1

Given a commercial website buy.com and a user with a Facebook account in facebook.com, the user has third-party cookies disabled in the browser.

If a user is logged in their Facebook account and visits facebook.com, Facebook can set first-party cookies for facebook.com

Now the user visits buy.com, the site uses a web beacon with an <img> tag with src pointing to a facebook.com URL.

Can the user can still be tracked and a retargeting campaign can happen without consent?

Assumption is that the request from the <img> tag on the buy.com site, sends info about the visit on the URL and is able to trace it back to the original user thanks to the first-party cookies that were set by the visit to Facebook and get resent on the request for the web beacon even from a different domain. Is that correct?

Improve this question
3
  • I've removed the part about being legal since this is off-topic here. Use Law for legal questions instead. Also, traditionally all cookies are the same and this will be possible. Some browsers though treat cookies differently depending if first-party or not and also other criteria. So the answer depends likely on the exact browser you use.
    – Steffen Ullrich
    Apr 10, 2021 at 9:33
  • 1
    This depends on whether the browser has first-party isolation enabled. With such isolation there isn't a global cookie jar, but one jar per origin you navigate to. Then, your FB cookies on facebook.com would be unrelated to your FB cookies for requests caused by an example.com first-party. Without such isolation the subresource request to the pixel would allow for tracking, but browsers differ in what referral information they supply. Of course, arbitrary tracking info can be encoded into the pixel URL
    – amon
    Apr 11, 2021 at 8:05
  • @amon did not know about the isolation option, I will look into it
    – user4388177
    Apr 11, 2021 at 21:45

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .