TL;DR: Third-party tracking cookies and pixels let ad networks follow you across sites and emails. In April 2025 Google decided to keep third-party cookies in Chrome and leave blocking as a user setting, so you have to turn it on yourself. Global Privacy Control (GPC) is a browser signal that tells every site not to sell or share your data; in California, businesses must honour it as a legal opt-out. Firefox, Brave and DuckDuckGo support GPC, and Privacy Badger adds it to other browsers.
Cookies, pixels and trackers in plain English
- First-party cookies are set by the site you're on. They keep you logged in and remember your basket. Mostly harmless.
- Third-party cookies are set by other companies embedded in the page, usually ad and analytics networks. They recognise you on every site that uses the same network.
- Tracking pixels are tiny invisible images in pages and emails. When they load, they report that you opened or visited, plus details like time and approximate location.
Even without cookies, sites can recognise your device with browser fingerprinting.
Chrome still allows third-party cookies
For years Google said it would phase out third-party cookies in Chrome. On 22 April 2025 it announced it would keep its current approach instead and not introduce a new standalone prompt; users can still choose in Chrome's Privacy and Security settings. Incognito mode blocks third-party cookies by default.
How to block them
- Chrome: Settings, Privacy and security, Third-party cookies, and choose to block them.
- Safari and Firefox block most cross-site tracking cookies by default.
- Clear existing cookies from the same privacy menu, then sign back into the sites you use.
Global Privacy Control: one switch, every site
Global Privacy Control is a signal your browser sends to every website saying you don't want your personal information sold or shared. Without it, you'd have to click a “Do Not Sell” link on every site.
- Built in: Brave, DuckDuckGo's browser (on by default) and Firefox (in settings).
- Extensions: EFF's Privacy Badger and others add it to Chrome and Edge.
It has legal teeth in some places. California's Attorney General states that a user-enabled global privacy control “must be honored by covered businesses as a valid consumer request to stop the sale or sharing of personal information.” Colorado requires businesses to honour recognised universal opt-out signals from 1 July 2024. Our US state privacy laws guide lists where else you have opt-out rights.
Email tracking pixels
Marketing emails often include pixels that show when you opened them. To limit this, turn off automatic image loading in your email app, or use Apple Mail's Mail Privacy Protection. Using email aliases also stops companies linking your inbox across services.
Reset your advertising ID
Phones have their own tracking ID for ads. On iPhone, deny apps permission to track in Settings, Privacy & Security, Tracking. On Android, delete or reset the advertising ID in Settings, Privacy, Ads (or Google, Ads, on some phones).
Ad profiles sit alongside breached data. A free email exposure check shows which breaches your email appears in, and the full Scan My Shadow scan adds your phone number.
Frequently Asked Questions
What are tracking cookies?
Usually third-party cookies set by ad and analytics networks that recognise you across the different websites that use them.
Is Chrome getting rid of third-party cookies?
No. In April 2025 Google said it would keep its current approach and not add a new standalone prompt. You can still block them in Chrome’s privacy settings.
What is Global Privacy Control?
A browser signal telling every site you don’t want your personal information sold or shared. Brave, DuckDuckGo and Firefox support it, and Privacy Badger adds it to other browsers.
Do websites have to honour GPC?
In California, yes: the Attorney General says covered businesses must treat it as a valid opt-out of sale or sharing. Colorado requires recognised universal opt-out signals to be honoured from July 2024.
How do I stop email tracking pixels?
Turn off automatic image loading in your email app or use a feature like Apple Mail Privacy Protection.
Sources
- Google Privacy Sandbox: Next steps for Privacy Sandbox and tracking protections in Chrome (22 April 2025)
- Global Privacy Control
- California Attorney General: California Consumer Privacy Act (CCPA)
- Colorado Attorney General: Colorado Privacy Act