Keep Factually independent
Whether you agree or disagree with our analysis, these conversations matter for democracy. We don't take money from political groups - even a $5 donation helps us keep it that way.
In 2025 can a person be tracked visiting sites thought of as illegal?
Executive summary
Yes — in 2025 companies and governments routinely can and do track people’s web visits, using cookies, pixels, browser fingerprinting and other techniques; courts and regulators are increasingly litigating and limiting some practices while patchwork laws (state and international) regulate others [1] [2] [3]. Legal exposure depends on the tracking method, consent mechanisms, state laws and litigation trends: some tracking is lawful if disclosed and consented to, while other uses are facing enforcement and lawsuits under wiretap, consumer-protection and state privacy statutes [4] [5] [3].
1. How sites and ad networks can identify a visitor — the technical playbook
Commercial trackers still have many tools to link visits to individuals: third‑party cookies and pixels drop identifiers when you visit a page, ad networks share and sync IDs, and advanced techniques like browser fingerprinting can uniquely identify a browser even after cookies are cleared [1] [6] [2]. Browser fingerprinting research presented at WWW 2025 found that fingerprints were being used in real time for ad bidding and to tailor responses, demonstrating that clearing cookies alone is no guarantee against re‑identification [2]. Privacy extensions such as EFF’s Privacy Badger block many third‑party trackers and send opt‑out signals like Global Privacy Control, but they do not eliminate all ways of linking visits [7].
2. Legal landscape: not universally illegal, but highly regulated and litigated
Website tracking is not categorically illegal across jurisdictions; rather, data protection laws and consumer‑privacy rules constrain how tracking is done and impose disclosure/consent duties [4] [8]. In 2024–25 litigation surged over pixels, session replay, geolocation and SDKs and plaintiffs have tested wiretap and state privacy statutes against tracking practices, producing mixed court outcomes and growing enforcement by state attorneys general [9] [5] [3]. Regulators have fined companies for tracking and notice failures — for example, a $1.55M settlement under California law tied to online surveillance and tracking [3].
3. Criminal/illegal content visits vs. tracking legality — two separate questions
Visiting a site that hosts illegal content is a substantive criminal/legal matter distinct from whether private companies can track that visit. Available sources discuss tracking techniques and enforcement but do not provide a comprehensive account of when law enforcement can tie browsing to prosecution in every scenario — “available sources do not mention” a single, universal rule on criminal prosecution based solely on site visits. What is clear in reporting is that tracking and location data have become the subject of litigation and regulatory scrutiny when collected or monetized without appropriate legal basis [10] [5].
4. What courts and statutes are testing in 2025
Courts are split on applying wiretap and state privacy statutes to web tracking; some rulings reject novel wiretap claims while other matters proceed, encouraging more plaintiffs’ filings and creating uncertainty for firms [9] [11]. States are actively updating privacy rules: several states require honoring browser opt‑out signals and expand enforcement authority, and attorneys general are pursuing notice and opt‑out violations [11] [3]. The patchwork means tracking that’s permitted or defensible in one state could provoke enforcement or litigation in another [12].
5. Practical risks for users and site operators
For users: targeted ads and behavioral profiles remain pervasive and may persist despite cookie opt‑outs; experiments and investigations show opting out doesn’t always stop all tracking [13] [7]. For operators: regulators recommend auditing cookies and vendor practices, improving consent flows, and documenting disclosures because enforcement and litigation are “low‑hanging fruit” for regulators and private plaintiffs [14] [3].
6. Technical and policy responses to reduce traceability
Browsers and standards bodies are changing behavior: Google and others are introducing measures (e.g., partitioning visited‑link data) to block some fingerprinting/leakage vectors, and privacy tools (browser extensions, GPC signals) can reduce exposure — but no single fix eliminates all tracking yet [15] [7]. Businesses increasingly adopt server‑side tagging, CMPs and vendor inventories to comply with expanding state laws and subject‑access requirements [12] [14].
7. Bottom line for your question — “can a person be tracked visiting sites thought of as illegal?”
Yes: technically, many trackers and ad ecosystems can link site visits to identifiers and profiles, and browser fingerprinting can persist across sessions [1] [2]. Legally, whether that tracking is lawful or usable by others (including law enforcement or civil plaintiffs) depends on consent, disclosures, the tracker’s role, and competing court decisions and state laws — a fragmented, evolving picture with active enforcement and litigation in 2025 [4] [5] [3]. Available sources do not provide a single bright‑line rule tying every tracked visit to criminal liability; outcomes turn on facts, statutes and case law in each jurisdiction [5].
If you want, I can (a) map specific U.S. state rules that matter for tracking in the places you care about using the sources above, or (b) summarize technical steps (browser settings, extensions, VPN/Tor tradeoffs) to reduce traceability with citations.