How to Use This Knowledge Base

The cookie tracker database is a reference lookup for anyone auditing a website’s data flows — privacy officers, web developers, legal teams, and analytics consultants. Type any cookie name, script domain, or vendor into the search field above. Results show the tracker’s category, the company that receives the collected data, the type of identity signal the tracker generates, its typical storage duration, and whether GDPR consent is required before the cookie fires.

You can also filter by category — choose analytics, advertising/retargeting, social embedding, or fingerprinting — to browse a specific tracker family. Every lookup runs entirely in your browser; no data leaves your device. To understand how trackers are used to re-identify you across sessions and devices, see the identity-resolution explainer. To compare how each tracker affects page-load performance, see the tracker performance weight database. For a decision tool on which cookies need a consent banner, use the which trackers require consent wizard.

Tracker Categories

Trackers fall into four functional families. The category determines the legal basis available under GDPR and ePrivacy, the identity signal strength, and which browser privacy features are likely to interfere.

Analytics Trackers

Analytics trackers measure aggregate visitor behaviour — page views, session duration, bounce rate, and traffic source. The most widely deployed are _ga and _gid (Google Analytics 4), _hjSession and _hjSessionUser (Hotjar), ajs_anonymous_id (Segment), and s_cc plus s_sq (Adobe Analytics). Even “anonymous” analytics cookies generate a persistent visitor identifier that is personal data under GDPR Recital 26. Most data protection authorities — including France’s CNIL and Germany’s DSK — treat standard GA4 implementation as requiring prior consent unless the operator obtains an exemption through IP anonymisation and short-lived, non-cross-site cookies.

Advertising and Retargeting Trackers

Advertising trackers build interest profiles that ad networks use to serve targeted or retargeted ads. Common examples are _fbp and fr (Meta Pixel), _gcl_au (Google Ads conversion), _ttp (TikTok Pixel), _uetsid (Microsoft Advertising), and IDE (DoubleClick/DV360). These trackers always require explicit prior consent: they share data with third-party ad platforms and process behavioural data for profiling under GDPR Article 9 purposes. Absent consent, placing them constitutes an unlawful transfer of personal data.

Social Proof and Embedding Trackers

Social embedding trackers are deposited when a page loads a third-party widget — a YouTube iframe, a Twitter/X timeline, a LinkedIn share button, or a Facebook comment box. Even without the visitor interacting with the embed, the social platform sets cookies that can track the visitor across other sites where the same widget appears. Typical cookies include yt-player-headers-readable (YouTube), lang and bcookie (LinkedIn), and session identifiers set by Instagram embeds. Consent is required for social embedding trackers under ePrivacy Article 5(3) because they are placed by third parties for purposes beyond basic functionality.

Fingerprinting and Persistent-ID Trackers

Fingerprinting trackers collect device and browser attributes — screen resolution, installed fonts, hardware concurrency, WebGL renderer, canvas rendering — to generate a probabilistic device fingerprint that persists even after cookie deletion. Scripts such as FingerprintJS Pro, ThreatMetrix, and Kochava’s device graph fall into this category. Unlike cookie-based identifiers, fingerprints are not stored locally, making them difficult for users to clear. The CNIL’s 2022 guidance explicitly classifies fingerprinting as a tracking technique subject to consent regardless of whether a cookie is deposited.

Understanding the Identity Signal Each Tracker Creates

Every tracker in this database is classified by the type of identity signal it produces. That classification matters because it determines how durable the identifier is, how linkable it is across sites, and how browser privacy controls affect it.

Persistent cookie ID: A unique string stored in a first-party or third-party cookie with a multi-year expiry — for example, _ga with its two-year default. As long as the cookie persists and the browser sends it, the identifier links every session to the same pseudonymous user record. Clearing cookies destroys the link. First-party persistent IDs (like GA4’s client ID) survive ITP and Firefox ETP; third-party persistent IDs are increasingly blocked by default.

Session ID: A short-lived identifier that expires when the browser closes or after a fixed timeout. Session IDs link events within a single visit but do not carry cross-session identity on their own. They are used alongside persistent IDs in most analytics platforms.

Probabilistic fingerprint: A device-derived identifier built from hardware and software attributes without storing anything locally. High-entropy fingerprints (using WebGL, AudioContext, font enumeration) can be 99%+ accurate in re-identifying a device even after full cookie and local-storage wipes. No browser privacy feature fully neutralises fingerprinting; Firefox’s Fingerprint Protection randomises some signals, but specialised fingerprinting services adapt.

IP-based identity: Some trackers — particularly server-side analytics and bot-detection services — use IP address combined with user-agent string as a lightweight identity signal. IP-based identity is probabilistic and degrades under CGNAT, VPNs, and IPv6 rotation. GDPR considers IP addresses personal data when they can be linked to an individual.

How Browsers Are Blocking Trackers

Browser vendors have moved aggressively against third-party cookie tracking over the past five years. Safari’s Intelligent Tracking Prevention (ITP), introduced in 2017 and updated through 2024, caps third-party cookie storage at 24 hours and blocks cross-site cookie access by default. Firefox’s Enhanced Tracking Protection (ETP) in Strict mode blocks all known third-party trackers using the Disconnect.me list. Brave blocks trackers and fingerprinting by default at the network layer.

Google Chrome deprecated third-party cookies in Q1 2024 for a small test population and then reversed the deprecation timeline in mid-2024, but the Privacy Sandbox APIs (Topics, Protected Audience, Attribution Reporting) are now live and gradually replacing cookie-based ad targeting on Chrome. Regardless of Chrome’s timeline, third-party cookie reach has already fallen: Safari and Firefox together represent roughly 25–30% of browser market share, and both block third-party cookies by default.

Server-side tag management (sGTM, Stape, CloudFlare Zaraz) is the industry’s current response: by routing tracking calls through a first-party subdomain, operators convert what would be third-party cookies into first-party cookies that survive ITP and ETP. The cookies still require consent under GDPR — the legal requirement is unchanged — but the technical blocking is bypassed. The cookie tracker database flags server-side variants of common trackers where documented.

Frequently Asked Questions

What is the difference between a first-party and a third-party tracking cookie?

A first-party cookie is set by the domain you are visiting directly. A third-party cookie is set by a different domain — typically an advertising network, analytics provider, or social platform — whose scripts are embedded on the page. Third-party cookies can follow a visitor across every site that embeds the same third-party script, building a cross-site behavioural profile. First-party cookies are limited to the single domain that set them and cannot track users elsewhere. Browsers now block or restrict third-party cookies by default; first-party cookies remain broadly available but still require consent when used for tracking or profiling.

What does the _ga cookie do?

The _ga cookie is Google Analytics 4’s primary client identifier. It stores a randomly generated string that uniquely identifies a browser-device combination across sessions. By default it expires after two years. Every time the visitor loads a page with GA4 active, the browser sends _ga to Google’s collection endpoint, which uses it to stitch together that visitor’s historical session data — pages viewed, events triggered, traffic source on first arrival. Because it creates a persistent pseudonymous record linked to measurable behaviour, GDPR supervisory authorities classify it as personal data requiring consent or a valid exemption.

How do I find all cookies on a website?

Open Chrome or Firefox DevTools (F12), go to Application > Cookies (Chrome) or Storage > Cookies (Firefox) after loading the page. This shows first-party cookies only. To capture third-party cookies, use the Network tab filtered by “cookie” or install a browser extension such as CookieMetrix or EditThisCookie. For a systematic audit, run a headless Chromium crawler (Playwright or Puppeteer) that collects Set-Cookie headers and document.cookie values across all page templates before and after consent-banner interaction. Search each cookie name in this cookie tracker database to identify the vendor and consent requirement.

What is ajs_anonymous_id?

ajs_anonymous_id is a persistent anonymous identifier set by Segment’s Analytics.js library. It is a UUID stored in a first-party cookie (and often duplicated in localStorage) that Segment uses to track a visitor’s behaviour across sessions before and after login. On login, Segment’s identify() call links this anonymous ID to a known user ID, retroactively associating all anonymous events with the authenticated user record. Because it can be linked to an identified person through the identify() call, it is personal data under GDPR and requires consent or legitimate-interest justification documented in a DPIA.

Which cookies does Firefox block by default?

Firefox’s Enhanced Tracking Protection (ETP) in Standard mode (the default since 2019) blocks third-party cookies from domains listed as tracking-only in the Disconnect.me database — primarily advertising and social tracking cookies. Standard mode does not block analytics trackers or cookies from domains that serve both tracking and functional purposes. In Strict mode, Firefox blocks all third-party cookies, all fingerprinting scripts on the Disconnect list, and cross-site tracking cookies in private browsing. Firefox also applies a 24-hour expiry cap to certain first-party cookies set via JavaScript (Storage Access API) in Standard mode.

What is the difference between fingerprinting and cookie tracking?

Cookie tracking stores an identifier on the visitor’s device and reads it back on future visits. The visitor can delete cookies to break the link. Fingerprinting derives an identifier from device and browser characteristics — screen size, fonts, GPU model, language settings — without storing anything locally. The visitor cannot “delete” a fingerprint because it is recomputed from the device each time. Fingerprints are probabilistic rather than deterministic: if hardware or software changes, the fingerprint shifts. Cookies are exact and stable until deleted. Fingerprinting is generally considered a higher-risk processing activity under GDPR because users have no practical way to opt out, and it requires consent under the ePrivacy Directive just as cookies do.