Cookie syncing, cookie synchronization or cookie matching is a technique in online advertising to track users across multiple websites. Once users see an advertisement, user data in the form of cookies is shared among ad companies, allowing them to link identifiers and create a user-specific profile to optimize targeted advertising. The process increases the relevance of personalized ads shown to the user, but raises privacy concerns in the way it enables companies to track people across the internet without their direct knowledge or explicit consent. Cookie syncing can also expose personal information, weaken security, and is difficult for users to avoid, even if they attempt to delete cookies on their device. The practice is widespread among major advertising networks. In Europe, the General Data Protection Regulation led to a decrease in cookie syncing compared to the United States.

Real-time bidding is a practice popular among advertisers where the advertisers bid on an impression in real time through automated means. This practice usually involves a publisher who displays ads on their website, a third-party ad exchange which loads the ads on the web, identifies an impression, and conducts an ad auction, and a third-party bidder who represents advertisers. When a user visits a web page, an ad auction is conducted, where the ad exchange will typically send out bid requests to all the third-party bidder participating in the process. If a bidder is interested in placing an ad on that particular ad space, the bidder script will respond with a bid response containing information about the ad to be loaded and the price the bidder is willing to pay. Typically, this ad-auction phase of real-time bidding occurs over a very short period of time, often ranging in the milliseconds. Once this process has concluded, the ad exchange will choose a winner and place the ad on the ad spot on the page and charge the bidder for the ad based on the prices it sent as a bid response.^[1]

Cookie syncing is a process that typically occurs after the ad-auction phase of real-time bidding. During cookie syncing, a script loaded by the ad exchange uses a script to send a request to the advertising third-party server. This request will typically contain some kind of user information like a user ID or the hashed contents of the ad-exchange server's cookie. The third-party ad server on receiving this request is then able to compare its own user data with the data sent by the ad-exchange in the request and send a response back that sets cookies on a user's computer containing the information that the third-party advertising server lacked about the user.^[1][2] This is done so that in subsequent ad-auctions the third-party server can better identify the same user and perform targeted advertising.^[3] In certain cases, the cookie syncing process can be done in reverse where the ad server sends a request to the ad exchange to match cookies with them.^[1]

Cookie syncing also allows the advertiser to respond faster and more decisively to bidding requests since if they had previously performed the cookie matching protocol with the same ad-exchange they would have the user's information stored which they can then use to perform a lookup in their databases based on the incoming ad-request. Advertisers can, and often do bid on new users for whom they do not have existing cookies as well. Winning the bid enables them to serve ads to the user and simultaneously perform cookie syncing, thereby augmenting their dataset for future ad auctions.^[1]

The practice of cookie syncing has a multitude of web security and privacy implications. The process of cookie syncing circumvents the same-origin policy, a web security feature enforced by all modern browsers that prevent a particular website from learning information about other non-affiliated sites. By enabling third-party servers to read and map cookies across multiple sites, cookie syncing facilitates the sharing of user identifiers. This practice can be used to establish persistent tracking mechanisms across multiple websites. Cookie syncing can also be paired with zombie cookies constructed using technologies like Flash cookies or IndexedDB and data re-identification methods like browser fingerprinting to create tracking systems that are designed to resist user deletion similar to the functionality of evercookies.^[4] In 2019, Papadopoulos et al. showed that cookie syncing can be used to compromise the encryption and privacy provided by virtual-private networks and websites that use Transport Layer Security. Since a majority of cookie syncing during that time occurred through unencrypted connections with the web server, the researchers were able to exfiltrate a user's browser history as well as user IDs by listening for the unencrypted traffic from a user's session.^[5]

Cookie syncing can also be a vehicle for information leakage and privacy-invasive tracking. Cookie syncing allows multiple parties to link together disparate identities of an individual, creating bridges between different kinds of tracking identifiers. In 2016, Engelhart et al. surveyed the top 1-million websites on the web and found that cookie syncing was extremely common on the web. The researchers found that DoubleClick was the most prolific, syncing over 108 cookies with other third parties. Other parties in the top 100 domains regularly synced cookies with at least one other third-party.^[6] A 2019 study by Papadopoulos et al. further revealed that some third parties store synced identifiers from other parties as HTTP cookies, causing subsequent syncing operations to transmit not only their own cookies but also identifiers obtained from other third parties. Additionally, their research found that personally identifiable information (PII) could be leaked through the referrer header during cookie syncing.^[7] In certain cases, if two advertising parties had previously performed cookie syncing, their preference towards a specific user could reveal information to the target website about the preferences and browsing habits of the user.^[3]

While the European General Data Protection Regulation (GDPR) does not explicitly ban cookie syncing, it introduces limits on the kinds of data that can be exchanged during cookie syncing. Before the GDPR regulations went into effect, companies engaging in cookie syncing would misclassify the exchange of user IDs as anonymized data, however the GDPR explicitly labelled user IDs pseudonymous data since the data can be used to re-identify a individual. Companies that participate in data exchange activities are also required to implement a subject-access request (SAR) process, through which a user can gain access to their data. Researchers in 2020 found that enacting GDPR led to decrease in cookie syncing activity in Europe compared to its United States counterparts. They also found that while most companies had set up SAR programs, some companies had made the SAR process difficult to complete, preventing these rights from being exercised.^[8]