We are being watched. The websites we visit, and the advertisers who promote products on those sites, are tracking our online activity, building a profile of where we go and in some cases what we do when we get there.

The computer on which this article is being written has no fewer than 2,901 tracking files (known as cookies) monitoring its online activity, from sites including Google (121 cookies), Amazon (14), the UK government (46) and dozens upon dozens of advertising networks. These track different things: some monitor which sites are visited, some track which adverts are clicked, others store and report back on preferences and favourites on different sites.

The Guardian site is no exception. Unless your browser's security settings are particularly high – and most users' aren't – the Guardian will have placed several cookies on your computer as you arrived at this article, and its advertisers will have placed a few of their own.

Given virtually every internet user will have hundreds of cookies, and other forms of tracking, on their computer, and only a small proportion will be aware of this fact, cookies present a privacy concern for visitors and site owners.

This may be less sinister than it might first seem. Most cookies store no identifying information on a user: they are interested only in the behaviour of the person behind the computer, not their identity. Those that do track an identity are usually tied to login functions or preferences on one particular website.

Still, the concern of pressure groups and users was enough to warrant the EU to look into the issue, and enough to compel it to take action. From 26 May this year, every website operating in the UK will be required to inform its users that they are being tracked with cookies, and to ask users for their consent.

Sites which do not comply with the new rules face fines of up to £500,000, levied by the information commissioner.

This means sites will have to justify why they need information on their users – explaining which aspects of the sites they use rely on cookies.

Leaving advertising aside, cookies fill three major roles on the Guardian's own site, as GNM product manager Piers Jones explains:

"Cookies do a great job at remembering users' preferences," he says. "If you want to change your default view from the US to UK site, or vice versa, cookies store that preference. Another use is whether you want to see the full site or mobile site from your phone. Cookies also power accessibility options and identity across the site, including on the comment system."

Cookies are also used for user testing across the Guardian – when new components are added to the site, there's often no way to know in advance what way of displaying it would work best. Cookies allow a random sample of site visitors to see it one way, and a different group another. Site administrators can then track which view gets the best response.

The third use for cookies is for tracking how a site is used to fuel improvements to it, getting a larger pool of data than focus groups or similar would generate:

"From my perspective, we're trying to look at the experience people have on the site," says Jones. "Without these cookies, that becomes harder to do."

Internet tracking is also essential for targeting ads delivered by the big advertising networks, and without such cookies sites relying on these for revenue could be adversely affected.

"Cookies ID you when you're on a particular PC and let ad networks build up a profile. This means when you go to another site on the network they build a much deeper ad profile, which means more relevant, and therefore higher priced, adverts can be delivered," explains Ian Maude of Enders Analysis. "The new rules don't spell the death of internet advertising, but could be a handicap to some sites."

Maude adds that sites which have login information on their users can build far deeper profiles of their userbase than even cookies allow, and these would remain unaffected by legal changes. This means sites such as Google (for logged-in users) and Facebook's advertising would be untouched, as would that of the Financial Times and similar sites.

For large sites such as the Guardian, where some advertising is sold directly by advertising teams and the remainder delivered through networks, there could potentially be an effect, but it could be smaller sites that are hardest hit.

"Sites with a weak relationship with their audience may struggle, especially if advertising networks are the only way they target their ads. Overall growth in the advertising market should offset the decline, but not for all sites."

How websites follow the new rules may have a big impact. Some, such as the information commissioner's site, explicitly asks users to tick a box agreeing to accept cookies. Early anecdotal evidence suggests this can reduce the number of users accepting tracking by more than 90%. Other sites, such as bt.com, display a prominent message asking users if they wish to change settings, and saying the default will be to accept everything if not – which experts believe will mean a far smaller portion of users will refuse tracking.

Most sites – including the Guardian – haven't yet revealed how they intend to respond to the changes in law. But however it's done, prominent websites across the UK may find themselves having to explain and justify monitoring they've previously taken for granted – and their future success may depend on how well they do so.

Tracking the Trackers

But who are the big players tracking us? Help us to identify them and we'll reveal what they're doing with our data.

Find out more about the Guardian and cookies

You can get more details on how the Guardian uses cookies on our Privacy Policy and Cookies page.

Third party cookies used to tailor advertising based on previous web browsing activity can be turned off through the (IAB) Internet Advertising Bureau's consumer site Your Online Choices."

• This article was amended on 16 April 2012. The original said that all advertising and third party advertising cookies could be disabled through through the (IAB) Internet Advertising Bureau's consumer site. This has been corrected.