A bounce-tracking detector

Imagine a toll booth on a road you never meant to take. Every time a shortcut sends you through it, the attendant stamps your hand with the same number. You never stop there, never buy anything, never even notice it, but it has a record of every trip.

What engines do today

All three engines have some defence, with different reach (checked October 2026): Safari's Intelligent Tracking Prevention has handled bounce tracking since 2018; Firefox purges listed trackers daily by default since 2020 and runs full Bounce Tracking Protection in Strict mode; Chrome has a bounce-tracking defence since October 2023, but only for people who block third-party cookies. The lesson "Bounce tracking and its defences" compared them. The core idea is the same everywhere, and that is what you build.

The rule your detector uses

A site is flagged as a bounce tracker when both are true:

1. It wrote storage while you were bouncing through it, in at least one navigation of the history.
2. You have not interacted with it as a landing site in the last window_days days. "In the last 45 days" includes a visit exactly 45 days ago: today - day <= window_days.

Flagged sites get their cookies and storage cleared. Next time they bounce you, they see a stranger.

The history

make_history(seed=0) runs the practice browser for 60 pretend days and returns (browser, history). The browser still holds every cookie it collected. history is a list of dicts, one per page Sam opened:

{"day": 12,
 "hops": [{"site": "hop.example", "wrote_storage": True}],
 "landed": "shopb.example",
 "interacted": True}

A list of dicts inside a dict looks busy, but you read it one layer at a time: visit["hops"] is a list, so loop over it; each hop is a dict, so ask for hop["site"].

for visit in history[:3]:                 # the first three navigations
    for hop in visit["hops"]:             # a list inside each visit, often empty
        print(visit["day"], hop["site"], hop["wrote_storage"])

Traps in the history, on purpose

• go.example is a link shortener. It redirects but saves nothing, so it is not a bounce tracker.
• login.example is a sign-in service. It saves a cookie while bouncing you back to a shop, but Sam also opens it directly and signs in every few days. That interaction keeps it safe.
• oldsso.example is an old sign-in service Sam last used directly on day 2. On day 59 that is 57 days ago, outside a 45-day window, so the rule flags it. The cost is small and honest: next time Sam uses it, he signs in again.
• relay.example was the landing site once, but Sam did nothing there. Landing is not interacting.

Real engines are tuned around exactly these cases: catch the toll booths, spare the sign-in services people use.

Clearing storage

The practice browser has browser.clear_cookies(site) and browser.clear_storage(site), like the "clear data for this site" button in your browser's settings. browser.cookies(site) lists what is left.

function findBounceTrackers(history, today, windowDays = 45) {
  const bounced = new Set(), used = new Set();
  for (const visit of history) {
    for (const hop of visit.hops) {
      if (hop.wrote_storage) bounced.add(hop.site);
    }
    if (visit.interacted && today - visit.day <= windowDays) used.add(visit.landed);
  }
  return new Set([...bounced].filter(site => !used.has(site)));
}

bounced, used := map[string]bool{}, map[string]bool{}
for _, v := range history {
    for _, h := range v.Hops {
        if h.WroteStorage { bounced[h.Site] = true }
    }
    if v.Interacted && today-v.Day <= windowDays { used[v.Landed] = true }
}