These friends of mine discovered it while browsing an airline website, each with his own laptop, only to discover different prices being offered. Which they found very strange, given they were seated next to each other.
After cleaning the browser history and visiting the same web site with anonymous mode on, both got the same prices being offered.
One of them works for a travel agency.
When you do a search on a travel website (including most airlines official sites) you are actually being served results from a GDS. These companies (Worldspan, Sabre, etc) pull in airline/hotel/etc availability and produce an a search and fulfillment API. They are the reason you can get a flight that connects across multiple different carriers.
I've built a number of successful OTAs (Online Travel Agencies, aka websites) and never once been asked to provide visitor IP addresses or cookies.
In the early days of the internet doing repeated searches would increase prices because these systems were designed for travel agents to do a small number of searches, and a spike in searches was a demand signal. Almost all demand based pricing has been eliminated from air and hotel because of internet "casual shoppers" and price wars.
Do a google search for "clear your cookies before booking flights" and you can read all about it.
Check out Pardot if you want to get an idea of what's possible. They drop a cookie on you the moment you browse the site and it logs every interaction you have with the site. When you finally sign up or fill in a form somewhere it'll associate those sessions with your new account and let you better target drip campaigns and market to them.
There's a lot of other ways to identify someone. It's like in Serenity -- everything has a fingerprint.
To give a real world example of how true this is, I have a friend that owns a service company. He subscribes to Visistat for which he embeds a small snippet of Javascript into every page in his site. He uses a product of theirs called LeadCaster which then identifies the company name and often the contact name of people that visit the site. How does it do this? Look at Visitstat's Learning Center for an explanation:
NOTE: Contact information is supplied by the contact databases of Data.com (formerly Jigsaw), NetProspex and LinkedIn. Not all information will be available for every company and listing, however, your reports will show all the data we are able to access for you.
So for a real world example that he told me about a few hours ago, a lady was on his website. She left without doing anything more than viewing a few pages. Through Visistat, he was able to get her company name and contact information from LinkedIn. He looked up the phone number for her company and called her. He then said, "I understand you're interest in ..." She replied, "How did you know I am interested in ...?"
This is spooky as shit and almost made me delete my LinkedIn profile today.