The browser, point by point.
Twelve tracking points in an ordinary browsing session: cookies, fingerprints, pixels, auctions, and the watchers off the edge of the page, each with its cut.
Every page load is a negotiation you never see, run in milliseconds and recorded. This dossier walks every point on the Atlas browser map in depth, and most of its cuts take minutes.
Search history.
Search engines keep what you asked and what you clicked, timestamped, tied to your account or device. The query log is a diary of intentions. Engines log queries, clicks, location, and device, tied to your account or session. Histories personalize results and ads and answer legal process. Keyword warrants asking who searched a phrase have been documented in US courts. A private engine for sensitive questions splits the diary.
Known systems / GOOGLE · BING
A search log is the most honest document about you that exists.
Browser fingerprint.
Fonts, screen size, and settings combine into a signature that identifies your browser without any cookie. Blocking cookies alone misses it. Canvas rendering, fonts, hardware, and settings combine into a signature stable across cookie clears. Trackers lean on it where cookies die. FingerprintJS licenses the capability openly to fraud teams, and ad tech runs quieter cousins. Tor and Brave ship countermeasures; mainstream defaults mostly do not.
Known systems / FINGERPRINTJS
Deleting cookies is pointless against a tracker that recognizes the browser itself.
Extensions.
Add-ons can read every page you visit, and popular ones have been sold and turned into data collectors overnight. Add-ons with page access read everything you see and type where granted. Ownership changes convert trusted tools into collectors overnight. Avast’s Jumpshot sold clickstreams from a security extension until reporting shut it down and the FTC fined it. Fewer extensions from accountable authors, with narrow permissions.
Known systems / AVAST JUMPSHOT
One rogue update can turn a helpful add-on into a wiretap, and it has happened at scale.
Address lookups.
Every site name you visit is looked up in the open by default, visible to the network you are on. Encrypted DNS closes the leak. DNS translates names to addresses in cleartext by default, visible to the local network and resolver. The lookup pattern is a browsing log. Encrypted DNS now ships in every major browser and OS. Turning it on moves the visibility to a resolver you choose.
By default, the network you sit on can read every destination you type.
Your internet provider.
Your provider sees every connection from your home and can log and monetize the pattern. A VPN moves the visibility, and choosing where matters. The provider sees every connection’s destination and timing from your line, volume too. Policy decides what happens with it. The capability is already there. The FTC documented broad collection across major US providers after the 2017 rule rollback. Encryption hides content; the metadata remains the provider’s view.
Your provider is the one observer you cannot browse around, only encrypt against.
Sign-in buttons.
Logging in with a big platform tells that platform every service you use it on. Convenience wires your accounts into one observable graph. Federated login tells the identity provider every site and app you attach, with timestamps. The convenience graph doubles as a services census. One compromised identity account opens everything downstream. Passkeys plus a manager give the convenience without the census.
Known systems / SIGN IN WITH GOOGLE · FACEBOOK LOGIN
Every convenient sign-in trades a map of your services for a saved password.
Data matching.
Brokers join your email and phone number across sites, stitching anonymous browsing to your real identity. The join keys are the identifiers you reuse. Identity graphs join emails, phones, addresses, and device IDs across sites into one persistent you. Onboarding services match offline records to online profiles. LiveRamp, Acxiom, and Experian run the visible end of the market. Unique emails per service quietly break the join keys.
Known systems / LIVERAMP · ACXIOM · EXPERIAN
The join between your accounts is the product. You are the primary key.
Ad auctions.
Each ad slot broadcasts your profile and location to hundreds of bidders in milliseconds, and that bid-stream data leaks into surveillance tools. Each page load broadcasts bid requests carrying your profile and location, page context included, to hundreds of companies in milliseconds. Losing bidders keep the data. Irish Council for Civil Liberties research documented the broadcast’s scale, and surveillance vendors have bought from the stream. Blocking ads is a privacy control, not a cosmetic one.
Known systems / OPENRTB · FOG REVEAL
Hundreds of companies learn your location every time a page loads an ad, and some resell the stream.
Cookies.
Tracking cookies follow you across sites to build a browsing profile. Blockers and strict browser settings cut most of it. Third-party cookies let one tracker recognize you across every site that embeds it. Browsers are phasing them out at very different speeds. Chrome ultimately walked back its deprecation plan, keeping the oldest tracker alive. Strict tracking protection and container tabs do now what the phase-out promised.
Known systems / CRITEO
The oldest tracker on the web still works because defaults still allow it.
Social buttons.
Embedded like and share buttons report your visit to the platform whether or not you click. The button is a camera facing the page. Embedded pixels and buttons report page views to their platforms whether or not you click or hold an account. Server-side variants dodge blockers. The Markup found Meta’s pixel on hospital scheduling pages, transmitting health details. The button is a camera facing the page, and it was pointed at waiting rooms.
Known systems / META PIXEL · TIKTOK PIXEL
Pages report your visit to platforms you never opened.
Password reuse.
One leaked password gets tried against every account you own. A manager and unique passwords end the chain. Credential stuffing replays leaked pairs against every major service at machine speed. One old reuse opens accounts you still care about. Leaked pairs circulate in combo lists for years after the breach. A manager and unique passwords end the entire class of attack, with second factors as the backstop.
A ten-year-old leak plus one reused password is a working key today.
Email spy pixels.
Invisible images in marketing email report when you read it and where, down to the device. Blocking remote images blinds them. Invisible images report opens to the sender’s platform with a timestamp and rough location, plus the device. Marketing suites bundle the tracking by default. Apple’s Mail Privacy Protection prefetches images to blunt it, and blocking remote images does the rest. Reading your mail should not be a read receipt.
Opening an email can be a read receipt you never agreed to send.
The dossier covers what these systems do. When the person on the other end of one of them is a stalker or a stranger with intent, a threat that persists, that is Darkveil’s work.
Talk to Darkveil