Online Tracking & Privacy Lawyer
A single visit to a website can reveal more than most people realize. Companies may collect information about the pages someone views, links they click, searches they perform, products they consider, advertisements they interact with, and devices they use. When information from multiple interactions is connected over time, businesses and technology providers can develop detailed profiles of an individual’s interests, habits, behavior, and activity.
Online tracking is widely used for functions ranging from analytics to advertising. It is not automatically unlawful. Privacy concerns can arise, however, when tracking occurs without adequate disclosure or consent, involves sensitive information, follows individuals across services in unexpected ways, or results in personal information being disclosed or used contrary to applicable law.
Net Law Advocates represents individuals nationwide in matters involving potentially unlawful digital tracking and other cyber law issues.
What Is Online Tracking?
Online tracking is the collection and linking of information about a person’s activity across websites, applications, devices, or digital services.
Tracking can occur during a single browsing session, over repeated visits to the same service, or across unrelated websites and apps. In some circumstances, information associated with different devices may also be connected to the same individual or household.
The Federal Trade Commission explains that websites and apps can use cookies, pixels, device fingerprinting, advertising identifiers, and other technologies to recognize users and track online activity. Tracking may also occur across multiple internet-connected devices.
Depending on how a system operates, tracked activity can reveal information about what someone searches for, what they purchase, which content they consume, where they travel, and what subjects interest them.
That information can become considerably more revealing when activity is collected over an extended period or combined with information from other sources.
Why Do Companies Track People Online?
There are many reasons businesses collect information about digital activity.
Some tracking supports functions consumers expect. A website may remember that a user is logged in, preserve a shopping cart, prevent fraud, or analyze whether a service is working properly.
Other forms of tracking are designed to understand and influence consumer behavior.
Companies may use tracking information to:
- Measure website and advertising performance
- Personalize content or recommendations
- Build profiles of consumer interests
- Select advertisements for particular audiences
- Retarget advertisements after someone visits a website
- Measure purchases or other actions following an advertisement
- Analyze behavior across websites or applications
- Combine online activity with information obtained from other sources
Advertising is an important driver of large-scale tracking. An FTC examination of major social media and video-streaming services found that many companies’ business models encouraged extensive collection of user information for monetization and targeted advertising. The report also found that companies used technologies such as pixels and other tools to track online activity and gather personal data.
The privacy question is therefore not simply whether tracking exists. What matters is what is being tracked, how broadly the information follows an individual, who receives it, what users were told, and how the information is ultimately used.
How Can Online Activity Be Connected to an Individual?
Online tracking does not always require a company to know someone’s name.
A browser, smartphone, account, or other device can be assigned or associated with an identifier that allows activity to be recognized over time. Examples include advertising IDs, device identifiers, cookies, email addresses, phone numbers, and other persistent identifiers.
Even identifiers that appear anonymous can sometimes allow continued tracking.
The FTC has specifically cautioned that hashing an identifier does not necessarily make the underlying information anonymous. A hashed email address or other persistent identifier can still be used to recognize and track a person or device across interactions.
Once an identifier becomes associated with an identifiable person, account, or other information source, activity that initially appeared disconnected may become part of a broader consumer profile.
Cross-Site and Cross-App Tracking Can Build Detailed Profiles
One of the more significant privacy concerns involves tracking that extends beyond a single website or application.
A company may observe what a person does on its own service. Third-party advertising, analytics, and technology providers can sometimes receive information from many different websites or applications, potentially allowing activity to be connected across otherwise unrelated services.
Over time, these signals can reveal patterns that a single interaction would not.
Someone’s browsing and app activity could potentially suggest interests involving health conditions, financial concerns, employment, relationships, religious activity, travel, purchases, or other personal matters.
The FTC has noted that tracking technologies can gather information about specific purchases, searches, webpage interactions, and information entered into forms, sometimes while consumers are unaware that the tracking is occurring.
Whether a particular tracking practice violates the law depends on the circumstances, but the ability to aggregate activity is one reason online tracking presents privacy concerns beyond ordinary website analytics.
Sensitive Information Raises Additional Privacy Concerns
The nature of the information revealed through tracking matters.
A record showing that someone visited a general retail website may raise different concerns from tracking that reveals activity involving medical treatment, financial problems, precise location, or another sensitive subject.
Health-related tracking has received particular regulatory attention. The FTC has taken enforcement action involving digital health companies accused of disclosing sensitive health information to advertising platforms through tracking technologies, and the FTC and Department of Health and Human Services have warned healthcare organizations about privacy and security risks associated with online tracking tools.
Location information can be similarly revealing. In 2026, the FTC announced a settlement that would prohibit data broker Kochava and its subsidiary from selling, sharing, or disclosing sensitive location data without consumer consent after allegations involving location information capable of tracing individuals’ movements.
The legal protections applicable to sensitive information depend on the type of data, the organization involved, the jurisdiction, and how the information was collected and used.
Online Tracking Is Not the Same as Website Tracking Technology
The two subjects overlap, but they are not identical.
Website tracking technologies are the technical mechanisms that can collect or transmit information. These can include cookies, tracking pixels, analytics scripts, session-replay software, and related code.
Online tracking is the broader practice of following, connecting, and analyzing an individual’s digital activity.
A tracking pixel, for example, may be one mechanism used to observe activity on a website. The broader privacy issue may involve how information gathered through that pixel is connected to activity elsewhere, incorporated into a consumer profile, used for targeted advertising, or shared among multiple companies.
Net Law Advocates addresses the operation and privacy implications of pixels, cookies, session replay, analytics scripts, and similar tools more specifically in its discussion of website tracking technologies.
Tracking Can Occur on Mobile Devices
Mobile applications create additional opportunities to observe activity because smartphones remain with users throughout much of their daily lives.
Advertising identifiers and other device information can potentially connect activity across apps. Applications may also have access to location, device information, and other data depending on their functionality and permissions.
The FTC has brought cases involving companies accused of improperly collecting or selling location information associated with mobile devices, including information that could reveal visits to sensitive locations.
The collection and use of information specifically through smartphones and applications is addressed further in the firm’s app and mobile privacy content.
Does a Cookie Banner Mean You Consented to Tracking?
Not necessarily.
Cookie banners and consent-management tools can provide users with information and choices about tracking, but the existence of a banner does not by itself establish that every collection or use of information was properly authorized.
The details matter.
Questions may include what the banner disclosed, which technologies operated before a user made a choice, whether rejecting optional tracking actually stopped it, what categories of data were collected, whether information was transmitted to third parties, and whether the company’s practices were consistent with its representations.
These questions overlap with broader issues involving unauthorized data collection, where the central issue is whether an organization had appropriate authority to obtain the information in the first place.
Tracking Data Can Move Between Multiple Companies
The company operating the website or app is not always the only organization involved in tracking.
Advertising networks, analytics companies, data brokers, social media platforms, software vendors, and other technology providers can participate in the collection or use of information generated by digital activity.
This can create a complicated data chain.
A person may interact with one website while information from that interaction is transmitted to another company. That company may combine the information with data it already possesses, use it to categorize the individual, or make it available for advertising or other purposes.
When information moves beyond the organization where the interaction originally occurred, separate questions may arise about data sharing without consent.
When Can Online Tracking Become a Legal Issue?
There is no single federal law that makes all undisclosed online tracking unlawful.
Potential claims depend on the specific conduct and applicable law. Relevant considerations may include the type of information collected, whether tracking involved communications or sensitive information, what disclosures were made, whether consent was required or obtained, where the individual resides, and how the information was subsequently used or disclosed.
The FTC also enforces Section 5 of the Federal Trade Commission Act against unfair or deceptive practices involving consumer privacy. Its privacy enforcement has included matters involving misleading privacy representations, sensitive information, tracking technologies, and unauthorized uses or disclosures of personal data.
State privacy laws add another layer. States continue to enact legislation governing the collection, use, and disclosure of consumer information, but the rights, exemptions, enforcement mechanisms, and ability of individuals to bring lawsuits vary by jurisdiction.
As a result, discovering that a company tracked someone’s activity does not automatically mean that person has a viable lawsuit. Determining whether legal action may be available requires examining the particular tracking practice and the law that governs it.
What Information May Help Evaluate an Online Tracking Claim?
Much of online tracking occurs behind the scenes, so an individual may have only limited evidence when a concern first arises.
Materials worth preserving can include screenshots of cookie or consent banners, applicable privacy policies, account settings, emails from the company, app permission screens, browser privacy settings, and any notices explaining how information is collected or shared.
The underlying technology may become important as well. Website source code, network transmissions, tracking configurations, advertising identifiers, vendor relationships, and other technical evidence can help establish what information was transmitted and which companies received it.
These details can help distinguish ordinary tracking from conduct that may implicate privacy rights.
Online Tracking Is Part of a Larger Digital Privacy Picture
Tracking rarely exists in isolation.
The information collected through online activity may later be combined with other information, disclosed to third parties, retained for extended periods, or used to make decisions about consumers. Tracking can therefore intersect with several different privacy issues even when no traditional data breach has occurred.
Net Law Advocates’ broader work involving digital privacy violations addresses the larger legal framework surrounding the collection, use, monitoring, and disclosure of personal information. Individuals seeking to understand the rights that may apply to their personal data may also encounter protections addressed through consumer data privacy rights.
Speak With Net Law Advocates About Online Tracking and Privacy
Online tracking can be difficult to identify because much of the activity occurs automatically and outside the user’s view. Whether a particular practice creates a legal claim depends on the technology involved, the information collected, the disclosures and consent provided, the companies receiving the information, and the applicable law.
Net Law Advocates represents plaintiffs nationwide in cyber and privacy matters. If you believe a company improperly tracked your online activity or used information about your digital behavior without appropriate authorization, the firm can review the circumstances and help you understand whether legal options may be available.
Contact Net Law Advocates at 888-913-2318 to schedule a free, confidential consultation.