All that's needed is a piece of information that ties to other pieces of information. In the case of online transactions, CC numbers, cookies, or other submissions of email addresses can be used. These can be correlated by the primary marketer, or by corrolation services. For the purposes of email mass-mailings, a relatively low probability of a direct match is likely acceptable.

It's for this and other reasons that I minimize the amount of business I transact online, and the amount of data I permit to be emitted. My cookies file lists 27 entries, and only 13 sites. My cookies permission file lists over 1690 sites -- these are sites which for the most part aren't allowed to set cookies. Yes, it means there are parts of the Web that don't work for me (or don't work in my primary browser -- Washington Post, for example, is accessible in lynx). I can live with the trade-off. The data are virtually always available elsewhere.

This isn't a perfect method, but it slows the bastards down.

Take a look at your security settings. I believe you can make this easier on yourself.

First, many user-oriented browsers -- that is, anything NOT shipped by Microsoft or AOL to provide marketing channels -- offer some very strong security/privacy options. Check with Wade, resident Opera snob (well, at least the browser, not sure about the performances...) for specifics.

You should be able to specify, on a per-site basis:

\r\n
• No cookies. The site cannot set or query a cookie.
\r\n
• Session cookies. The site can set a cookie which will last only for the duration of your session. If you ever look at cookie data, you'll find that many want to persist for years, decades, or even centuries. Sorry, you don't need to track me that long.
\r\n
• Permanent cookies. The site can set a cookie persisting beyond the end of the current session.
\r\n

My own browser only lets me specify permanent or no cookies. More recent versions of Mozilla aka Firebird, allow setting session cookies. I allow permanent cookies for sites which use/require a login, in some cases, though the local login manager covers for this in most cases. Allowing session cookies would allow pretty much all sites which use cookies to track session state to work, but keep them from snooping on you cross-session. Note that if you allow both types of cookies among a set of sites which pool cookie information (add / banner sites and credit-card processing sites are examples), it's still possible to corrolate information.

But at least you should be able to set preferences so your tools are doing what you want without requiring you delete all cookies after each session, and without loosing the (very few) possibly useful cookies you might want to keep around.