title: Cross-domain user tracking without 3rd party cookies?
body: <p>How are cross-domain web tracking services implemented (e.g., for <em>behavioral advertising</em>), now that the majority of people are browsing with 3rd party cookies disabled?</p>
  
  <p>More explicitly, how does a third party tracking service recognize that two requests to different domains are coming from the same person?</p>
  
  <p>Some options come to my mind:</p>
  
  <ul>
  <li>Maybe <strong>iframe-based</strong>, by embedding a tracking page from the third-party tracking service into various sites. This included tracking page should be able to set first party cookies for the tracking domain (?). If the included page is unique for each tracked page, it should be possible to match the request to the website the iframe is embedded into?!</li>
  <li><strong>IP + user agent based</strong> (unreliable)</li>
  <li>browser <strong>fingerprinting</strong> and clock skew
  measurements (I hope this is not already in common use today)</li>
  <li><strong>Cookie handover</strong>, that is, append the session ID as a paremeter to all links between the various pages. The visited page can then set its own cookie with the same ID as the referring page. Problem is, this does not work if the second page is not visited by clicking one one of those prepared links.</li>
  <li>Using non-traditional cookies, such as <strong>Flash Cookies</strong>. <em>Maybe</em> some of these monsters don't honor the same-origin policy?</li>
  </ul>
  
  <p>So, how is it being done?</p>
  
  <p><strong>EDIT:</strong> I just noticed that disabling 3rd party cookies will only prevent the creation of new cookies, but existing ones are still readily sent to the third party domain. Hence, one could somehow redirect the user to the 3rd party tracking service, which sets a first-party cookie, which could then later be read by a web bug. Interesting.</p>