A Boston technology firm is surreptitiously tracking computer users across the Internet on behalf of pharmaceutical companies, a practice that demonstrates the limits of a recent agreement to protect the privacy of Web surfers.