Short answer: The strategy is retargeting, also called remarketing, which is built on cross-site tracking and behavioural targeting. Cookies, tracking pixels, login IDs and device identifiers record what someone does on one site, then ad platforms use that history to show them relevant ads on other sites and apps. In 2026 it works only with proper consent, and browser privacy controls limit how far it can follow people.
This guide is for marketers, students answering this exact question in a course or quiz, and business owners who keep seeing “we use cookies” banners and want to know what is actually happening behind them. By the end you will know what the strategy is called, the technologies that make it work, how browsers and privacy law have changed it, and how I set up tracking for clients so it is both useful and compliant.
What is the strategy called?
If you met this as a multiple-choice question, the expected answer is retargeting (Google Ads calls it remarketing). Someone visits your site, a small piece of code notes the visit, and later that person sees your ad on a news site, YouTube or Instagram. The wider practice underneath it has several names that people use loosely:
- Cross-site (cross-web) tracking: following one browser’s activity across different websites, mainly through third-party cookies and pixels.
- Cross-device tracking: linking a person’s phone, laptop and tablet into one profile, usually through a login.
- Behavioural targeting: choosing which ad to show based on that recorded behaviour.
- Multi-touch attribution: using the same tracking to work out which ads and channels led to a sale.
Retargeting is the visible result; tracking is the plumbing. It sits alongside the other channels in my overview of types of digital marketing strategies, and it works best as a supporting tactic, not the whole plan.
How cross-web tracking works, step by step
- A visit is recorded. A tag on your site (Google tag, Meta Pixel, LinkedIn Insight Tag) fires when a page loads and sends the page, time and a browser identifier to the ad platform.
- The visitor is added to an audience. For example “viewed a product, did not buy, last 30 days”.
- The identifier is recognised elsewhere. When the same browser or logged-in user appears on a site or app in that platform’s network, the platform knows they belong to your audience.
- An ad is shown. Often the exact product they looked at, a reminder, or an offer.
- The result is measured. If they come back and buy, the platform credits the ad and the data feeds the next round of bidding.
Rather have an expert do this for you?
Hand it over and get back to running your business.
The technologies behind it
| Technology | What it does | Main limit in 2026 |
|---|---|---|
| First-party cookies | Set by your own domain; remember sessions, carts and returning visitors | Safari caps script-set cookies at 7 days without interaction |
| Third-party cookies | Set by an ad or analytics domain; recognise the same browser across many sites | Blocked by default in Safari and Firefox; user choice in Chrome |
| Tracking pixels and tags | Tiny scripts or images that report page views and conversions | Blocked by ad blockers; need consent in the UK and EU |
| Login-based IDs | Google, Meta or your own account login ties devices together | Only works for signed-in users |
| Mobile advertising IDs | Identify a device across apps | Apple requires apps to ask permission before tracking |
| Server-side and conversion APIs | Send conversion data from your server to the ad platform | Still subject to consent; needs technical set-up |
| Fingerprinting | Guesses identity from device and browser settings | Opaque to users; browsers actively resist it, and I advise clients not to use it |
Cookies and pixels
A cookie is a small text file stored in the browser. A first-party cookie belongs to the site you are on; a third-party cookie belongs to another domain loaded on that page, which is what lets an ad network recognise you on site after site. A pixel is the messenger: a snippet that reports “this browser just viewed the checkout page”. This is exactly the mechanism that browser privacy features now target.
Cross-device tracking
People often research on a phone and buy on a laptop. Platforms link those sessions mainly through logins: if you are signed in to Google or Meta on both devices, the platform can treat them as one person. Without a login, cross-device matching is far less reliable, which is why first-party accounts and email sign-ups have become so valuable.
Analytics, CRM and data platforms
Google Analytics 4 measures what visitors do on your own site (my guide to using Google Analytics for SEO covers the set-up) and can share audiences with Google Ads; I explain exactly what that link allows in what Google Ads can do with Analytics audiences. CRMs such as HubSpot or Salesforce join web activity to email and sales records, and customer data platforms combine all of it into one profile.
How the rules changed: browsers, apps and law
Most articles on this topic still say “third-party cookies are going away”. The real picture in 2026 is more mixed, and it matters for how you plan.
- Chrome: after years of planning to remove third-party cookies, Google announced in April 2025 that it would keep its current approach of letting users choose in Chrome’s privacy settings and would not roll out a new standalone prompt. Third-party cookies still work for many Chrome users, but not all.
- Safari: WebKit’s tracking prevention blocks all third-party cookies by default and deletes script-set cookies and storage after 7 days without user interaction. On iPhones, a large share of your audience is effectively untrackable across sites.
- iOS apps: Apple’s App Tracking Transparency means apps must ask permission before tracking people across other companies’ apps and websites.
- UK and EU law: the UK regulator, the ICO’s cookie guidance, says you must tell people what cookies and similar technologies do and get consent that is actively and clearly given, except for cookies that are strictly necessary. GDPR and the ePrivacy rules set a similar standard across the EU.
- US: state laws such as California’s CCPA/CPRA give people the right to opt out of the sale or sharing of their data for cross-context behavioural advertising.
- Pakistan: there is no in-force national data protection law equivalent to GDPR at the time of writing, but if your customers are in the UK, EU, US or Gulf, their rules apply to you. Pakistani exporters and agencies running ads abroad need consent banners like anyone else.
People are uneasy about all this. Pew Research Center’s 2023 privacy survey found 67% of US adults say they understand little to nothing about what companies do with their data, and 73% feel they have little or no control over data companies collect. Tracking that surprises people damages trust faster than it builds sales.
Benefits, and the limits nobody mentions
| Benefit | Honest limit |
|---|---|
| Reminds warm visitors who left without buying | Many would have come back anyway, so platforms can over-credit retargeting |
| Personalised ads based on what someone viewed | Showing the same product for weeks after purchase annoys people; use exclusions and frequency caps |
| Shows which channels lead to sales | Attribution has gaps wherever consent is refused or cookies are blocked |
| Cross-device view of a customer | Mostly limited to logged-in users |
| Better ad spend decisions | Every extra tag adds page weight and can slow your site |
The last point is one I see constantly. When I audit sites, it is common to find several ad pixels, two analytics tools and an old tag nobody remembers, all loading on every page. That hurts load time and Core Web Vitals, which affects both SEO and conversion. Trimming tags is often a quick part of web performance optimisation.
How I set up tracking that is useful and compliant
Privacy-first tracking setup checklist
- List every tag on the site: analytics, ad pixels, chat widgets and heatmaps. Remove anything nobody uses.
- Put tags in one place: a tag manager, so nothing is hard-coded into the theme.
- Add a consent banner that actually blocks tags: non-essential tags should not fire until the visitor agrees.
- Use Google Consent Mode if you run Google Ads: tags then respect the visitor’s choice.
- Write a plain cookie policy: what each tool does, in normal language.
- Prioritise first-party data: accounts, email sign-ups and your CRM, collected with clear permission.
- Tag your own links with UTM parameters: campaign tracking that needs no cross-site cookie.
- Set audience durations and exclusions: drop people who already bought.
- Cap ad frequency: a few views a day is a reminder; twenty is harassment.
- Consider server-side conversion tracking: more reliable data, still only with consent.
- Check speed after adding tags: run the page through a speed test before and after.
- Review it every quarter: platforms, laws and browsers keep changing.
Ticks are saved in your browser.
For the speed step, my free PageSpeed checker gives a quick before-and-after reading. For the UTM step, my free UTM builder creates tagged links in seconds. To see where traffic from AI assistants fits into the same reporting, read my guide to tracking AI referral traffic in GA4.
Alternatives that rely less on tracking
- Contextual advertising: target the content of the page (a cricket ad on a cricket article), not the person’s history.
- Organic search: someone searching “best AC repair in Gulshan” has told you their intent without any tracking. That is why SEO pairs so well with paid retargeting: search brings the first visit, retargeting reminds the undecided. My guide to search engine marketing strategies covers both sides.
- Email and owned audiences: people who opted in, on a list you control.
- Aggregated measurement: modelled conversions and marketing mix models that estimate impact without following individuals.
Check your understanding
A shopper views trainers on your site, leaves, and later sees those trainers in an ad on a news site. What is this called?
- Contextual advertising
- Retargeting (remarketing)
- Search engine optimisation
Retargeting uses a record of the earlier visit to show a related ad elsewhere. Contextual ads use the page content, not the person’s history.
Which browser blocks all third-party cookies by default?
- Chrome, since 2025
- None of them
- Safari
WebKit’s tracking prevention in Safari blocks all third-party cookies by default. Chrome kept user choice instead.
Under UK cookie rules, when can an ad pixel fire without consent?
- Never: advertising tags are not strictly necessary
- Whenever the visitor scrolls the page
- Only on mobile
Only strictly necessary storage is exempt. Ad and analytics tags need clear, active consent, and scrolling is not consent.
What makes cross-device tracking most reliable?
- IP addresses
- The user being logged in on each device
- Third-party cookies
Logins tie devices to one account. Cookies are per browser and IP addresses change and are shared.
Frequently asked questions
What is the digital marketing strategy that tracks users across the web?
Retargeting, also called remarketing. It relies on cross-site tracking (cookies, pixels and login IDs) to recognise people who visited your site and show them relevant ads on other sites and apps.
Is retargeting the same as behavioural targeting?
Retargeting is one type of behavioural targeting. Behavioural targeting uses any recorded behaviour to choose ads; retargeting specifically targets people who already interacted with your own site or app.
Is cross-web tracking legal?
Yes, when done within the rules. In the UK and EU you need informed, active consent before non-essential cookies and similar technologies run. In California and other US states people can opt out of data being shared for cross-context advertising. Tracking without consent where it is required can bring regulatory action.
Has Chrome removed third-party cookies?
No. In April 2025 Google said it would keep its existing approach of user choice in Chrome settings rather than remove them or add a new prompt. Safari and Firefox already block them by default, so you cannot rely on them for everyone.
How can I stop being tracked across websites?
Use a browser with tracking protection, block third-party cookies in your settings, decline non-essential cookies on banners, use an ad blocker, and on iPhone choose “Ask App Not to Track” when prompted.
Does tracking affect SEO?
Not directly as a ranking signal, but heavy tag loads slow pages, and speed and page experience matter to users and to Google. Lean, consented tracking is better for both.
Sources
- Google Privacy Sandbox, “Next steps for Privacy Sandbox and tracking protections in Chrome” (2025).
- WebKit, “Tracking Prevention in WebKit” (updated 2023).
- Information Commissioner’s Office, “Cookies and similar technologies” guidance (2025).
- Pew Research Center, “How Americans View Data Privacy” (2023).
If you want to know which tags your site is loading and whether they are slowing it down, my SEO audit covers tracking, speed and consent setup, or you can ask me a question. You can also see how measurement fed into real projects in these online growth case studies.
Request received
Thank you! Saad will contact you within the next 24 hours.
Keep an eye on your phone and inbox.