Here are some papers that I enjoyed and think are worth reading:
Flash Cookies and Privacy II: Now with HTML5 and ETag Respawning, by Mika Ayenson, Dietrich James Wambach, Ashkan Soltani, Nathan Good, and Chris Jay Hoofnagle. 2011.
Flash Cookies and Privacy, by Ashkan Soltani, Shannon Canty, Quentin Mayo, Lauren Thomas, and Chris Jay Hoofnagle. August 2009.
A Crawler-based Study of Spyware on the Web, by Alexander Moshchuk, Tanya Bragin, Steven D. Gribble, and Henry M. Levy. Proceedings of the 13th Annual Network and Distributed Systems Security Symposium (NDSS 2006), San Diego, CA, February 2006.
Behavior-based Spyware Detection, by Engin Kirda, Christopher KruegelGreg Banks, Giovanni Vigna, and Richard Kemmerer. 15th Usenix Security Symposium, August 2006.
SpyProxy: Execution-based Detection of Malicious Web Content, by Alexander Moshchuk, Tanya Bragin, Damien Deville, Steven D. Gribble, and Henry M. Levy. Proceedings of the 16th USENIX Security Symposium (USENIX Security 2007), Boston, MA, August 2007.
Measurement and Analysis of Spyware in a University Environment, by Stefan Saroiu, Steven D. Gribble, and Henry M. Levy. Proceedings of the First Symposium on Networked Systems Design and Implementation (NSDI '04), San Francisco, California, March 2004.
Automated Spyware Collection and Analysis, by Andreas Stamminger, Christopher Kruegel, Giovanni Vigna, and Engin Kirda. 12th Information Security Conference (ISC), Lecture Notes in Computer Science, Springer Verlag, Italy, September 2009.
Dynamic Spyware Analysis, by Manuel Egele, Christopher Kruegel, Engin Kirda, Heng Yin, and Dawn Song. Usenix Annual Technical Conference, USA, June 2007.
Do Not Track: http://donottrack.us/.
An Analysis of Private Browsing Modes in Modern Browsers, by Gaurav Aggarwal, Elie Bursztein, Dan Boneh, and Collin Jackson. USENIX Security 2010.
Timing Attacks on Web Privacy, by Edward W. Felten and Michael A. Schneider. Proc. of 7th ACM Conference on Computer and Communications Security, Nov. 2000.
RequestPolicy: Increasing Web Browsing Privacy through Control of Cross-Site Requests, by Justin Samuel and Beichuan Zhang. PETS 2009.
What Californians Understand about Privacy Online, by Chris Jay Hoofnagle and Jennifer King. September 2008.
Americans Reject Tailored Advertising and Three Activities that Enable It, by Joseph Turow, Jennifer King, Chris Jay Hoofnagle, Amy Bleakley, Michael Hennessy. September 2009.
Cookies and Web Browser Design: Toward Realizing Informed Consent Online, by Lynette I. Millett, Batya Friedman, and Edward W. Felten. Proc. of CHI 2001 Conference on Human Factors in Computing Systems, April 2001.
Informed Consent in the Mozilla Browser: Implementing Value-Sensitive Design, by Batya Friedman, Daniel C. Howe, and Edward W. Felten. Proc. of 35th Annual Hawaii International Conference on System Sciences, January 2002.
Adnostic: Privacy-Preserving Targeted Advertising, by Vincent Toubiana, Arvind Narayanan, Dan Boneh, Helen Nissenbaum, Solon Barocas. NDSS 2010.
I Still Know What You Visited Last Summer: Leaking browsing history via user interaction and side channel attacks, by Zack Weinberg, Eric Chen, Pavithra Ramesh Jayaraman, and Collin Jackson. IEEE Security and Privacy Symposium 2011.
This should be enough to get you started. I recommend using standard literature search methods. For instance, read the related work sections of these papers to see if they identify/cite other papers worth reading. Then, plug each paper into Google Scholar to find what newer papers cite them, and see if any of those are interesting. Keep expanding your pool in this way. If there are any researchers who have written multiple papers you really liked, check out all of their publications. Look at the proceedings of PETS, WEIS, and SOUPS, as they may have more that is of interest to you.
P.S. I also want to point you to an excellent blog by a leading researcher that you might enjoy, 33bits.org. Check out especially these topics on that blog: ubercookies, history stealing, tracking.