Say you look at a pair of boots. Once. It is a Tuesday lunchtime; you follow a link to a retailer you have never used, linger on a pair of tan leather boots for perhaps forty seconds, decide against them, and close the tab. For the next three weeks the boots follow you — to a news site, a weather app, the sidebar of a recipe blog, the pause screen of a video. This is a hypothetical, but you already know it barely needs to be: retargeting is the one piece of the advertising machine that civilians reliably notice, because it is the one piece that behaves as if it knows something. It does. Here is what happened in those forty seconds, and in the three weeks after.
Forty seconds to an audience
While the boots’ page was loading its photographs, it was also loading a tag — a scrap of code the retailer pasted into the site, still commonly called a pixel after the era when it literally was one: a one-by-one transparent image whose only job was to make your browser announce itself to a server. The modern version fires a request to an ad platform, and the platform writes down an identifier. In a desktop browser that has historically meant a third-party cookie; on a phone, the operating system’s advertising ID; increasingly, if you were logged in to anything, a scrambled (“hashed”) version of your email address that can be matched against the same scramble wherever else it appears.
None of this needs your name. It needs a handle — something stable enough that the machine can recognise the same browser next Tuesday. Against that handle, one fact is now recorded: viewed product 88213, tan boots, did not buy.
That single fact qualifies you for a retargeting audience — a list with a name like “viewed product, no purchase, last 30 days”. You did not join it; you matched it. And the next morning, when you open a news site, the page’s ad slots go to auction. A bid request describing the slot and your identifier flashes out to the exchanges, and the buying software on the other side — DSPs, demand-side platforms — checks that identifier against the audiences it holds. One of them recognises you as belonging to the boot retailer.
The economics of the entire genre fit in one sentence: the DSP bids more for you than for the stranger reading the same article. Not because it knows who you are, but because you have demonstrated intent, and intent is the closest thing this industry has to a sure bet. People who looked at boots buy boots at many times the rate of people who never did, so an impression served to you is worth a premium. The lookup and the bid both happen inside the roughly hundred milliseconds the auction allows1 — a deadline anatomised in the 100-millisecond auction.
Intent is the closest thing this industry has to a sure bet, and the machine pays a premium for it.
Why the boots don’t stop
In theory there is a governor on all this: the frequency cap, an advertiser’s instruction to show a given person the ad no more than, say, three times a day. In practice the cap fails for reasons of arithmetic. It is enforced per identifier, per platform. Your laptop’s cookie and your phone’s advertising ID are strangers to each other unless something has matched them. The retailer may be buying through more than one DSP, each capping independently, across exchanges that do not compare notes. Clear your cookies and the counter resets, because as far as the machine is concerned a fresh you has just arrived. Three per day quietly becomes three per day, per device, per platform — and nobody in the chain selling impressions has a burning incentive to tighten it.
What eventually slows the boots is not restraint but decay. Response to a retargeting ad drops with each repeat exposure — the trade calls it fatigue, or audience burn-out, and measures it obsessively. Well-run campaigns rotate the creative, shorten the window, and above all suppress people who have already bought. Which points at the genre’s signature failure: the boots that keep chasing you after you own them. Usually the purchase happened on a different device, or the checkout page’s pixel never fired, and the audience simply never got the memo. The list only knows what the pixels tell it.
The boots take the credit
Week three. You buy the boots — perhaps in a shop, perhaps by typing the retailer’s name into your browser yourself. Somewhere, a dashboard awards the conversion to the banner you scrolled past yesterday. This is view-through attribution: if an impression was served to your identifier — seen, or merely rendered on a page you visited — and you convert within the window, the impression can claim the purchase. On the big platforms the default view window is commonly a single day2, and a day is plenty when the audience was chosen precisely because it was about to buy.
The campaign harvests intent it did not create, then presents the harvest as its own crop.
Note the trick. A retargeting audience is, by construction, the population most likely to purchase anyway. The campaign harvests intent it did not create, then presents the harvest as its own crop. The honest question — would this purchase have happened without the ad? — has a name, incrementality, and answering it requires deliberately not showing ads to a held-out group and comparing. Many advertisers never quite get around to that experiment, which is why retargeting is famous inside the trade for looking magnificent in dashboards.
24 hours
Making it stop, mostly
The opt-outs exist, arranged in concentric circles of usefulness. Google’s My Ad Center lets you switch personalisation off across Google’s services and the sites it serves — what that switch does and doesn’t do is an essay of its own3. Meta’s ad preferences do the same job on its side of the fence. Then come the industry schemes — Your Online Choices in Europe, the Digital Advertising Alliance’s WebChoices tool in the US — which let you opt out of scores of ad companies at once45, with one pleasing irony: several record your refusal in a cookie, so clearing your cookies un-opts you out.
Browsers now do more of the real work than any form. Safari and Firefox have blocked third-party cookies by default for years, which is why the boots pursue Chrome users more doggedly than anyone else. Chrome itself, after half a decade of promising to retire those cookies, announced in 2025 that it would keep them after all6.
And know the limits. Opting out of personalisation stops the boots following you; it does not, in most regimes, stop the visit being recorded. The retailer still logged your forty seconds under its own first-party roof. Hashed-email matching walks straight past cookie hygiene whenever you log in around the web, and each opt-out lives in one browser on one device at a time. The bluntest instrument remains an ad blocker — a bargain with its own fine print, weighed in do ad blockers break the deal?, on a site that is, yes, funded by the machine it describes. Take the opt-outs anyway. The boots will stop following you, mostly. What the machine learned about your Tuesday lunchtime is another matter.