Which pages did they visit next?

More sophisticated implementations can collect substantially more information about user behavior.

The privacy implications therefore depend less on the label “analytics” and more on the actual data flow. Relevant questions include what information the script receives, whether persistent identifiers are attached, whether the provider can use the information for its own purposes, and whether data from the website can be combined with information from other sources.

A tool used for legitimate website measurement can raise different concerns if its configuration results in sensitive or identifying information being sent to another company.

What Information Can Website Tracking Technologies Collect?

The answer depends on the website, the tracking tool, and how it has been configured.

Potentially collected information may include:

• Pages and content viewed
• Links and buttons clicked
• Search terms
• Purchase activity
• Form interactions
• IP addresses
• Device or browser identifiers
• Advertising identifiers
• Approximate or precise location information
• Referring websites
• Dates and times of interactions
• Account or login-related information
• Information associated with a user’s actions on a webpage

The FTC’s review of major social media and video-streaming companies found tracking technologies capable of transmitting information such as webpage or app interactions, purchased items, search terms, and information typed into forms.

Not every tracking tool collects all of this information. Understanding the actual implementation is essential before drawing conclusions about what a particular website transmitted.

Tracking on Healthcare Websites Can Involve Particularly Sensitive Information

Tracking technologies can create greater privacy concerns when they operate on websites involving healthcare or other sensitive subjects.

Consider the difference between viewing a retailer’s general homepage and using a healthcare website to schedule an appointment, access a patient portal, or enter symptoms into an online tool.

HHS has warned that tracking technologies used by healthcare organizations may, in certain circumstances, have access to information such as email addresses, appointment details, medical record numbers, device identifiers, and information entered by users. HIPAA requirements can apply when regulated entities collect or disclose protected health information through tracking technologies.

There is an important limitation. In 2024, a federal court vacated part of HHS’s tracking-technology guidance concerning certain visits to unauthenticated public webpages, and HHS’s current guidance expressly acknowledges that ruling. As a result, merely connecting an IP address or identifying information with a visit to a public health-related webpage does not automatically establish that PHI was disclosed.

The FTC has separately taken action involving digital health companies accused of sharing sensitive health information with advertising platforms through tracking technologies.

These distinctions illustrate why the specific information transmitted and the circumstances surrounding the transmission matter.

Can Tracking Technologies Collect Information Entered Into Forms?

Potentially, yes.

The fact that someone has not clicked a final “Submit” button does not necessarily establish that information entered on a webpage remained entirely within that form.

Depending on the technology and configuration, scripts operating on a webpage may be capable of observing interactions with page elements. The FTC has documented tracking technologies capable of collecting information users typed into forms.

This can become particularly sensitive when forms involve medical information, financial information, account credentials, personal identifiers, or details about why someone is seeking a particular service.

It does not mean every form containing tracking technology transmits everything a person types. Determining what actually happened generally requires examining the website’s technical configuration and data transmissions.

First-Party and Third-Party Tracking Are Different

It is also useful to distinguish between technologies operated by the website itself and technologies supplied by outside companies.

A first-party tool may collect information for the website operator’s own purposes.

Third-party technology can involve another company receiving information generated through the visitor’s interaction with the site. These third parties may provide analytics, advertising, social media, customer-support, testing, or other technology services.

The involvement of a third party can matter because the information is no longer necessarily remaining solely with the website the user intentionally visited.

Depending on the circumstances, this may raise separate questions concerning data sharing without consent.

Does a Privacy Policy or Cookie Banner Make Website Tracking Lawful?

Not automatically.

A privacy policy can disclose a company’s practices, and a cookie banner can provide users with choices about certain technologies. But whether those mechanisms are legally sufficient depends on the circumstances and applicable law.

A meaningful analysis may consider what was actually disclosed, whether a user’s choice was honored, whether technologies operated before consent was obtained, what information was collected, who received it, and whether the practice was subject to a law requiring a particular form of authorization.

In the healthcare context, for example, HHS expressly states that a website banner asking users to accept or reject tracking technologies does not itself constitute a valid HIPAA authorization for the disclosure of PHI.

More broadly, situations in which personal information is obtained without appropriate permission may implicate issues involving unauthorized data collection.

When Can Website Tracking Create a Legal Claim?

There is no rule making every use of cookies, pixels, analytics software, or session replay unlawful.

Potential claims are fact-specific.

The legal analysis can depend on the technology used, the information captured, whether communications were intercepted, whether sensitive information was involved, what disclosures were made, whether valid consent existed, which third parties received the information, the jurisdiction involved, and which laws apply.

State privacy, wiretapping, interception, consumer-protection, health-privacy, and other laws may potentially become relevant depending on those facts.

That is also why discovering a tracking script in a website’s source code does not, standing alone, establish that a visitor has a viable lawsuit. The more important question is what the technology actually did with that particular visitor’s information.

How Can Website Tracking Be Investigated?

Website tracking can leave technical evidence even though the collection itself is often invisible to users.

An investigation may examine:

• Website source code and scripts
• Browser cookies and local storage
• Network requests generated during a visit
• Information contained in transmitted parameters
• Tracking and advertising identifiers
• Consent-management configurations
• Privacy policies and disclosures
• The identity of third-party recipients
• Changes in tracking configurations over time

Technical evidence can help establish whether information left the website, what information was transmitted, and which outside service received it.

Individuals concerned about tracking should also consider preserving screenshots of relevant pages, privacy notices, consent banners, forms, and other information showing what they encountered when using the website.

Website Tracking Can Connect to Broader Privacy Issues

A tracking technology is often only the beginning of the data lifecycle.

Information collected on a website may later be combined with other information, used to create consumer profiles, shared with additional companies, or retained for future advertising and analytics.

This creates important distinctions within digital privacy law.

The technical collection itself is the focus of website tracking. Online tracking and privacy addresses the broader practice of following and profiling people’s digital behavior. Unauthorized data collection focuses on whether information was obtained without appropriate authorization. Data sharing without consent concerns what happens when information is transmitted or disclosed to other parties.

Together, these issues can help establish what happened to a person’s information from the moment it was collected through its subsequent use or disclosure.

Speak With Net Law Advocates About Website Tracking and Privacy

Website tracking cases can depend heavily on technical details that users cannot see simply by looking at a webpage. Identifying a pixel or script is only the first step. Determining what information it collected, where that information went, and whether the conduct implicates applicable privacy law requires a closer examination of the facts.

Net Law Advocates represents plaintiffs nationwide in cyber and privacy matters. If you believe a website collected or transmitted your personal information through tracking technology without appropriate authorization, contact Net Law Advocates at 888-913-2318 to schedule a free, confidential consultation.