How the tiny website icon accidentally became the first bookmark tracker
When Microsoft introduced the favicon feature in Internet Explorer 5 in 1999, the browser only requested the 16x16 icon file from a web server when a user added the page to their Favorites list. Webmasters quickly realized that by checking server access logs for requests of that tiny image file, they could track exactly how many visitors had bookmarked their website without asking users or running any client-side JavaScript.
The Origin of the Shortcut Icon
In March 1999, Microsoft released Internet Explorer 5, introducing a small visual enhancement that would quickly become a standard component of the web: the favorite icon, or favicon. Designed as a portmanteau of the words 'favorite' and 'icon', the feature allowed webmasters to associate a custom 16x16 pixel graphic with their website. When a user bookmarked a site, this miniature image appeared next to the page title in the browser's Favorites menu and alongside the URL in the address bar.
To implement the feature, website owners placed a specially formatted graphic file named 'favicon.ico' in the root directory of their web server. Internet Explorer was programmed to automatically check this standard location. At the time, the Windows ICO format was the sole supported file type, making the implementation proprietary to the Windows ecosystem before web standards bodies began formalizing icon declarations in HTML.
The Mechanism Behind Log-Based Tracking
The tracking phenomenon arose from the specific sequence of network events Internet Explorer 5 executed. Rather than downloading the icon file every time a visitor loaded a page, the browser only dispatched an HTTP GET request for '/favicon.ico' when the user explicitly chose to add the page to their Favorites list. As a result, the request for the icon was an isolated event tied to an intentional user action.
System administrators inspecting their raw web server access logs soon noticed distinct entries for '/favicon.ico'. Because ordinary browsing did not trigger these requests, each entry in the access log served as a server-side signal that a visitor had just bookmarked the URL. By filtering the access logs for requests matching that single file path, webmasters could tally bookmark events without running client-side JavaScript, querying browser storage, or prompting the user.