The way I remember it is, as the page host I have a cookie on you. Then I drop in a 1-pixel image to a third party, and in the query string to it I write in a hashed form of the cookie I have for you. That HTTP request then itself can go through the cookie process, but for the third party. They then check their DB for both their own issued cookie and the value you passed in, and are then able to perform some asynchronous (batch or otherwise) match to associate the two IDs. From then on, an ad etc. can be targeted based on that info.