Cookies vs LocalStorage vs IndexedDB: How Sites Store Tracking Data

Beyond Traditional Third-Party Cookies

For decades, third-party cookies were the primary mechanism for tracking users across the internet. However, as modern browsers (like Safari, Firefox, and Chrome) aggressively restrict third-party cookies, advertising trackers have shifted toward alternative client-side storage APIs.

Understanding the differences between Cookies, LocalStorage, and IndexedDB is essential for maintaining digital privacy.

---

Comparison of Browser Storage Mechanisms

| Storage API | Capacity | Expiration | Included in HTTP Requests? | Cleared by "Clear Cookies"? | | :--- | :--- | :--- | :--- | :--- | | HTTP Cookies | ~4 KB | Configurable date | Yes (Sent with headers) | Yes | | LocalStorage | ~5-10 MB | Persistent (No expiry) | No (Read via JavaScript) | Often missed by basic cleaners | | SessionStorage | ~5-10 MB | Tab/Session close | No (JavaScript only) | Yes (on close) | | IndexedDB | > 500 MB+ | Persistent database | No (JavaScript query) | Separate DB storage |

---

How Trackers Abuse LocalStorage and IndexedDB

When you clear traditional cookies, malicious tracking scripts can read a backup tracking ID previously saved in LocalStorage or IndexedDB and immediately recreate the deleted cookie. This technique is known as "Respawning" or "Zombie Cookies".

Prevention Strategies:

1. Use Strict Tracking Prevention: Modern browsers like Brave and Firefox isolate client storage per-site (State Partitioning).
2. Clear All Site Data: When clearing browsing data, ensure you select "Cookies and other site data" and "Cached images and files".
3. Inspect Your Browser Signature: Use the Browser Fingerprint Diagnostic to verify that script-based identifiers cannot reliably single out your device.