Syllabus Lesson 118 of 156 · How a browser decides
How a browser decides

Bounce tracking and its defences

Why it matters Partitioning and cookie blocking only touch third parties, sites embedded inside a page. Bounce tracking dodges both by making the tracker the page you are on, for a split second. Knowing how it works explains why your browser sometimes clears data from sites you have never knowingly visited.

Picture a road between two towns with a toll booth that you never chose to visit. Every time you drive from town A to town B, the road quietly routes you through the booth, which stamps your card and waves you on. You never stop, never look at it, and yet it keeps a record of every trip.

Redirect: a server's answer that says "go to this other address instead". Your browser follows it automatically, usually too fast to notice.

Bounce tracking: sending your navigation through a tracker's address as a redirect, so the tracker is briefly the top-level site and can read and write its own first-party cookie.

How a bounce works

  1. On shopa.example you click a link to ShopB. The link really points to adco.example/click?to=https://shopb.example/.
  2. For a moment, adco.example is the site in your address bar. It is first party now, so partitioning does not apply: it reads its cookie adco_id=u-7731, or sets one.
  3. It redirects you to shopb.example, often adding the ID to the URL.
  4. Next week a link on shopc.example bounces you through AdCo again. Same cookie, so AdCo joins ShopA, ShopB and ShopC.

You built a version of this in Leg 2. Notice what the defences from earlier lessons cannot see: no third-party request was involved at all.

What gives a bounce tracker away

Honest sites redirect too: a login page sends you back to the shop, a payment step returns you to the order page. The difference is in your behaviour. Engines look for sites that:

  • appear in redirect chains, in the middle of a navigation,
  • use storage while they do (read or write cookies),
  • but that you never interact with as a top-level site: no clicks, no typing, no scrolling.

User interaction: a click, tap or key press on a site while it is the top-level page. You type a password into a login page, so it counts; you never touch a bounce tracker.

The defence is then simple to state: after a grace period, clear the storage of sites that bounce you but that you have not interacted with recently. The tracker's ID is gone, so its next bounce sees a stranger. Logins and payment pages survive, because you interacted with them.

What each engine does today

EngineBounce defence (checked October 2026)
SafariIntelligent Tracking Prevention has handled bounce tracking since 2018, clearing data of sites it classifies as trackers when you have not interacted with them.
FirefoxSince 2020, by default, a daily purge of cookies and site data for sites on its tracker list that you have not interacted with recently. Full Bounce Tracking Protection, which detects bounces from behaviour rather than a list, is on in Strict mode.
ChromeSince October 2023, bounce-tracking mitigations, but only for users who block third-party cookies.

Note the two styles. A list-based purge only catches trackers someone has already named; a behaviour-based detector catches new ones but must avoid hurting honest redirects. The final lesson of this module compares those styles.

Try it Open DevTools (F12, or Cmd+Option+I on a Mac), go to the Network panel and tick "Preserve log". Then click a link in a newsletter or search result. The first entries often show status 301, 302 or 307: those are redirect hops. Look at which sites appear between where you clicked and where you landed.

A common misconception

"Blocking third-party cookies stops bounce tracking." It does not, because during the bounce the tracker is first party. That is exactly why engines needed a separate defence based on interaction.

Recap

  • Bounce tracking routes your navigation through a tracker, which is briefly first party and keeps its cookie.
  • Its signature: shows up in redirects, uses storage, never gets your interaction.
  • The defence clears such sites' storage; logins survive because you interact with them.
  • Safari since 2018, Firefox list purge since 2020 plus full protection in Strict mode, Chrome since 2023 only with third-party cookies blocked (checked October 2026).

Spotted a problem in this lesson? Report it

Code · runs in your browser
Output

        

      

      
      

        Back