How to check if a website tracks your shopping habits

Shopping trackers rarely announce themselves. A supermarket, department store or online marketplace can record the pages you view, products you search for and items you leave in a basket, then use that pattern to decide which advertisements to show you. The signals may be stored on your device, sent to the retailer or passed to an advertising partner.

Cookies are small pieces of data a website stores or reads through your browser. Some are necessary for a basket, login or payment page; others measure visits, build an advertising profile or follow you across other sites. Related tools include tracking pixels, local storage and device identifiers, so removing visible cookies alone does not reveal every form of behavioural tracking.

Start by separating what a site knows from what a third party knows. A first-party cookie belongs to the domain you visited, while a third-party cookie can be set by an analytics or advertising domain. A visit to Woolworths, Coles, Myer or an Australian online marketplace may therefore create both kinds of record, even when the retailer never displays its partner’s name.

Australian privacy rules add useful context, but they are not a promise of anonymity. The Privacy Act 1988 and Australian Privacy Principles cover many organisations, while smaller businesses may be governed by state or territory laws and the Australian Consumer Law. Signs of tracking are easier to judge when the site explains its purposes and gives you a genuine way to refuse optional data collection.

Check	What you may see	What it tells you
Site information	Cookie names, domains and expiry dates	Whether the site or another domain set them
Consent controls	Analytics and advertising choices	Which purposes can be refused
Browser privacy settings	Blocked or removable trackers	What your browser already limits
Network activity	Repeated requests to advertising domains	Whether tracking continues across pages

Read the consent controls

Open the site’s cookie notice, then choose its preferences or “reject non-essential” option when available. A useful notice separates necessary functions from analytics, personalisation and advertising, names major technology partners and allows optional purposes to be switched off. If the only choice is “accept”, check the privacy policy for a separate control before the page reloads.

Australia has no GDPR-style blanket requirement for a cookie banner on every website. For organisations covered by the federal Privacy Act, Australian Privacy Principle 3.6 can require clear consent for tracking technologies that are not reasonably necessary and can be turned off. The Office of the Australian Information Commissioner explains this obligation, while misleading privacy claims can breach Australian consumer law.

Identify what the site stores

Use the padlock or site-information icon beside the address bar to open site controls and review stored cookies. Look for the retailer’s domain, unfamiliar third-party domains, long expiry dates and names containing terms such as “ads”, “analytics” or “track”. A first-party cookie can still support analytics, while a vague name can be harmless, so category and publisher matter more than wording alone.

For a deeper check, open your browser’s developer tools and inspect the Cookies or Storage panel, followed by the Network panel as pages load. Chrome and Edge list cookies under Application; Safari and Firefox use Storage. Tracking pixels and analytics beacons appear as network requests rather than cookies, while browser fingerprinting may leave no cookie to inspect at all.

Audit your browser controls

Chrome and Edge users can look for “third-party cookies” or “cookies and other site data” under Privacy and security settings. Safari offers cross-site tracking protection, while Firefox provides Enhanced Tracking Protection. Standard protection usually allows sites to work while blocking known trackers; strict modes can break logins, maps or payment tools, so test important Australian shopping sites before changing them permanently.

Blocking is only part of an audit. Clear data for a particular retailer after a session if you want to remove its saved identifiers, but expect to sign in again and possibly lose an abandoned basket. Server logs, account histories and fingerprinting signals can continue beyond the cookie jar, so clearing data should complement stronger controls rather than replace them.

Follow the trail across sites

Search for a product on one site and notice whether ads for it appear on unrelated publisher pages. Retailers can share visit or basket events with search, social and retail-media partners, while affiliate links and pixels in order emails can record a click and attribute it to a company. In the network panel, repeated requests to an unfamiliar advertising domain are a stronger clue than a familiar retailer cookie.

Commuters in Sydney and Melbourne may move between a retailer app, a browser and entertainment during a trip. A roundup of offline mobile games illustrates the same split: offline play can avoid routine network requests, yet it does not necessarily remove advertising identifiers or data collected at installation.

Review mobile permissions

Check each shopping app’s permissions for location, contacts and advertising personalisation. Remove precise location access unless a nearby-store feature genuinely needs it, and use “ask each time” where available. On iOS, the App Tracking Transparency prompt appears when tracking is requested; declining it limits data sharing for that permission. On Android, app permissions and the advertising ID can affect personalised ads even when the app works offline.

For Android, Android privacy controls provide a practical reference for reviewing app permissions, the Google advertising ID and recent device activity. Resetting the advertising ID can break the link to a previous profile, while revoking permissions stops future access by that app. Neither action removes purchase records held by a retailer account or deletes information already collected by a website you visited.

Check policy and accountability

Read the privacy policy rather than relying only on the cookie banner. Look for sections on analytics, advertising, data sharing and retention, plus the identity of the Australian company operating the service and a clear privacy contact. Check when the policy was last updated and whether the listed purposes match the cookies, pixels and partners found in your browser.

If the explanations are vague, keep screenshots of the notice, relevant policy passages and tracker domains. People can raise a privacy complaint with the Office of the Australian Information Commissioner when the federal Privacy Act applies, or with the relevant state or territory privacy commissioner. The Australian Competition and Consumer Commission can also become involved where a business makes misleading claims about how personal information is handled.

Make one repeatable privacy check

A practical routine is to review cookie choices whenever a major retailer changes its banner, then check browser privacy controls once a quarter. Using a separate browser profile for shopping, choosing “reject non-essential” where offered and removing site data after purchases limits several common forms of behavioural tracking without requiring specialist software.

The next step is to open the site-information panel for the retailer you use most and save a dated screenshot of its current cookie permissions.