Home · Blog · Tracking

Tracking

Cookies, pixels and fingerprints: the tracking vocabulary, translated

Third-party cookies, tracking pixels, browser fingerprinting, SNI — each term sounds like a verdict. Here is what each one actually reveals about you, and which layer stops it.

8 September 2026 · 6 min read

Cookies: first-party vs third-party

A cookie is a small note a website asks your browser to keep — your login session, your cart, your language. First-party cookies come from the site you are visiting and mostly exist to make it work. Third-party cookies come from someone else embedded in that site: an ad network whose script loads on ten thousand pages and reads the same identifier on every one of them. That is the cross-site trail people mean by “cookie tracking.”

Two honest notes. First, third-party cookies are dying by platform policy, not by VPN: every major browser now blocks or partitions them by default. Second, killing them changed the trackers' address, not their appetite — which brings us to pixels and fingerprints.

Tracking pixels: the one-pixel spy

A tracking pixel (or beacon) is an invisible image — often literally one pixel — embedded in a page or an email. Loading it is a request to the tracker's server, carrying the page you are on, the time, and any identifier the tracker already holds. In emails it reports the open itself: sender, moment, device, approximate location.

Pixels are DNS lookups first and HTTP requests second, which is exactly why DNS-level blocking is their natural enemy: if the pixel's domain never resolves, the beacon never fires, in every app at once. Our Plus filtering lists exist largely for this traffic. What DNS blocking cannot do is stop first-party pixels — the site phoning its own analytics home looks identical to the site working.

Fingerprinting: you are the cookie

Fingerprinting does not store anything — it measures. Your browser volunteers dozens of semi-stable signals to any page that asks: screen size and color depth, installed fonts, timezone, language, GPU model via WebGL, even microscopic differences in how your hardware renders a hidden <canvas> image. Combined, they are unique enough to re-identify most devices without any stored identifier at all. Nothing to delete, nothing to block with a cookie banner, nothing a tunnel can encrypt away — the signals leave inside your own legitimate traffic.

This is the scariest-sounding term and the one most “anti-tracking” marketing quietly skips, because no network product fixes it. Defenses live in the browser: resist-fingerprinting modes that standardize the signals, fewer exotic fonts and extensions (every customization makes you more unique, not less), and separate browsers or profiles for separate identities.

Network metadata: DNS, SNI and IP

Below the browser sits the network layer, and it leaks in three classic ways: DNS (which names you look up), SNI (the hostname sent in the clear to open an HTTPS connection), and your IP address (who and roughly where you are). Your ISP sees all three by default; so does anyone on café Wi-Fi with basic tools.

This layer — and only this layer — is what a VPN fully owns. Inside the PryVPN tunnel, DNS resolves through the tunnel, SNI travels inside the encrypted payload, and the visible address is the exit node's, not yours. It is also the layer our never-logged list covers: browsing, DNS, destinations, SNI, payloads and your tunnel source address are not recorded on our side either.

What actually works, layer by layer

No single product covers all four layers, so stop shopping for one and stack cheap ones instead:

1. Network layer: a real tunnel with in-tunnel DNS and a routing-based kill switch. That is PryVPN's entire job, and it does it on every plan.
2. Loaders: DNS-level tracker blocking (Plus) plus a browser content blocker for cosmetic filtering. Overlapping on purpose.
3. Identifiers: clear cookies on exit or per-site containers, separate profiles for separate lives (work, shopping, everything else).
4. Uniqueness: a mainstream browser configuration with fingerprint resistance on — boring is untrackable, customized is memorable.

Notice what is missing from the list: panic. Each scary term maps to exactly one layer, each layer has exactly one fix, and none of the fixes cost anything beyond the setup evening.

Questions we hear

Reviewed by Elena Marín · 8 September 2026