← The Attention Machine

Tracking & Targeting demo

A live demonstration. Three phases: what your browser reveals about you, how that data is auctioned, and how the resulting profile is used to target manipulation. Everything runs in your browser. Nothing is sent anywhere unless you press the tracker test, which sends three real requests to Google and X.

How to read this page. The three phases below run live, but the explanation carries the whole argument on its own — it reads fully with JavaScript off. Expand the "Deeper" box for how the tracker test works and its honest limits.

The idea for this demo comes from the EFF's Cover Your Tracks — the Electronic Frontier Foundation's long-running tool that shows what your browser reveals to trackers and how unique your fingerprint is. Run it alongside this page for a second, independent reading of your exposure.

This site uses cookieless analytics only — no personal data, no profile (details on the privacy page). With one deliberate exception: this page can load three real advertising and analytics trackers, once, so the demonstration below can honestly test whether your browser blocks them — but only when you press the button in the first demo; nothing is loaded before that. They are the only trackers on the entire site. Each request carries what any image request carries — your IP address, this site's address (not this page's: the site asks your browser to leave the rest of the address out), and any cookie your browser already holds for that company, which is precisely the identifier that makes it a tracker. If your browser accepts cookies from other sites, two of the companies set one in reply: X a cookie called muc_ads that lasts two years, and DoubleClick a test cookie that lasts fifteen minutes. Nothing else is sent, and we store nothing.

Phase 1 — What this page already knows

Without clicking anything, without logging in, your browser reveals a significant amount to every site you visit. The list below is what this page can read about you using standard JavaScript — no special permissions, no server request required. No consent prompt appears for any of it. In the EU it should: the European Data Protection Board's Guidelines 2/2023 confirm that reading information already stored on your device — which is what fingerprinting does — falls under Article 5(3) of the ePrivacy Directive and needs consent. You will rarely see it asked for. It is the baseline state of the web.

The signals are individually mundane. The screen size, the language, the timezone, the device's pixel density. Combined, they form a fingerprint often sufficient to identify you across sites without a cookie. For a precise measurement of how unique your browser is, the EFF's Cover Your Tracks tool is the reference.

These signals — combined with your IP address, browsing history, and data broker records you've never interacted with — form a persistent profile. Cookies are only one mechanism among many. Fingerprinting survives clearing cookies. Your browser can also ask not to be tracked. In California the law requires businesses to honour Global Privacy Control as a request to stop selling or sharing your data, and Colorado recognises it under its own privacy law; the older Do Not Track signal was shelved by the W3C in 2019, because too few sites and browsers took it up.

The live test above probes three layers, each more invasive than it sounds. Analytics is the one everyone accepts as harmless — "just visitor stats." Yet Google Analytics sits on close to half of all websites — more than four in five of those that run any analytics at all (W3Techs). Its cookie is set separately on each site, but on every one of them your browser sends Google the address of the page and your IP address, which Google may use, depending on your settings, to personalise the ads you see elsewhere. "Just stats" is the raw material of a cross-site record of where you go. The ad exchange layer is where that record becomes a product: you are sorted into remarketing audiences and sold. The social layer is the one most people never agreed to — the Facebook Like button and its equivalents reported your visit to every page they appeared on, whether or not you clicked, whether or not you even had an account. Presence was the data. The button was the sensor.

Why the tracker test says only 'blocked' or 'loaded' — and not 'partially blocked' +

The live test above reports two outcomes per tracker: it was blocked, or it loaded. The EFF's Cover Your Tracks — the tool this demo is modelled on — reports a third, middle outcome: partial protection. Some privacy tools do not block a tracker outright; they let the request through but strip the identifying part (the cookie), so the tracker fires yet cannot actually recognise you. Our two-way test cannot see that: it would call such a tracker "loaded" and imply no protection, when in fact you are partly protected. A three-way "blocked / partial / loaded" result would be more accurate, and would teach a real distinction — a tracker being blocked versus merely neutered.

Why we deliberately do not do it here. To detect the middle state, the tracker has to report back what it received — did the cookie survive, did the identifier survive? Real trackers (Google, X) do not tell us that. So we would have to run our own tracker endpoint that logs what it got. But it would have to sit on a separate web address that ad-blockers genuinely recognise and block — a first-party endpoint on this site is never blocked, so it would report "not protected" for almost everyone and mislead you. And any such endpoint receives data from your browser — which would break the promise at the top of this page: nothing here is sent anywhere. Every honest version of the upgrade needs infrastructure we do not have, or breaks that guarantee. So we keep the two-way test, and pair it with the fingerprint reading below it, which makes the more important point without sending anything: you remain identifiable even when every tracker here is blocked.

This site does none of this. It uses a self-hosted Plausible instance — cookieless, with no personal data collected and nothing that identifies you. What the box above shows is what any website receives from your browser, this one included. We chose not to use it against you. What the site does count is listed on the privacy page.

Phase 2 — How that data is auctioned

On a typical commercial website, the milliseconds between you loading the page and the page becoming usable contain a hidden event: a real-time bidding (RTB) auction. Your browser profile is assembled into a bid request and broadcast simultaneously to dozens of advertising companies. They evaluate, they bid, the winner's ad is shown. The auction completes in roughly 100 milliseconds — before you finish reading the headline.

The critical detail is the word broadcast. According to research by the Irish Council for Civil Liberties, this happens to the average EU internet user an estimated 376 times per day. In the United States, the estimate is 747 times per day. Not to the winning bidder — to all bidders. Every company that receives the broadcast can keep a copy of your profile whether or not it wins the auction, and nothing in the system stops it.

The Belgian Data Protection Authority found in 2022 that the industry's consent framework for RTB breaches the GDPR, and in 2024 the Court of Justice of the European Union, answering questions from the Belgian appeal court, confirmed the decision's two premises: the consent string is personal data, and IAB Europe is a joint controller of it — which the Belgian Market Court confirmed in May 2025, upholding the fine while ruling that IAB Europe's role does not extend to the processing inside the auction itself. The auction itself has never been ruled lawful; the framework that is supposed to legitimise it has been ruled unlawful. In plainer words: the consent mechanism RTB relies on has been found not to comply with the law, and the auction runs on regardless.

The simulation below uses your real browser signals as input. The bidders are real companies; the bid values are illustrative. This site does not actually run RTB — what you see is what happens on sites that do.

Phase 3 — How that profile is used to manipulate you

The profile assembled in Phase 1 and sold in Phase 2 can be purchased by any actor with an advertising budget — including political campaigns, state-sponsored influence operations, and bad-faith content creators. Targeting that began as commercial advertising became, by the same mechanism, infrastructure for psychological influence at scale.

The demonstration below shows how. Based on your inferred signals, the system selects an emotional vulnerability. From that, it selects a manipulation technique with a documented psychological mechanism. From that, it constructs content — source name, headline, body, engagement hook, each element a deliberate choice. The framing is then dressed for your inferred income tier and region — loss-framing for profiles that appear to have assets, exclusion-framing for profiles that appear to have less — and, like a real system, which variant you get is split-tested against your signal mix. The demo tells you exactly which inferences it made and why, including the ones that are wrong: crude, wrong predictions still get acted on.

The post you'll see is fictional and labelled. The point is recognition: Cambridge University researchers have shown that knowing how a manipulation technique works before you encounter it makes you significantly more resistant. This effect is called prebunking, or psychological inoculation. The Bad News game by DROG teaches it interactively in about fifteen minutes.

What you've just seen

Three phases, one system. Your browser passively reveals data. That data is auctioned to advertisers — and to anyone else with a budget. The resulting profile is used to select, then construct, content engineered to bypass your critical evaluation.

No individual setting defeats this fully. Partial defences exist — uBlock Origin (the tracker blocker Tools & Sites recommends), Firefox with enhanced tracking protection, the Brave browser, the EFF's Privacy Badger. Each one reduces the surface area; none eliminates it. The answer that matches the scale of the system is structural; the GDPR and the Digital Services Act are the most serious attempts so far, and neither has finished the job.

The most durable defence is recognising the techniques when you see them. That is the argument for prebunking, and the reason this page exists.

← Advertising & Surveillance
Data Combination demo →
State Actors →
Educate Yourself →