tracking.ferreiraandren.com · a demonstration
You did not sign in. You did not click anything. Yet this page has already built a profile of your device, your location and your software — using only the ordinary features every browser hands to every website by default. Nothing here is stored about you unless you keep this tab open; the whole point is to show you the collection, not to sell it. Every advertising and analytics company does exactly this, silently, on pages you visit all day.
This single line is derived from your hardware and software, not from a cookie. Delete every cookie, open a private window, switch off your VPN — most of it stays the same. That is what makes it a fingerprint: you cannot clear what you did not store.
The moment your browser asked for this page, it volunteered all of this. A site with JavaScript switched off still gets everything below.
reading what the server saw…
A cookie is a little note this site asked your browser to keep and hand back every time you return, so it knows you are the same person. This page just set you a stack of them, exactly the way a real analytics or advertising system would. Reload the page and watch the visits counter climb — that is memory the site keeps about you, from cookies alone.
Here is the thing most people get backwards: a website can only read
the cookies it set itself. This page can see the cookies on
tracking.ferreiraandren.com and nothing else. Your Google
cookies, your bank cookies, your email — all invisible to it. That wall (the
browser calls it the "same-origin" rule) is the single thing stopping every
site you visit from rifling through every other site you are logged into. If
it did not hold, the web would be unusable.
So how do ad companies follow you from site to site? Not by reading your other cookies — they can't. They do it two other ways:
Want to see the cookies every other site has set on you? No web page is allowed to show you that — only you can. In your browser, open the developer tools (View → Developer, or right-click → Inspect) and look under Application → Cookies, or open your settings and search "cookies". You will find hundreds.
Now the JavaScript runs. It reads your screen, your hardware, your fonts, your graphics chip — and computes the silent fingerprints that follow you across cookie clears. None of this asked your permission, because none of it has to.
collecting…
Move your mouse, scroll, type in this box, switch tabs. Everything you do on a page can be recorded and replayed — this is the raw material of "session recording" tools that thousands of sites embed. The blue trail is your actual mouse path on this page.
Everything above needed no permission at all. The most precise data sits one click away, behind a browser prompt. Sites ask for it constantly — "allow notifications?", "use your location?" — and most people tap yes. Here is what that yes actually hands over. Nothing below happens unless you press the button, and this page throws the result away when you close the tab.
The IP guess up top put you in a whole city. This puts you on your street, to a few metres — it reads your device's GPS, Wi-Fi and Bluetooth.
This is the part people don't believe until they see it. Below is every visit I have on record for this browser — and how I linked them. Then there's a button that deletes everything: every cookie (even the ones your JavaScript can't touch), your localStorage, your IndexedDB. Press it, let the page reload, and watch me recognise you in under a second anyway — because your fingerprint and your TLS handshake were never stored on your machine for you to delete.
reading my memory of you…
"Session recording" tools sit on thousands of ordinary websites and quietly film your every move — where your mouse went, what you clicked, how you scrolled, how you hesitated. I did the same while you read this page. Press play and watch a ghost of yourself repeat it.