HTTP cookies are the most common. They are usually written and read by the site you are visiting (the "first party"), but also (depending on your browser and browser settings) written and read by third-party elements on the page you are visiting.
Also common are small image elements, served from various tracking servers (these are common in commercial emails too). Just like the information you make available by default when visiting any web page, these image elements can also gather basic browser environment details (e.g., IP address, User Agent). Also, depending on browser configuration, iframes can be used to embed more powerful mechanisms from third-party servers.
Keep in mind that your User Agent is often quite unique, and with access to JavaScript and certain browser plug-ins (e.g., Flash, Java), web sites can obtain quite detailed information about your browsing environment - often enough to uniquely identify you across web sites and over time, even without cookies. See https://panopticlick.eff.org/ for a good example.
There are more extensive mechanisms for tracking, device fingerprinting, and (at least partially) de-anonymizing web site visitors. See http://33bits.org/2010/02/18/cookies-supercookies-and-ubercookies-stealing-the-identity-of-web-visitors/ for examples.