ETag Tracking Explained: The Cookie Alternative You Cannot Delete

ETag tracking uses an ordinary caching feature to recognize returning visitors without cookies. It got its reputation as a cookie "you can't delete" because clearing cookies alone doesn't remove it. You can, though, and modern browsers have made it much less useful to trackers.

What an ETag is

An ETag (entity tag) is a label a server sends with a file, such as an image or script, to identify that version of it. Your browser stores the file and its ETag in its cache. Next time, it asks the server: "I have the version with this ETag; has it changed?" If not, the server says so and the browser uses its copy. That saves time and data.

How it's misused for tracking

1. A tracker gives each new visitor a unique ETag on a small file, such as a tiny image.
2. Your browser stores it in the cache.
3. On your next visit, your browser sends that ETag back to check the file.
4. The tracker reads it and recognizes you, even if you cleared your cookies.

In 2011, researchers found analytics company KISSmetrics using ETags to recreate deleted tracking IDs on sites including Hulu, which led to lawsuits.

Why it's less effective now

Browsers now split their cache by the site you're visiting. Since 2020, Chrome has kept a separate cache for each top-level site, and Firefox and Safari do the same. A tracker embedded on two different sites gets two different cache entries, so it can't use an ETag to link your visits between them.

A site can still use ETags to recognize you on its own pages, much like a first-party cookie.

How to clear it

• In Chrome, press Ctrl + Shift + Delete and tick Cached images and files along with cookies.
• Incognito windows start with an empty cache and discard it when closed.
• Clearing cache makes sites load a little slower the next time, which is the trade-off.

Related techniques

ETags belong to a family of tracking methods that store IDs somewhere other than cookies, alongside local storage and other browser storage. Bounce tracking and fingerprinting avoid storage altogether. See bounce tracking and canvas fingerprinting.

Practical protection

1. Clear cookies and cache together, or set Chrome to delete site data when you close it.
2. Block third-party cookies.
3. Use a content blocker to stop tracker domains from loading at all.
4. Work through a Chrome privacy checklist.

Ghost Browser adds random background visits to blur your browsing profile. It doesn't clear caches, so use the steps above for ETags.