How Trackers Follow You Everywhere

Apple's 2021 App Tracking Transparency prompt made millions of people aware that apps track them. What it didn't explain is that app tracking is one of four separate systems running simultaneously. Right now, your browser is building a persistent profile through cookies and fingerprinting, your inbox is leaking your location every time you open a newsletter, your apps are reporting usage patterns to advertising SDKs, and your ISP is logging every domain you visit through DNS. Each system runs independently. Blocking one leaves the other three untouched.

This is the full picture, and the free tools that actually address each layer.

Browser Trackers: Cookies, Cross-Site Tracking, and Fingerprinting

Third-party cookies were the original browser tracking mechanism. When you visit a news site, the page loads ads from Google's ad network. That ad request drops a cookie in your browser tied to Google's domain. When you visit a different site — a shopping site, a health forum, a recipe blog — the same Google ad domain loads again and reads that cookie. Google now knows you visited both sites, in sequence, from the same device. This cross-site tracking is how advertising networks build profiles across hundreds of millions of pages without you ever interacting with them directly.

Safari and Firefox deprecated third-party cookies by default in 2020. Chrome finally followed in 2024, but replaced third-party cookies with the Privacy Sandbox, a system that runs tracking inside the browser and reports interest-based categories to advertisers. The surveillance moved, it did not disappear.

Browser fingerprinting does not use cookies at all. Your browser reports its screen resolution, installed fonts, GPU model, system language, time zone, supported browser APIs, and dozens of other attributes to every site it contacts. The combination is statistically unique for most users. The EFF's Cover Your Tracks tool will show you your fingerprint and how unique it is among browsers that have visited the tool — most results come back as unique in a sample of hundreds of thousands. Fingerprinting persists across private browsing sessions, cookie deletion, and VPN use because it is derived from your hardware and software configuration, not stored data.

Brave's built-in fingerprint randomization adds noise to these signals, making your fingerprint slightly different on each site visit. Firefox with privacy.resistFingerprinting enabled in about:config does the same. Neither approach is invisible, but both substantially raise the cost of fingerprint-based tracking. Combined with uBlock Origin, which blocks known fingerprinting scripts from loading at all, the two approaches complement each other.

Email Tracking Pixels: Your Inbox Is Leaking Your Location

Email newsletters, marketing messages, and many personal emails from salespeople contain a tracking pixel — a transparent 1×1 image hosted on the sender's server. When your email client loads the message, it fetches that image. That fetch logs your IP address, your email client and operating system, and the exact timestamp of the open. If you forward the email and a colleague opens it, that shows up as a separate open from a different IP.

IP addresses can be mapped to a city with high accuracy and to a neighbourhood with moderate accuracy. A sender running email campaigns knows not just that you opened their message, but roughly where you were when you did it, on what device, and at what time of day. Salespeople with read-receipt tools like HubSpot Sales or Yesware can see that you opened their email fourteen seconds after it arrived, decided not to reply, and later opened it again from a different location.

Proton Mail blocks tracking pixels by default by routing all external image loads through its proxy servers. The sender receives a request from Proton's servers, not your IP, and the timestamp is randomized. Apple Mail on iOS 15 and later uses a similar proxy approach through its Mail Privacy Protection feature, though it prefetches all images whether you open the email or not, which can inflate open rates while protecting your IP.

In Gmail, you can disable automatic image loading: Settings → See all settings → Images → Ask before displaying external images. This breaks pixel tracking but also means legitimate images do not load until you click to allow them. Proton Mail's proxy approach is cleaner — images load normally from your perspective while your IP stays hidden.

App Trackers: What Your Phone Is Sending While You Use Free Apps

Most free mobile apps contain third-party SDKs from advertising and analytics companies. These SDKs are pre-built code libraries that app developers drop in to enable analytics, crash reporting, or ad monetization. The developer's primary business may be providing you a flashlight app or a weather widget, but the SDK inside is collecting and transmitting data on behalf of Google, Meta, AppsFlyer, Adjust, or similar companies.

An AppCensus analysis found that over 70% of Android apps share data with at least one third-party SDK. Common data points collected include device identifiers (the advertising ID, device model, and serial numbers), approximate and precise location, app usage patterns (which screens you visit, how long you spend on each), and in some documented cases, clipboard content. The 2021 TikTok controversy over clipboard access was an example of behavior that SDK-level tracking enables — the app didn't need the clipboard, but the SDK reached for it anyway.

Apple's App Tracking Transparency (ATT) in iOS 14.5 requires apps to ask permission before accessing the advertising ID used for cross-app tracking. Saying no removes one tracking vector but not SDK-level analytics within the app itself. An app can still log your in-app behavior and send it to its own servers without ATT permission. Android's equivalent opt-out (Settings → Privacy → Ads → Delete advertising ID) similarly limits one identifier while leaving other collection intact.

The most effective app-level reduction is using fewer apps. A browser-based version of a service — reading Reddit.com in Firefox with uBlock Origin instead of the Reddit app — removes SDK-level tracking entirely. For Android users comfortable with F-Droid, it is an open-source app repository containing free, audited alternatives to common apps: Fennec (Firefox fork), Newpipe (YouTube client with no Google tracking), and Simple Mobile Tools for contacts, calendar, and camera. None contain advertising SDKs by design.

Network-Level Trackers: Your ISP and DNS Exposure

DNS is the address book of the internet. When you type toolsfree.ai into your browser, your device asks a DNS resolver what IP address corresponds to that domain. By default on most home networks, that resolver is operated by your ISP, and it logs every domain you query. Your ISP sees every site you attempt to visit — not the content of the pages, which is encrypted over HTTPS, but the complete list of domains. That log is retained, and in many countries can be sold to advertising companies or provided to government agencies on request.

Switching your DNS resolver to Cloudflare 1.1.1.1 or Quad9 removes your ISP from this equation. Cloudflare's 1.1.1.1 has been independently audited and commits to deleting query logs within 24 hours. Quad9 is operated by a Swiss nonprofit and blocks known malicious domains as an additional benefit. The switch takes under five minutes on any device. Full instructions for every major platform are in our guide to free private DNS services.

DNS over HTTPS (DoH) adds a second layer: it encrypts the DNS query itself, so even your ISP cannot see which resolver you are using or intercept the query in transit. Cloudflare 1.1.1.1's app enables DoH on mobile. Chrome and Firefox both support DoH natively — Chrome: Settings → Privacy and security → Security → Use secure DNS; Firefox: Settings → Privacy & Security → DNS over HTTPS.

On public Wi-Fi — coffee shops, airports, hotels — your device's traffic passes through a network you do not control. The network operator can see your unencrypted traffic and can in principle conduct man-in-the-middle attacks on HTTPS connections if they control the network's certificate authority. Proton VPN free encrypts your traffic before it leaves your device, routing it through Proton's servers. No data cap, no speed throttling except during peak periods, no logs policy independently audited. See our full private browsing guide for the complete network-level setup.

The Free Toolkit to Stop All Four

These four tracking systems require four different countermeasures. No single tool addresses all of them.

Browser: Switch to Brave or use Firefox with uBlock Origin installed. Brave blocks third-party trackers and ads by default and enables fingerprint randomization out of the box. Firefox with uBlock Origin is a strong alternative, particularly on desktop where uBlock Origin retains full MV2 capabilities. On Chrome, install uBlock Origin Lite and accept reduced coverage or switch browsers for sensitive browsing. The full browser extension guide covers setup for all four browsers.

Email: Move to Proton Mail or enable image blocking in your current client. Proton Mail is free for one address with 1 GB of storage and proxies all external images by default, so you never need to configure anything. If you are staying on Gmail, disable automatic image loading and accept that manual image-loading is the trade-off. Proton Mail is available at proton.me — the free plan covers standard email needs with no ads.

Apps: Audit permissions on your phone's installed apps. On iOS: Settings → Privacy & Security → Location Services — revoke location access from any app that does not genuinely need it. Set location permission to "While Using" rather than "Always" for apps that do need it. On Android: Settings → Privacy → Permission Manager. Delete apps you have not opened in 30 days. For apps you need but prefer without tracking, check whether a browser-based alternative exists. F-Droid on Android provides open-source alternatives without advertising SDKs for many common categories.

Network: Switch your DNS to Cloudflare 1.1.1.1 or Quad9 and enable DNS over HTTPS in your browser. On untrusted networks, use Proton VPN free. The free tier provides unlimited bandwidth on servers in three countries — the US, Netherlands, and Japan — with WireGuard protocol and an audited no-logs policy. It covers the public Wi-Fi use case without any payment. For full setup details, see the DNS privacy guide.

What You Are Left With

After this setup, you have addressed the four main tracking vectors: browser-level third-party tracking and fingerprinting through Brave or Firefox with uBlock, email pixel tracking through Proton Mail or image blocking, app-level SDK tracking through permissions auditing and browser alternatives, and network-level DNS exposure through encrypted DNS and Proton VPN on public networks.

What you have not solved: first-party tracking on sites where you are logged in (Google still logs your Gmail usage; Facebook still records your Facebook activity), advertising within apps from the app's own server-side analytics rather than third-party SDKs, and tracking through link parameters in URLs (UTM codes embedded in newsletter links identify you to the sending service when you click, regardless of browser settings). These residual vectors are harder to address without more significant workflow changes.

The combination above is the practical baseline — the setup that most people will actually maintain and that covers the majority of tracking exposure. The full toolkit with breach monitoring, 2FA apps, and password manager setup is in the free security tools checklist.