--- title: "Tracking & Targeting demo" description: "A live demonstration of what your browser reveals, how that data is auctioned, and how profiles are used to target manipulation. Nothing leaves your browser unless you press the tracker test." url: https://attentionmachine.org/en/attention-machine/tracking-and-targeting/ lang: en updated: 2026-10-25 license: "CC BY-NC-SA 4.0 (https://creativecommons.org/licenses/by-nc-sa/4.0/)" --- # Tracking & Targeting demo A live demonstration. Three phases: what your browser reveals about you, how that data is auctioned, and how the resulting profile is used to target manipulation. Everything runs in your browser. **Nothing is sent anywhere unless you press the tracker test, which sends three real requests to Google and X.** The idea for this demo comes from the EFF's Cover Your Tracks[^src-eff] — the Electronic Frontier Foundation's long-running tool that shows what your browser reveals to trackers and how unique your fingerprint is. Run it alongside this page for a second, independent reading of your exposure. This site uses cookieless analytics only — no personal data, no profile (details on the [privacy page](https://attentionmachine.org/en/about/privacy/)). With one deliberate exception: _this page_ can load three real advertising and analytics trackers, once, so the demonstration below can honestly test whether your browser blocks them — but only when you press the button in the first demo; nothing is loaded before that. They are the only trackers on the entire site. Each request carries what any image request carries — your IP address, this site's address (not this page's: the site asks your browser to leave the rest of the address out), and any cookie your browser already holds for that company, which is precisely the identifier that makes it a tracker. If your browser accepts cookies from other sites, two of the companies set one in reply: X a cookie called muc\_ads that lasts two years, and DoubleClick a test cookie that lasts fifteen minutes[^src-probe-headers-2026]. Nothing else is sent, and we store nothing. ## Phase 1 — What this page already knows Without clicking anything, without logging in, your browser reveals a significant amount to every site you visit. The list below is what this page can read about you using standard JavaScript — no special permissions, no server request required. No consent prompt appears for any of it. In the EU it should: the European Data Protection Board's Guidelines 2/2023[^src-european-data-2024] confirm that reading information already stored on your device — which is what fingerprinting does — falls under Article 5(3) of the ePrivacy Directive and needs consent. You will rarely see it asked for. It is the baseline state of the web. The signals are individually mundane. The screen size, the language, the timezone, the device's pixel density. Combined, they form a fingerprint often sufficient to identify you across sites without a cookie[^src-eckersley-2010]. For a precise measurement of how unique your browser is, the EFF's Cover Your Tracks tool[^src-eff] is the reference. These signals — combined with your IP address, browsing history, and data broker records you've never interacted with — form a persistent profile. Cookies are only one mechanism among many. Fingerprinting survives clearing cookies[^src-eckersley-2010]. Your browser can also ask not to be tracked. In California the law requires businesses to honour Global Privacy Control[^src-california-attorney-2026] as a request to stop selling or sharing your data, and Colorado recognises it[^src-colorado-department-2026] under its own privacy law; the older Do Not Track signal was shelved by the W3C in 2019[^src-w3c-2019], because too few sites and browsers took it up. The live test above probes three layers, each more invasive than it sounds. **Analytics** is the one everyone accepts as harmless — "just visitor stats." Yet Google Analytics sits on close to half of all websites — more than four in five of those that run any analytics at all (W3Techs[^src-w3techs-2026]). Its cookie is set separately on each site[^src-google-2026], but on every one of them your browser sends Google the address of the page and your IP address[^src-google-2026-b], which Google may use, depending on your settings, to personalise the ads you see elsewhere. "Just stats" is the raw material of a cross-site record of where you go. The **ad exchange** layer is where that record becomes a product: you are sorted into remarketing audiences[^src-google-2026-c] and sold. The **social** layer is the one most people never agreed to — the Facebook Like button[^src-court-justice-2019] and its equivalents[^src-x-2026] reported your visit to every page they appeared on, whether or not you clicked, whether or not you even had an account. Presence was the data. The button was the sensor. **Why the tracker test says only 'blocked' or 'loaded' — and not 'partially blocked'** The live test above reports two outcomes per tracker: it was **blocked**, or it **loaded**. The EFF's Cover Your Tracks[^src-eff] — the tool this demo is modelled on — reports a third, middle outcome: _partial_ protection. Some privacy tools do not block a tracker outright; they let the request through but strip the identifying part (the cookie), so the tracker fires yet cannot actually recognise you. Our two-way test cannot see that: it would call such a tracker "loaded" and imply no protection, when in fact you are partly protected. A three-way "blocked / partial / loaded" result would be more accurate, and would teach a real distinction — a tracker being _blocked_ versus merely _neutered_. **Why we deliberately do not do it here.** To detect the middle state, the tracker has to report back what it received — did the cookie survive, did the identifier survive? Real trackers (Google, X) do not tell us that. So we would have to run _our own_ tracker endpoint that logs what it got. But it would have to sit on a _separate_ web address that ad-blockers genuinely recognise and block — a first-party endpoint on this site is never blocked, so it would report "not protected" for almost everyone and mislead you. And any such endpoint _receives data from your browser_ — which would break the promise at the top of this page: nothing here is sent anywhere. Every honest version of the upgrade needs infrastructure we do not have, or breaks that guarantee. So we keep the two-way test, and pair it with the fingerprint reading below it, which makes the more important point without sending anything: you remain identifiable even when every tracker here is blocked. This site does none of this. It uses a self-hosted Plausible instance — cookieless, with no personal data collected and nothing that identifies you. What the box above shows is what any website receives from your browser, this one included. We chose not to use it against you. What the site does count is listed on the [privacy page](https://attentionmachine.org/en/about/privacy/). ## Phase 2 — How that data is auctioned On a typical commercial website, the milliseconds between you loading the page and the page becoming usable contain a hidden event: a real-time bidding (RTB) auction. Your browser profile is assembled into a bid request[^src-openrtb-specification] and broadcast simultaneously to dozens of advertising companies. They evaluate, they bid, the winner's ad is shown. The auction completes in roughly 100 milliseconds[^src-wang-2017] — before you finish reading the headline. The critical detail is the word _broadcast_. According to research by the Irish Council for Civil Liberties[^src-iccl-2022], this happens to the average EU internet user an estimated **376 times per day**. In the United States, the estimate is **747 times per day**. Not to the winning bidder — to all bidders. Every company that receives the broadcast can keep a copy of your profile whether or not it wins the auction, and nothing in the system stops it. The Belgian Data Protection Authority[^src-belgian-data-2022] found in 2022 that the industry's consent framework for RTB breaches the GDPR, and in 2024 the Court of Justice of the European Union[^src-court-justice-2024], answering questions from the Belgian appeal court, confirmed the decision's two premises: the consent string is personal data, and IAB Europe is a joint controller of it — which the Belgian Market Court confirmed in May 2025[^src-belgian-data-2025], upholding the fine while ruling that IAB Europe's role does not extend to the processing inside the auction itself. The auction itself has never been ruled lawful; the framework that is supposed to legitimise it has been ruled unlawful. In plainer words: the consent mechanism RTB relies on has been found not to comply with the law, and the auction runs on regardless. The simulation below uses your real browser signals as input. The bidders are real companies; the bid values are illustrative. This site does not actually run RTB — what you see is what happens on sites that do. ## Phase 3 — How that profile is used to manipulate you The profile assembled in Phase 1 and sold in Phase 2 can be purchased by any actor with an advertising budget — including political campaigns, state-sponsored influence operations, and bad-faith content creators. Targeting that began as commercial advertising became, by the same mechanism, infrastructure for psychological influence at scale. The demonstration below shows how. Based on your inferred signals, the system selects an emotional vulnerability. From that, it selects a manipulation technique with a documented psychological mechanism. From that, it constructs content — source name, headline, body, engagement hook, each element a deliberate choice. The framing is then dressed for your inferred income tier[^src-mattioli-2012] and region — loss-framing[^src-kahneman-1979] for profiles that appear to have assets, exclusion-framing for profiles that appear to have less — and, like a real system, which variant you get is split-tested[^src-kohavi-2009] against your signal mix. The demo tells you exactly which inferences it made and why, including the ones that are wrong: crude, wrong predictions still get acted on. The post you'll see is **fictional and labelled**. The point is recognition: Cambridge University researchers[^src-roozenbeek-linden-2022] have shown that knowing how a manipulation technique works before you encounter it makes you significantly more resistant. This effect is called _prebunking_, or psychological inoculation. The Bad News game by DROG[^src-bad-news] teaches it interactively in about fifteen minutes[^src-roozenbeek-2019]. One thing to do now **See what Google and Meta think you are.** Both let you see the interests they have assigned you, and switch off ads based on them: [Google My Ad Center](https://myadcenter.google.com/) · [Meta Ad preferences](https://accountscenter.facebook.com/ad_preferences) (log in first). ## What you've just seen Three phases, one system. Your browser passively reveals data. That data is auctioned to advertisers — and to anyone else with a budget. The resulting profile is used to select, then construct, content engineered to bypass your critical evaluation. No individual setting defeats this fully. Partial defences exist — uBlock Origin (the tracker blocker [Tools & Sites](https://attentionmachine.org/en/educate/tools/) recommends), Firefox with enhanced tracking protection, the Brave browser, the EFF's Privacy Badger. Each one reduces the surface area; none eliminates it. The answer that matches the scale of the system is structural; the GDPR and the Digital Services Act are the most serious attempts so far, and neither has finished the job. The most durable defence is recognising the techniques when you see them. That is the argument for prebunking, and the reason this page exists. ## Sources [^src-openrtb-specification]: [OpenRTB specification](https://iabtechlab.com/standards/openrtb/) — IAB Tech Lab. [^src-eckersley-2010]: Eckersley, P. (2010), [_How Unique Is Your Web Browser?_](https://coveryourtracks.eff.org/static/browser-uniqueness.pdf), PETS 2010 — the study behind the EFF's Cover Your Tracks; source of the per-signal entropy figures in the fingerprint-arithmetic block. [^src-iccl-2022]: [ICCL](https://www.iccl.ie/news/iccl-report-on-the-scale-of-real-time-bidding-data-broadcasts-in-the-u-s-and-europe/) — RTB research (2022); 376 (EU) / 747 (US) exposures per day. [^src-european-data-2024]: European Data Protection Board (2024), [_Guidelines 2/2023 on the Technical Scope of Art. 5(3) of the ePrivacy Directive_](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-22023-technical-scope-art-53-eprivacy-directive_en) — fingerprinting and other device-reading techniques fall within the consent requirement. [^src-belgian-data-2022]: Belgian Data Protection Authority (2 February 2022), [Decision 21/2022 — IAB Europe's Transparency and Consent Framework held in breach of the GDPR](https://www.dataprotectionauthority.be/citizen/iab-europe-held-responsible-for-a-mechanism-that-infringes-the-gdpr). [^src-belgian-data-2025]: Belgian Data Protection Authority (14 May 2025), [The Market Court rules in the IAB Europe case](https://www.dataprotectionauthority.be/the-market-court-rules-in-the-iab-europe-case) — decision 21/2022 annulled on procedural grounds, the €250,000 fine confirmed; IAB Europe a joint controller “for the processing of user preferences within the TCF”, not for processing entirely within the OpenRTB protocol. [^src-court-justice-2024]: Court of Justice of the European Union (7 March 2024), [_IAB Europe_, Case C-604/22](https://curia.europa.eu/juris/liste.jsf?num=C-604/22) — a TC String is personal data and IAB Europe a joint controller. [^src-court-justice-2019]: Court of Justice of the European Union (29 July 2019), [_Fashion ID_, Case C-40/17](https://curia.europa.eu/juris/liste.jsf?num=C-40/17). [^src-roozenbeek-linden-2022]: Roozenbeek & van der Linden et al. (2022), [_Psychological inoculation improves resilience against misinformation_](https://doi.org/10.1126/sciadv.abo6254), Science Advances. [^src-cambridge-social]: [Cambridge Social Decision-Making Lab](https://www.sdmlab.psychol.cam.ac.uk) — prebunking research. [^src-bad-news]: [Bad News](https://getbadnews.com) — the inoculation game, free in the browser, from the Cambridge Social Decision-Making Lab and DROG. [^src-eff]: [EFF Cover Your Tracks](https://coveryourtracks.eff.org). [^src-w3techs-2026]: [W3Techs](https://w3techs.com/technologies/details/ta-googleanalytics) — Google Analytics usage: 47% of all websites, 82% of those using a traffic-analysis tool (October 2026). Vendor survey of the top 10 million sites — an industry estimate. [^src-google-2026]: Google, [_\[GA4\] Cookie usage on websites_](https://support.google.com/analytics/answer/11397207), Analytics Help (read October 2026) — “The GA4 JavaScript tags use first-party cookies to distinguish unique users”. [^src-google-2026-b]: Google, [_How Google uses information from sites or apps that use our services_](https://policies.google.com/technologies/partner-sites), Google Privacy & Terms (read October 2026) — when you visit a site that uses Google Analytics, “your web browser automatically sends certain information to Google. This includes the URL of the page you’re visiting and your IP address.” [^src-wang-2017]: Wang, J., Zhang, W. & Yuan, S. (2017), [_Display Advertising with Real-Time Bidding (RTB) and Behavioural Targeting_](https://doi.org/10.1561/1500000049), Foundations and Trends in Information Retrieval 11(4–5), 297–435 (open version: arXiv:1610.03013) — from a page visit to the winning ad "usually within 100ms". [^src-roozenbeek-2019]: Roozenbeek, J. & van der Linden, S. (2019), [_Fake news game confers psychological resistance against online misinformation_](https://doi.org/10.1057/s41599-019-0279-9), Palgrave Communications 5(65) — the Bad News evaluation, 15,000 players; the six techniques the game teaches. [^src-google-2026-c]: Google, [_About your data segments_](https://support.google.com/google-ads/answer/2453998), Google Ads Help (read October 2026) — remarketing lists, now called “your data”: “Use your data to re-engage people who have previously interacted with your brand or services”; the ads are “shown to people in this segment as they browse Google or partner websites”. [^src-x-2026]: X, [_How cookies are used on X_](https://help.x.com/en/rules-and-policies/x-cookies), X Help Center (read October 2026) — X receives information about your device “whether or not you’re logged in” when you visit a site that integrates X services or an X advertiser’s website; a device that has ever logged in to X stays associated with that account. [^src-probe-headers-2026]: The tracker test’s own requests, recorded in Chromium on 22 October 2026 — each carried `Referer: https://attentionmachine.org/`; `t.co` answered with `Set-Cookie: muc_ads=…; Max-Age=63072000` (two years), `googleads.g.doubleclick.net` with `Set-Cookie: test_cookie=CheckForPermission` expiring after fifteen minutes, and `www.google-analytics.com` with no cookie. Your browser’s network panel shows the same headers when you run the test. [^src-kahneman-1979]: Kahneman, D. & Tversky, A. (1979), [_Prospect Theory: An Analysis of Decision under Risk_](https://doi.org/10.2307/1914185), Econometrica 47(2), 263–291 — "losses loom larger than gains". [^src-kohavi-2009]: Kohavi, R., Longbotham, R., Sommerfield, D. & Henne, R.M. (2009), [_Controlled experiments on the web: survey and practical guide_](https://doi.org/10.1007/s10618-008-0114-1), Data Mining and Knowledge Discovery 18, 140–181 — the “hash and partition” method: a hash of each user’s identifier assigns the user to a variant. [^src-mattioli-2012]: Mattioli, D. (25 June 2012), [_On Orbitz, Mac Users Steered to Pricier Hotels_](https://www.wsj.com/articles/SB10001424052702304458604577488822667325882), The Wall Street Journal — Orbitz found that Mac users “spend as much as 30% more a night on hotels” and began showing them “different, and sometimes costlier, travel options than Windows visitors see”. [^src-california-attorney-2026]: California Attorney General (2026), [_California Consumer Privacy Act (CCPA)_](https://oag.ca.gov/privacy/ccpa), State of California Department of Justice (updated 28 August 2026) — a user-enabled global privacy control “must be honored by covered businesses as a valid consumer request to stop the sale or sharing of personal information”. [^src-colorado-department-2026]: Colorado Department of Law (2026), [_Colorado Privacy Act_](https://coag.gov/resources/colorado-privacy-act/) (read October 2026) — Global Privacy Control, “the state’s first universal opt-out mechanism”; the Department “has published a list of Universal Opt-Out Mechanisms that have been recognized to meet the standards of the Colorado Privacy Act”. [^src-w3c-2019]: W3C (17 January 2019), [_Tracking Preference Expression (DNT)_](https://www.w3.org/TR/tracking-dnt/), Working Group Note — published as a Note because there was not “sufficient deployment of these extensions (as defined) to justify further advancement”, nor “planned support among user agents, third parties, and the ecosystem at large”. [← Advertising & Surveillance](https://attentionmachine.org/en/attention-machine/advertising/)\ [Data Combination demo →](https://attentionmachine.org/en/attention-machine/data-combination/)\ [State Actors →](https://attentionmachine.org/en/attention-machine/state-actors/)\ [Educate Yourself →](https://attentionmachine.org/en/educate/) --- Some content on this site was created with the assistance of AI tools and may contain errors. [How we use AI →](https://attentionmachine.org/en/about/how-we-use-ai/)