Browser Fingerprinting: The Tracking Method That Doesn't Need Cookies
A friend once cleared her cookies religiously before every browsing session and was surprised to learn ad networks could still recognize her. Fingerprinting is why, and it does not care how often you clear anything.
Every browser configuration leaves a fingerprint, whether or not a single cookie is ever set.
In this post
- What a browser fingerprint actually is
- The signals that make up a fingerprint
- Why it is harder to defend against than cookies
- How unique your setup probably already is
- What actually helps, and what does not
Cookie deletion, private browsing, and cookie-consent banners have trained a lot of people to think of tracking almost entirely in terms of cookies. That framing made sense for a long time. It is increasingly incomplete, because a second tracking method has been quietly growing in use for years, one that does not need to store anything on your device at all.
What a browser fingerprint actually is
A browser fingerprint is a profile built from dozens of small, mostly harmless-looking pieces of information your browser exposes to every website you visit, by design, for legitimate compatibility reasons. Individually, each piece is common. Your screen resolution alone might match thousands of other users. But combined, screen resolution plus installed fonts plus browser version plus time zone plus a dozen other signals, the combination becomes rare enough to single you out, often with no single cookie involved at any point.
The Electronic Frontier Foundation's long-running Cover Your Tracks project (formerly Panopticlick) has been measuring exactly this for years, and lets you test how unique your own browser's fingerprint is against their dataset of real visitors.
The signals that make up a fingerprint
| Signal | What it reveals |
|---|---|
| User agent string | Browser, version, and operating system |
| Screen resolution and color depth | Your display hardware configuration |
| Installed fonts | Often unique combinations based on software you have installed |
| Canvas and WebGL rendering | Subtle differences in how your specific hardware and drivers render graphics |
| Time zone and language settings | Rough location and locale, even with location services off |
| Installed browser plugins | Another combination that narrows down who you likely are |
None of these individually would identify anyone. The technique relies entirely on combining enough of them that the resulting profile becomes statistically rare, sometimes unique among millions of visitors.
Why it is harder to defend against than cookies
Cookies are, at least in principle, something you control. You can view them, delete them, and block them by category. Fingerprinting signals are mostly things your browser has to reveal for the web to function normally at all. A site genuinely needs to know your screen size to render correctly. It needs to know your language to serve the right content. That legitimate need is exactly what makes the data available for tracking too, and it is much harder to selectively block "the parts used for tracking" without breaking the parts sites need for normal function.
This is also why fingerprinting survives clearing cookies, using private or incognito mode, and even switching between accounts on the same device and browser. None of those actions change your screen resolution, your installed fonts, or how your graphics hardware renders a canvas element.
How unique your setup probably already is
Research from projects like Cover Your Tracks has repeatedly found that the majority of tested browsers have a fingerprint unique enough, among the sample tested, to be individually identifiable, even without a single cookie stored. Unusual combinations, an uncommon font you installed for design work, a specific browser extension count, a particular screen resolution, tend to make a fingerprint more identifiable, not less, since rarity is exactly what the technique depends on.
The uncomfortable part: trying to look "unique" in the opposite direction, by having an unusually locked-down, heavily modified browser, can sometimes make you more identifiable, not less, since that specific combination of modifications becomes its own rare fingerprint. The goal with most practical defenses is blending into a large, common crowd, not standing out as different.
What actually helps, and what does not
- Helps: browsers with built-in fingerprint resistance, such as Firefox's strict tracking protection settings or Brave's fingerprint randomization, which are specifically designed to make your browser blend in with a large common group rather than stand out
- Helps: the Tor Browser, which is built from the ground up to make every user's fingerprint look as close to identical as possible, at the cost of some convenience and speed
- Does not help much on its own: clearing cookies or using private browsing mode, since neither touches the underlying signals fingerprinting relies on
- Does not help, and can backfire: installing many privacy extensions to "lock down" your browser, since an unusual combination of extensions is itself a fingerprinting signal
Fingerprinting is not a reason to give up on browser privacy, but it is a reason to stop treating cookie management as the whole picture. If tracking resistance matters to you, the tools built specifically to blend your fingerprint into a common crowd do far more than habitually clearing cookies ever will.