The browser says the request went to track.example.com.
That does not necessarily mean Example Company operates the tracker.
Modern tracking systems increasingly try to look first-party from the browser’s point of view. The request uses the visited site’s own domain or subdomain, even though an outside analytics or advertising company may operate the infrastructure behind it or receive the resulting data.
This matters because browser privacy defenses often treat first-party and third-party resources differently.
A familiar hostname can hide an unfamiliar operator
One documented technique is CNAME cloaking.
A site can configure a subdomain such as:
metrics.news.example
to resolve through DNS to infrastructure belonging to an outside tracking provider.
To the browser’s ordinary web-layer view, the request appears to go to a subdomain of news.example.
Underneath, the DNS configuration points elsewhere.
WebKit documented this practice while explaining Safari’s CNAME-cloaking defenses. Its example shows a site-controlled subdomain resolving to a third-party tracker, giving the outside service first-party-looking access. See WebKit’s CNAME Cloaking and Bounce Tracking Defense.
WebKit cited research that found thousands of sites using this arrangement with dozens of trackers.
First-party appearance does not establish first-party control
This is the important investigative lesson.
A request hostname can tell you where the browser believes it is sending traffic.
It cannot by itself tell you:
- who operates the server,
- who contracted for the service,
- who receives copies of the data,
- what database the event enters,
- whether the vendor can reuse the information elsewhere.
Those answers may require DNS records, privacy policies, vendor documentation, contracts, server configuration, or direct observation of downstream data flows.
Likewise, using a vendor does not automatically mean the site has surrendered control of the data. A third party can process information strictly on behalf of a first party under contractual limits.
The architecture has to be examined rather than assumed.
Browser defenses noticed the camouflage
Safari’s Intelligent Tracking Prevention added specific defenses against third-party CNAME cloaking. WebKit’s current tracking documentation also discusses third-party CNAME and IP-address cloaking as techniques its protections try to detect. See Tracking Prevention in WebKit.
That evolution shows why the simple phrase block third-party trackers became technically slippery.
If the tracker can borrow the site’s own hostname, the third party no longer looks third-party at first glance.
The Surveillance Economy does not only collect data.
It also changes where collection appears to happen.
The address bar and network panel are useful evidence.
They are not always the corporate org chart.