If you searched `can online stores still track me after I clear cookies`, the short answer is yes. Clearing cookies removes one layer of continuity, not the whole recognition stack. Online stores can still reconnect sessions through browser fingerprinting, account state, referral context, and profile systems that stitch visits back together.
MDN’s cookie documentation makes the basic layer clear: cookies are one browser storage mechanism websites can read and write to preserve session state. Clearing them can absolutely remove some continuity. The problem is that websites can also rely on other signals that survive or return quickly once the page loads again.
EFF’s Cover Your Tracks is useful here because it reminds people that a browser can remain distinctive even when obvious identifiers are gone. If a site sees the same language settings, timezone, rendering quirks, device behavior, and other fingerprintable traits, then the user may still look recognizable enough to reconnect across visits.
The commercial stack can also rebuild continuity through account and profile systems. Twilio Segment’s identity-resolution materials explain this logic in plain product language: merge customer history across web, mobile, server, and third-party touchpoints using identifiers such as cookie IDs, device IDs, emails, anonymous IDs, and user IDs. In other words, the machinery is designed to keep separate-looking moments from staying separate forever.
That is why cookie clearing often feels less powerful than people hoped. It may remove one breadcrumb while leaving the route, the browser shape, the campaign tags, the loyalty login, or the email trail untouched. From the user side it feels unfair because the reset action seemed meaningful. From the system side it was only one broken link in a larger chain.
The practical privacy lesson is not “never bother clearing cookies.” It is “do not confuse one cleanup step with full anonymity.” Real anti-tracking defense has to reduce more than one signal and tell the user which signals were still live.
That is also why Cloak should stay concrete. If the browser still looks easy to reconnect, the product should say so. If it stripped a tag, weakened a fingerprint, or surfaced a repeat-session warning, that visible proof is more useful than vague reassurance.