If they saw the person's username, then they can keep tracking that username. Same with any type of cookies. Https obviously makes it harder to do on sites they

If they saw the person's username, then they can keep tracking that username. Same with any type of cookies. Https obviously makes it harder to do on sites they don't own, but it still works on http sites and https sites they own.