Documents, links, and a stateless protocol
Tim Berners-Lee proposed the system that became the World Wide Web at CERN in 1989. Its central ideas were modest and powerful: identify documents, request them over a network, and connect them with hypertext links.
HTTP was stateless. A server could answer a request without a built-in memory of the person who made the previous one. That made the protocol simple; it did not make use of the web anonymous. Servers still received network addresses and request information, and organizations could keep logs. But persistent identity was not the organizing principle of the early architecture.
Cookies add memory
Websites soon needed a way to remember state: a shopping cart, a login, a preference. Cookies supplied a small value that a browser could return with later requests to the same domain.
The same mechanism could support continuity or surveillance. When content from one company appeared across many unrelated sites, that third party could set or receive an identifier in each place. A feature designed to give one site memory became infrastructure for following activity across the web.
Cookie standards gradually added rules around scope, security, and expiration, but policy and user understanding lagged behind deployment.
Advertising becomes behavioral
Early web advertising often resembled print: place an advertisement near content likely to attract a relevant audience. As cookies, ad exchanges, embedded scripts, and data brokers matured, the business shifted toward identifying or classifying an individual impression in real time.
The page a person opened could trigger requests to many companies they had never heard of. Browsing activity could be combined with location, purchases, device characteristics, and inferred interests. The economic value of knowing the audience encouraged more collection, longer retention, and wider sharing.
Browsers become identifiable without cookies
Deleting cookies does not remove every way to recognize a browser. Screen dimensions, installed fonts, language, time zone, graphics behavior, hardware details, and other characteristics can contribute to a fingerprint. No single value needs to be unique if the combination is distinctive enough.
Fingerprinting made privacy a browser-design problem rather than only a storage-setting problem. Blocking one identifier could cause trackers to seek another signal. Strong defenses therefore try to reduce or standardize exposed information as well as restrict known trackers.
Do Not Track asks for a social rule
Do Not Track proposed a browser signal expressing that a person did not want tracking. It was an appealing idea: one preference rather than a separate negotiation with every site.
The signal was not, by itself, an enforcement mechanism. Industry, regulators, and standards participants did not converge on a universally binding interpretation. The W3C Tracking Preference Expression work was eventually discontinued. The episode demonstrated that technical expression is weak when recipients have neither a consistent obligation nor an incentive to honor it.
Regulation changes the obligations
Data-protection law predates the modern web, but large-scale online profiling made its application more visible. The European Union’s General Data Protection Regulation took effect in 2018, strengthening requirements around legal basis, transparency, individual rights, security, and accountability. Other jurisdictions adopted or expanded privacy laws with different scopes and definitions.
Regulation changed compliance practices and created meaningful rights. It also produced a layer of consent interfaces that can obscure choices, pressure acceptance, or treat privacy as a banner-management problem. Consent matters; collecting less can be more protective than requesting permission for an unnecessarily complicated system.
Browsers restrict cross-site tracking
Browsers began blocking, partitioning, or limiting third-party cookies and other cross-site storage. Tracking-protection lists block known domains. Privacy-preserving proposals attempt to support functions such as measurement without exposing the same individual history.
These changes improve the baseline, but the underlying incentives remain. First-party services can observe signed-in activity. Large platforms can connect information across products. Fingerprinting and link decoration adapt. Privacy engineering remains an ongoing contest between minimizing data and finding new ways to derive it.
Encryption becomes ordinary
HTTPS moved from an optional feature for login and payment pages toward the expected transport for the whole web. Encryption prevents routine intermediaries from reading or altering the content traveling between a browser and a site.
This was an enormous security and privacy improvement. It did not make destinations private. The site still receives the request, and surrounding metadata can reveal information about connections. Encryption protects a path; data minimization governs what happens at the endpoint.
Where privacy stands now
Web privacy is now shaped by several layers at once:
- protocols that determine what a request exposes;
- browsers that control storage, permissions, and identifying surfaces;
- sites and vendors that decide what to collect;
- business models that reward or reject surveillance;
- laws that establish obligations and remedies;
- people trying to make meaningful choices inside all of it.
The strongest privacy improvements often come from changing defaults and architecture, not asking individuals to configure every interaction perfectly. A site that does not load a tracker does more than a tracker accompanied by a carefully worded toggle. A tool that works without an account avoids an identity problem before it begins.
The unfinished question
The web still has to answer a basic question: how much observation should be required to read, communicate, learn, and complete ordinary tasks?
Its history shows that capabilities introduced for convenience can be reorganized around surveillance, that voluntary signals struggle against economic incentives, and that browser defenses and law can move the baseline. It also shows that every site retains a simple form of agency: it can decide not to collect data it does not need.