How Does Mcafee Track Visitors With Cookies

I'm running a test on my site for the mcafee secure logo, such that the mcafee logo will be shown to some visitors, and we track conversion rates with and without the logo. Naturally, mcafee have to keep track of the user vir the whole session, through to any 'thank you for buying' page. The code you place on the site is just an image, which includes in the url a reference to your domain.

The tech guy I spoke to suggested that the tracking happens via a cookie. But can this be done, when no script has been called from their server? The headers returned with the image show Content-Type: image/gif.

So basically I'm asking can cookies be set this way? If not then all I can see is that they're tracking urls only, which will be far from reliable.