Using HSTS to track your browsing habits evades the features of web browsers designed to control more normal ”cookie” based tracking mechanisms. Using ”incognito” or ”private” modes means that existing cookies won’t be shared with sites you visit. Browsers also let you entirely delete cookies that could be used to track you. Because HSTS is a security feature and isn’t intended to be used for tracking, web browsers treat it differently from cookies. It is only by intentional misapplication that HSTS can be exploited to track users.
» Sam Greenhalgh | radicalresearch.co.uk