Tracking cookies, advertising IDs and fingerprinting

Last checked: 14 Oct 2026

Websites and apps use three main ways to recognise the same browser, phone or TV again: cookies, advertising IDs and fingerprinting. They usually work with a random-looking number rather than your name or email address. But UK law, and California's, can still count that number as personal information, because it can single out one device or person over time.

Cookies and tracking cookies
Advertising IDs on phones and TVs
Is a random ID "personal information"?
Fingerprinting
What you can do

Cookies and tracking cookies

A cookie is a small piece of text that a website saves in your browser. Your browser sends it back to the site next time, so the site can remember things like your login, your basket or your language. Mozilla says websites can only store personal details in a cookie if you've given them those details.

First-party cookie: one from the website shown in your address bar.
Third-party cookie: one from a different company whose content is on the page, such as an advert, a video or a share button. Because that company's content appears on many websites, its cookie can recognise your browser on all of them. Mozilla calls this cross-site tracking.
Tracking cookie isn't a legal term. It usually means a cookie used to recognise you across different websites over time, for advertising or to measure visits. The ICO, the UK's data protection regulator, says cookies can be used for "tracking users' browsing behaviour".

Cookie banners in the UK

In the UK, a website must ask before using cookies (and similar technology) that aren't essential to the service you asked for. The ICO's guidance says:

refusing must be as easy as accepting, and it shows equally clear "accept all" and "reject all" buttons as good practice
if you ignore the banner, the site must not use them: "Silence or inactivity doesn't qualify"
cookies for advertising always need your agreement (ICO)

Some cookies don't need your agreement, such as ones that keep you logged in or remember your basket. The US consumer regulator's guide doesn't describe a rule like this; it suggests choosing the cookie option that suits you.

Advertising IDs on phones and TVs

Phones and TVs have an advertising ID: a long random-looking code that the device makes for apps to use for ads, instead of your name. You can reset it, delete it or stop apps seeing it.

Device	What the maker says it is	Your settings
iPhone and iPad	Apple: "an alphanumeric string that's unique to each device". If you don't let an app track you, it gets all zeros instead.	iPhone ad settings
Android	"a unique, user-resettable and user-deletable ID for advertising". If you delete it, apps get a string of zeros.	Android ad settings
Samsung TVs	The PSID: "a randomised, non-persistent, and resettable device identifier" (Samsung UK).	Samsung TV settings guide
Roku	"unique, non-permanent, identifiers" (Roku).	Roku settings guide
Fire TV	"a user-resettable, unique identifier" (Amazon).	Fire TV settings guide

What a reset does: Samsung says data linked to your old ID "will no longer be used in the delivery of ads to you"; Roku says the old IDs "will no longer be used to display personalized ads". Google and Amazon's rules for app makers say they mustn't link a new ID to the old one without your consent. These are company rules, not something your device can enforce.

LG TVs also have an ad ID you can reset, but LG doesn't say how it's made. See the TV settings guides.

Is a random ID "personal information"?

A cookie ID or advertising ID usually doesn't contain your name, email or address. On its own, it doesn't tell anyone who you are. But the law doesn't only count names:

UK: UK data protection law covers information about someone who can be identified "directly or indirectly", including by "an online identifier". The ICO lists advertising IDs, cookie IDs and device fingerprints as identifiers that may be personal data, and says: "You do not need to hold an individual's name in order to identify them." Being able to tell one person apart from others is enough.
California: the CCPA counts "cookies, beacons, pixel tags, mobile ad identifiers" as identifiers that can be personal information. It also covers identifying someone as "more probable than not" from pieces of information, which, in our reading, includes fingerprinting.

So both things are true: these IDs are usually just numbers, and the law can still give you rights over them, such as the right to object in the UK.

Fingerprinting

Every time you visit a website, your browser tells it some details so pages display properly: your screen size, language, time zone, fonts, browser version and so on. Fingerprinting combines many of these small details. The ICO says together they can "uniquely identify a particular device". Nothing is saved on your device, so clearing cookies doesn't remove a fingerprint.

It has other uses too. The ICO gives detecting fraudulent log-ins as an example, and Brave notes that games, maps and editing tools use some of the same browser features.

UK law: the ICO says the cookie rules cover fingerprinting too, and that a website "must also get consent if you are using device fingerprinting techniques for online advertising purposes" (ICO).

Apps: Apple doesn't allow iPhone apps to fingerprint: "Regardless of whether a user gives your app permission to track, fingerprinting is not allowed." It says apps that do it may be rejected from the App Store (Apple). Amazon's rules for Fire TV apps also forbid using fingerprinting for interest-based ads (Amazon).

What your browser does about it

No browser maker says it can stop all fingerprinting. These are the protections they describe.

Firefox

Blocks known fingerprinting companies by default. Stronger protection, which limits what Firefox reveals, is on in private windows and in Strict mode (Mozilla). To use it in all windows: Settings → Privacy & Security → Enhanced Tracking Protection → Custom → Suspected fingerprinters then choose all windows. Mozilla says this may stop some websites working properly.

Safari on a Mac

Apple says Safari always shows websites a simplified version of your Mac's setup, so it "looks more like everyone else's Mac". A stronger setting is on by default in Private Browsing. To use it for all browsing: Safari → Settings → Advanced → Use advanced tracking and fingerprinting protection (source)

Safari on iPhone and iPad

Apple says Private Browsing adds protections against advanced fingerprinting. We haven't found an Apple page giving the setting for all browsing, so we don't list one.

Microsoft Edge

Tracking prevention blocks fingerprinting it judges harmful at all three levels (Basic, Balanced and Strict). Microsoft says fingerprinters it considers "non-malicious" aren't blocked. Settings and more → Settings → Privacy, search, and services → Tracking prevention

Brave, DuckDuckGo and Tor Browser

All three have fingerprinting protection switched on already. Brave adds "a small amount of randomness" to what it reveals. DuckDuckGo makes some browser features return less useful information. Tor Browser tries to make its users look alike.

What you can do

Cookie banners: in the UK, "reject all" should be as easy to find as "accept all".
Cookies across websites: Safari and Firefox limit third-party cookies by default. See Do Not Track: on or off? for the Safari setting.
Advertising IDs: reset or delete them on your iPhone, Android phone or TV. Resetting doesn't affect fingerprinting.
Fingerprinting: leave your browser's built-in protection on, and use the stronger setting if a browser offers one. Mozilla and Apple both list your add-ons and installed fonts among the details fingerprinting uses.
Ask websites not to sell or share your data: see Global Privacy Control.
Complain: in the UK, you can report a website's cookie use to the ICO.

Sources

This page describes your options and how organisations say they handle requests. It isn't legal advice. See About & sourcing to report a correction.