Tracking technologies are automated mechanisms embedded in websites, applications, and mobile apps that collect data about user behavior, device characteristics, and interactions to identify, monitor, or profile individuals across sessions and platforms. Types include: first-party cookies (set by the visited domain), third-party cookies (set by external domains—typically advertisers or analytics providers), tracking pixels (invisible 1×1 images that fire HTTP requests to record page loads or email opens), device fingerprinting (assembling a probabilistic unique ID from browser attributes such as OS, screen resolution, installed fonts, and IP address), server-side tracking (capturing behavioral events at the web server layer before any browser response), session replay and heatmap tools (recording mouse movements and keystrokes), and mobile advertising identifiers (Apple IDFA, Google Advertising ID). Their primary business purposes are attribution, personalization, and analytics. From a privacy architecture perspective, tracking technologies are the principal data-collection layer that determines what personal data enters an organization's ecosystem—making them a foundational privacy governance concern.
Where it stops · what it isn't
- —IN SCOPE: First-party and third-party cookies, tracking pixels, device fingerprinting, server-side event collection, session replay tools, mobile advertising IDs (IDFA/GAID), log-file and IP-based tracking, and Consent Management Platform (CMP) integration.
- —OUT OF SCOPE: Data processing or storage architectures that do not involve behavioral collection (e.g., CRM databases populated manually, ERP transaction records).
- —OUT OF SCOPE: Deep technical implementation of cookie protocols, JavaScript SDKs, or CMP configuration—covered in higher-LOD cubelets.
- —NOT the same as: Data analytics or business intelligence broadly. Tracking technologies are the collection mechanisms, not the downstream analysis pipelines they feed.
- —NOT the same as: Authentication tokens or session-management cookies used purely for functional login state—these are not tracking in the privacy-regulatory sense unless repurposed for behavioral profiling.
Connected concepts in the graph
Every cubelet sits in a knowledge graph. Here's what this one connects to.
PART OFPrivacy Architecture — Applications and Software (ISACA CDPSE Domain 2)
REQUIRESConsent Management (obtaining and recording valid user consent before deploying non-essential tracking)Privacy Impact Assessment / DPIA (mandatory pre-deployment evaluation under GDPR Article 35)
ENABLESDigital Marketing Attribution and Audience SegmentationProduct Analytics and User Behavior Monitoring
CONSTRAINSCross-Domain Data Sharing (third-party tracking creates data flows requiring contractual and regulatory controls)
RELATED TOData Minimization and Purpose Limitation (CDPSE Privacy Principles)Data Subject Rights Management (tracking data is subject to access, deletion, and portability requests)