HTTP cookies are the most common. They are usually written and read by the site you are visiting (the "first party"), but also (depending on your browser and browser settings) written and read by third-party elements on the page you are visiting.
Also common are small image elements, served from various tracking servers (these are common in commercial emails too). Just like the information you make available by default when visiting any web page, these image elements can also gather basic browser environment details (e.g., IP address, User Agent). Also, depending on browser configuration, iframes can be used to embed more powerful mechanisms from third-party servers.
There are more extensive mechanisms for tracking, device fingerprinting, and (at least partially) de-anonymizing web site visitors. See http://33bits.org/2010/02/18/cookies-supercookies-and-ubercookies-stealing-the-identity-of-web-visitors/ for examples.