A redirect can last less than a second.
That is still enough time to introduce two databases to each other.
Advertising systems often assign their own identifiers to the same browser.
Company A may know the browser as A-1842.
Company B may know it as B-9917.
Those IDs are useless for direct data sharing until somebody learns that they refer to the same browser.
One historical solution is cookie synchronization.
A redirect can carry the introduction
Imagine a browser visiting an advertising endpoint at Company A.
Company A redirects it to Company B using a URL like:
b.example/sync?partner_id=A-1842
When the browser reaches Company B, B can read its own cookie—perhaps B-9917—while also seeing A’s identifier in the URL.
Now a mapping can be built:
A-1842 = B-9917
The browser acted as the courier.
Academic researchers have documented cookie synchronization as an important mechanism for exchanging identifiers between advertising parties. A 2018 study described synchronization as a way for trackers with different local IDs to align those IDs and merge information about users. See Cookie Synchronization: Everything You Always Wanted to Know But Were Afraid to Ask.
MDN’s privacy documentation likewise identifies redirect tracking as a technique in which users are briefly and often imperceptibly sent through a tracker so it can use first-party storage or otherwise participate in recognition. See MDN’s Privacy on the web.
The redirect itself may be visible
Browser developer tools, network logs, or a carefully captured navigation can expose the chain.
You may see:
Site → Ad company A → Ad company B → destination.
You may also see identifiers moving in query parameters.
That is strong evidence that the browser contacted the intermediaries.
It may even reveal an apparent ID exchange.
What it does not automatically reveal is the entire server-side database created from those requests.
Identifiers can be encoded, hashed, short-lived, or translated later. Companies can also synchronize information through server-to-server channels the browser never sees.
Browser defenses changed the technique
Modern tracking prevention has made traditional cross-site cookie access more difficult. Safari, Firefox, and other browsers restrict or partition third-party storage, and advertising systems have responded with other approaches: link identifiers, first-party collection, login-based identity, server-side matching, and newer extended identifiers.
The old redirect chain remains useful because it demonstrates the architecture plainly.
One company does not need to know everything about you.
It only needs a reliable way to say:
The person I call A-1842 is the same browser you call B-9917.
Once that translation exists, separate surveillance systems can start speaking the same language.