How Websites Use Invisible iFrames to Track Your Behavior

An iframe is a window inside a web page that loads a page from another site. Many are visible and useful, such as a YouTube video or a payment form. Others are tiny or hidden, and exist so that tracking and ad companies can run their own code on the sites you visit.

What hidden iframes do

• Read and set third-party cookies. Inside its iframe, a tracker runs on its own domain, so it can use its own cookies and recognize you across every site that embeds it.
• Cookie syncing. Ad companies use hidden frames and pixels to swap their IDs for you, so they can share what they know.
• Ad delivery and measurement. Ads are often loaded in iframes, which also report what you saw and for how long.
• Fingerprinting. Scripts in the frame can collect details about your browser and device.

Legitimate uses

Not every iframe is tracking. Payment forms, embedded maps and videos, sign-in buttons and chat widgets all use them, and they're often more secure that way, because the main site can't read what's inside.

What Chrome limits

• Since 2023, Chrome keeps storage such as localStorage separate for each site an iframe appears on, so a tracker can't use one stored ID everywhere.
• Third-party cookies still work in iframes in Chrome, unless you block them, because Google decided to keep them. See the third-party cookie timeline.
• Safari and Firefox block or isolate third-party cookies by default.

See the iframes on a page

1. Press F12 to open DevTools.
2. In the Elements tab, press Ctrl + F and search for iframe.
3. Look at each one's src to see which company it loads from, and its width and height. Sizes of 0 or 1 pixel are a sign of tracking.
4. The Application tab lists all frames under Frames.

Block iframe tracking

• Block third-party cookies: Settings → Privacy and security → Third-party cookies.
• Use a tracker blocker, which stops the tracking frames and scripts from loading.
• Reject cookie banners, which limits what sites load for consenting visitors.

Hidden iframes are one part of how tracking works. See third-party tracking explained and tracking pixels. Ghost Browser adds random background visits, so profiles built from what trackers still see are less accurate.