Internet Monitoring and Web Tracking: A Complete CIPT Guide to Privacy Risk Management
Introduction
Internet Monitoring and Web Tracking is a core topic in the IAPP Certified Information Privacy Technologist (CIPT) Body of Knowledge, under the Privacy Risk Management domain. It covers the technologies used to observe, record and profile people's online behaviour, the risks those technologies create, and the controls a privacy technologist can apply to reduce those risks. This guide explains why the topic matters, what it covers, how the main technologies work, and how to answer exam questions on it.
1. Why Internet Monitoring and Web Tracking Is Important
Ubiquity
Almost every website, mobile app and connected device collects some form of behavioural data. Analytics, advertising, personalisation, fraud prevention and security all depend on tracking. Any technologist designing a system will almost certainly touch tracking technology.
Regulatory exposure
Tracking sits at the centre of many privacy laws and enforcement actions, including:
• The ePrivacy Directive (the EU "Cookie Law").
• The GDPR, which treats online identifiers as personal data (Recital 30).
• CCPA/CPRA rules on the "sale" and "sharing" of personal information and on cross-context behavioural advertising.
• COPPA, for children under 13.
• FTC Section 5 actions against unfair and deceptive practices.
• Regulator decisions on cookie walls and dark patterns, for example by the CNIL and the Belgian DPA in the IAB TCF case.
Trust and reputation
Invisible or covert tracking erodes user trust. Well-known incidents such as supercookies, history sniffing and covert fingerprinting caused major reputational damage.
Security risks
Monitoring tools such as deep packet inspection, keyloggers and session replay scripts can capture sensitive data, including passwords, health information and payment data. If that data is mishandled, it can lead to breaches.
Power asymmetry
Tracking enables profiling, discrimination, manipulation and surveillance. These are classic privacy harms in Solove's taxonomy (surveillance, aggregation, secondary use) and in Calo's model of subjective and objective harms.
2. What Internet Monitoring and Web Tracking Is
Internet monitoring
Internet monitoring is the observation of network or online activity by an entity, for example:
• An employer monitoring employee traffic.
• An ISP inspecting packets.
• A government performing lawful interception.
• A school filtering content.
• A security team running Data Loss Prevention (DLP).
Web tracking
Web tracking is the collection of information about a user's browsing behaviour across one or more sites or sessions. It is typically used for analytics, advertising, personalisation and measurement.
Key distinctions the CIPT expects you to know
• First-party vs. third-party tracking: First-party tracking is set by the domain the user is visiting. Third-party tracking is set by a different domain embedded in the page, such as an ad network, social widget or analytics provider. Third-party tracking enables cross-site profiling.
• Session vs. persistent tracking: Session data expires when the browser closes. Persistent identifiers survive across sessions.
• Stateful vs. stateless tracking: Stateful tracking stores an identifier on the device (cookies, local storage). Stateless tracking derives an identifier from device characteristics (fingerprinting) and stores nothing on the device.
• Network-level vs. application-level monitoring: Network-level monitoring operates on traffic (packet sniffing, DPI). Application-level monitoring operates inside software (scripts, SDKs).
3. How It Works: Key Technologies
HTTP cookies
Cookies are small text files set by a server via the Set-Cookie header and returned on later requests.
• Attributes: Domain, Path, Expires/Max-Age, Secure, HttpOnly and SameSite (Strict, Lax, None).
• Uses: Session management, preferences and tracking.
• Third-party restrictions: Safari's Intelligent Tracking Prevention (ITP) and Firefox's Enhanced Tracking Protection (ETP) restrict third-party cookies. Google has repeatedly delayed and then changed its plans to phase them out in Chrome.
Flash cookies (Local Shared Objects) and other storage
• Flash LSOs: Historically used to "respawn" deleted HTTP cookies, which led to lawsuits.
• HTML5 storage: Includes localStorage, sessionStorage and IndexedDB.
• Other persistent stores: ETags and cache-based identifiers can also persist data.
Zombie cookies and evercookies
These are identifiers that regenerate themselves from backup storage locations after the user deletes them. Regulators view them as deceptive because they defeat user choice.
Web beacons
Also called pixel tags, clear GIFs or web bugs, these are tiny, often invisible images or scripts that trigger a request to a server.
• Information sent: The request reveals IP address, user agent, referrer, timestamp and any cookies.
• Where they are used: In emails to confirm opens, and on web pages for conversion tracking (for example, the Meta Pixel).
JavaScript tags and tag managers
Analytics libraries (for example, Google Analytics) and tag managers load third-party code that can read the DOM, capture events and send data to vendors.
• Risk: This creates supply-chain risk and "data leakage" risk.
• Example: Pixels on health websites transmitting sensitive data have triggered FTC and HHS enforcement.
Browser and device fingerprinting
Fingerprinting combines attributes such as user agent, screen resolution, fonts, plugins, time zone, language, canvas/WebGL rendering and audio context to create a quasi-unique identifier.
• Stateless: Nothing is stored on the device, so clearing cookies does not defeat it.
• Hard to detect: Users cannot easily see it or block it.
• Legal position: Under the ePrivacy Directive, fingerprinting still requires consent, because it involves accessing information stored on or emitted by terminal equipment.
• Defences: The Tor Browser counters fingerprinting through uniformity. Brave counters it through randomization.
Device and advertising IDs
Mobile platforms provide resettable advertising identifiers: Apple's IDFA and Google's Advertising ID (AAID/GAID).
• Apple: App Tracking Transparency (ATT) requires opt-in permission before an app can access the IDFA.
• Mobile SDKs: SDKs embedded in apps can collect location, contacts and usage data.
Cross-device tracking
This links a user's phone, laptop and TV.
• Deterministic linking: Uses login identifiers or hashed email addresses.
• Probabilistic linking: Infers links from shared IP address, Wi-Fi and behavioural patterns.
• Covert methods: Ultrasonic audio beacons have been used and have attracted FTC warnings.
Session replay scripts
These record mouse movements, clicks and keystrokes to reconstruct a user's session. They risk capturing passwords and sensitive form inputs unless fields are masked.
Network-level monitoring
• Packet sniffing: Capturing traffic on a network.
• Deep Packet Inspection (DPI): Examining the payload of packets, not just the headers. ISPs may use DPI for traffic management or ad injection; the Phorm and NebuAd controversies are examples.
• Header enrichment and supercookies: Some carriers injected unique identifier headers (UIDH) into users' traffic. The Verizon UIDH case led to FCC action.
• TLS interception: Corporate proxies may perform man-in-the-middle decryption of encrypted traffic.
• DNS logging: Records which domains users look up.
Employee and workplace monitoring
Techniques include DLP, URL filtering, email scanning, keystroke logging, screen capture, User and Entity Behavior Analytics (UEBA) and bossware.
• Legal considerations: ECPA (US), GDPR legitimate interests and proportionality tests, works council consultation (EU), and the Bărbulescu v. Romania decision of the ECHR, which requires prior notice and proportionality.
Location tracking
Location can be derived from GPS, Wi-Fi triangulation, cell towers, Bluetooth beacons and IP geolocation.
Server-side tracking and CNAME cloaking
These are newer techniques that disguise third-party trackers as first-party, in order to evade browser protections.
4. Privacy Risks Created
• Lack of transparency and user awareness: Invisible tracking violates the notice principle.
• Lack of meaningful choice: Dark patterns, cookie walls and respawning undermine consent.
• Aggregation and profiling: Combining data reveals sensitive inferences about health, sexuality, religion or political views.
• Secondary use and function creep: Data collected for security is later reused for marketing.
• Data sharing with third parties and data brokers.
• Re-identification: "Anonymous" identifiers can be linked back to real identities.
• Security exposure: Collected data creates breach risk, and session replay can leak credentials.
• Chilling effects: Monitoring discourages free expression.
5. Controls and Privacy-Enhancing Measures
Organisational and legal controls
• Conduct a Privacy Impact Assessment (PIA) or DPIA for monitoring programs. A DPIA is often mandatory under GDPR Art. 35 for systematic monitoring.
• Write clear privacy notices and cookie policies.
• Implement a Consent Management Platform (CMP) with granular, opt-in consent for non-essential cookies in the EU/UK, and opt-out rights in the US.
• Honour Global Privacy Control (GPC) signals, which are legally recognised under CCPA/CPRA and in Colorado. Do Not Track (DNT) is a weak, largely ignored legacy signal.
• Put vendor contracts in place (Data Processing Agreements) and audit third-party tags.
• Apply data minimisation, retention limits and purpose limitation.
• For employee monitoring, publish acceptable use policies, give prior notice, apply proportionality, and use least-intrusive alternatives.
Technical controls
• Run cookie and tag scanning and inventories, and use tag governance.
• Use IP anonymisation or truncation, and hash or pseudonymise identifiers.
• Set short cookie lifetimes and use the SameSite, Secure and HttpOnly attributes.
• Mask sensitive fields in session replay.
• Use first-party, privacy-friendly analytics, or aggregate measurement with differential privacy.
• Apply Content Security Policy (CSP) and Subresource Integrity (SRI) to control third-party scripts.
• Encrypt data in transit with TLS and HTTPS, which limits passive network monitoring.
User-side tools
Ad blockers, tracker blockers (uBlock Origin, Privacy Badger), private browsing modes, VPNs, Tor, browser anti-fingerprinting features and cookie deletion.
Industry self-regulation
• The NAI and DAA codes, and the AdChoices icon.
• The IAB Transparency and Consent Framework (TCF).
• Platform privacy initiatives such as Apple ATT, Google's Privacy Sandbox (Topics API, Attribution Reporting) and Apple Private Relay.
6. Exam Tips: Answering Questions on Internet Monitoring and Web Tracking
Tip 1: Identify the technology first
Many questions describe a scenario without naming the technique. Map the clues to the technology:
• "Invisible 1x1 image in email" means a web beacon.
• "Identifier persists after clearing cookies" means a zombie cookie, evercookie or fingerprinting.
• "No data stored on device" means fingerprinting (stateless).
• "ISP inserts identifier into traffic" means header enrichment or a supercookie.
• "Inspecting packet contents" means DPI.
Tip 2: Distinguish first-party from third-party
If a question asks which cookie enables tracking across unrelated websites, the answer is almost always the third-party cookie.
Tip 3: Know cookie attributes
• HttpOnly: Blocks JavaScript access, which mitigates XSS theft of cookies.
• Secure: The cookie is sent only over HTTPS.
• SameSite: Limits cross-site sending of the cookie, which mitigates CSRF and tracking.
• Expires/Max-Age: Controls whether the cookie is persistent.
Tip 4: Apply jurisdiction-specific consent rules
• EU/UK: Prior opt-in consent is needed for non-essential cookies and similar technologies, including fingerprinting. Strictly necessary cookies are exempt. Pre-ticked boxes are invalid (Planet49 case).
• US: The model is generally notice and opt-out (CCPA "Do Not Sell or Share", GPC), except that COPPA requires verifiable parental consent for children under 13.
Tip 5: Prefer the least privacy-invasive effective option
When asked for the BEST control, choose the one that addresses the root cause and reflects Privacy by Design. Examples are data minimisation, aggregation, pseudonymisation and masking, rather than relying only on notice. Notice alone is rarely the best answer when a technical control is available.
Tip 6: Watch for proportionality in employee monitoring
The correct answers emphasise:
• A legitimate purpose.
• Transparency and prior notice.
• Least-intrusive means.
• Limited access and retention.
• A DPIA.
• Avoiding covert monitoring except in narrowly justified investigations.
Tip 7: Recognise deceptive practices
Respawning deleted cookies, ignoring opt-outs, hidden SDK collection and dark-pattern consent banners are likely to be framed as FTC Section 5 deception or as invalid consent under GDPR.
Tip 8: Link to privacy harms and frameworks
Be ready to connect tracking to the following frameworks:
• Solove's taxonomy: Surveillance, aggregation, identification, secondary use, disclosure.
• FIPPs/OECD principles: Collection limitation, purpose specification, openness, individual participation.
• Nissenbaum's contextual integrity: For example, health data flowing to advertisers violates the norms of its context.
Tip 9: Know the limits of user tools
• Private/incognito mode: Does not hide activity from ISPs, employers or websites. It only avoids local storage of history and cookies after the session ends.
• VPN: Hides traffic from the local network and ISP, but not from the VPN provider or from websites the user logs into.
• Do Not Track: Voluntary and largely ignored. GPC has legal force in some US states.
Tip 10: Read for keywords like BEST, FIRST, MOST LIKELY
• FIRST: Usually points to assessment or inventory, such as conducting a DPIA or scanning the site for tags.
• BEST: Usually points to a comprehensive or root-cause control.
• MOST LIKELY risk: Usually points to the realistic harm in the scenario, such as data leakage to third parties via pixels.
Tip 11: Eliminate distractors
Remove answers that are technically inaccurate. For example, "fingerprinting can be blocked by deleting cookies" is false. So is "HTTPS prevents the website from tracking you": HTTPS protects data in transit, not from the endpoint itself.
Sample question walkthrough
Scenario: A health information website uses a third-party advertising pixel. Users later see ads related to their medical searches. What is the MOST appropriate action for the privacy technologist?
Reasoning:
• Identify the technology: a third-party web beacon or pixel.
• Identify the risk: disclosure of sensitive data to third parties and secondary use.
• Identify the best control: remove or reconfigure the pixel on sensitive pages, conduct a tag audit and DPIA, and obtain explicit consent where required.
• Reject weaker answers: "update the privacy policy" alone is insufficient.
7. Quick Revision Checklist
• Cookie types: session, persistent, first-party, third-party, secure, HttpOnly, SameSite.
• Other storage: Flash LSOs, HTML5 storage, ETags, evercookies.
• Beacons and pixels; JavaScript tags; tag managers.
• Fingerprinting: stateless, hard to block, still needs consent in the EU.
• Mobile: IDFA, AAID, ATT, SDKs, location.
• Cross-device: deterministic vs. probabilistic linking.
• Network monitoring: DPI, packet sniffing, header enrichment, TLS interception.
• Workplace monitoring: notice, proportionality, DPIA, Bărbulescu.
• Laws and signals: ePrivacy, GDPR, CCPA/CPRA, COPPA, FTC Section 5, GPC vs. DNT.
• Controls: CMPs, minimisation, masking, anonymisation, vendor management, CSP, privacy-friendly analytics.
Conclusion
Internet Monitoring and Web Tracking tests whether you can recognise tracking technologies, evaluate their privacy risks, and recommend proportionate, legally compliant and privacy-by-design controls. On the exam:
• Identify the technique.
• Name the harm.
• Apply the relevant legal or consent model.
• Choose the control that addresses the root cause in the least intrusive way.
