Tracking prevention

Consent is a permission the visitor grants or withholds. Tracking prevention is something the browser does regardless — to visitors who consented and visitors who did not, without either being asked.

The mechanisms vary by browser and change on their own schedule, but the shapes are consistent: blocking third-party cookies outright, capping how long a cookie set by a script may live, stripping identifying parameters from URLs in some navigations, and limiting storage that persists across sites.

The consequence that catches teams out is that this happens after your configuration. You can set a generous cookie window and the browser can shorten it. Nothing errors. The cookie is simply gone earlier than you specified, for some proportion of visitors and not others, and the proportion moves as browsers ship updates.

So the numbers degrade unevenly. Two campaigns identical in every respect can measure differently because their audiences skew toward different browsers, and a reporting change can arrive with a browser release you did not know shipped.

What it does not touch. A click ID carried in a URL and stored in your own database is not subject to any of it — the value left the browser and lives in your system. Nor is a match on an identifier the customer gave you directly. This is the real reason those approaches became central: not that they are more accurate in principle, but that they survive conditions that break everything else.

And it is not a consent mechanism. Tracking prevention does not ask permission and does not record one, so it cannot substitute for a lawful basis. The two constraints stack.