Browser Fingerprinting: How Websites Track You Without Cookies

You cleared your cookies, switched to incognito mode, and even changed your IP address. Yet somehow, the same ads keep following you around the web, and websites still seem to recognize you. The culprit is almost certainly browser fingerprinting, a stealthy tracking technique that identifies you based on the unique characteristics of your device and browser configuration.

Unlike cookies, which you can delete, your browser fingerprint is nearly invisible, extremely difficult to remove, and shockingly accurate. Studies have shown that over 80% of browsers have unique fingerprints, making users identifiable across sessions, devices, and even private browsing modes.

What Is Browser Fingerprinting?

Browser fingerprinting is a tracking technique that collects dozens of data points about your browser, device, and system configuration to create a unique identifier, called a "fingerprint," that distinguishes you from other users. This identifier allows websites and advertisers to recognize you even when you block cookies, use private browsing, or rotate IP addresses.

Think of it like a human fingerprint: the combination of your screen resolution, installed fonts, time zone, operating system, browser version, graphics card, and language preferences is almost certainly unique to you. Even seemingly harmless details, when combined, can identify you with precision rivaling government ID.

Fingerprinting vs. Cookies: Key Differences

While cookies and fingerprints both track users, they operate very differently. Here is a side-by-side comparison:

Feature	Cookies	Browser Fingerprinting
Storage location	Stored on your device	Nothing stored; derived from your browser
User control	Can be deleted or blocked	Very hard to remove
Visibility	Visible in browser settings	Invisible to the user
Cross-site tracking	Limited by third-party cookie blocking	Works across sites by default
Private browsing	Reset per session	Still identifies you
Legal regulation	Heavily regulated (GDPR, ePrivacy)	Loosely regulated, often undisclosed

How Browser Fingerprinting Works

When you visit a website, your browser automatically shares information to render pages correctly. Fingerprinting scripts harvest that information, combine it with data obtained through subtle probes, and generate a hash that uniquely identifies your setup.

Here is the process in five steps:

Script injection: A fingerprinting script, often loaded from an advertising or analytics domain, runs in your browser.
Attribute collection: The script gathers dozens of browser attributes using standard web APIs.
Active probing: It performs tests like rendering hidden graphics or playing silent audio to extract hardware-specific signals.
Hash generation: All collected values are combined and hashed into a single, unique identifier.
Database matching: The hash is sent to a server and compared against stored fingerprints to recognize returning visitors.

Common Fingerprinting Data Points

Modern fingerprinting scripts typically collect 30 to 100 distinct attributes. The most common include:

User agent string: Browser name, version, and operating system.
Screen resolution and color depth: Your display settings.
Installed fonts: The list of fonts available to your browser.
Time zone and language: Your regional preferences.
Hardware concurrency: Number of CPU cores available.
Device memory: Approximate RAM available.
Browser plugins and extensions: Though limited in modern browsers.
Touch support: Whether your device supports touch input.
Battery status: On some browsers, charge level and status.

Advanced Fingerprinting Techniques

Beyond simple attribute collection, trackers use clever technical tricks to generate even more unique identifiers. These advanced methods are harder to detect and defend against.

Canvas Fingerprinting

Canvas fingerprinting instructs your browser to draw a hidden image using the HTML5 Canvas API, typically a line of text with specific fonts and shapes. Due to tiny differences in graphics drivers, GPUs, anti-aliasing settings, and font rendering engines, the resulting image is subtly different on nearly every device. The script converts the image to a data string and hashes it, producing a highly unique identifier.

WebGL Fingerprinting

Similar to canvas fingerprinting but using 3D graphics, WebGL fingerprinting renders complex scenes and measures pixel-level differences caused by your specific GPU hardware and drivers. This technique can distinguish between devices with otherwise identical configurations.

Audio Fingerprinting

Audio fingerprinting uses the Web Audio API to generate a silent audio signal and analyze how your device processes it. Minor variations in audio stack implementation across devices produce measurable differences, adding another layer of uniqueness.

Font Enumeration

By measuring the width of rendered text in various fonts, scripts can detect which fonts are installed on your system. A unique combination of installed fonts, especially custom or professional ones, can single out your device from millions.

Behavioral Fingerprinting

Some advanced trackers go beyond static attributes to analyze how you interact with a page: your mouse movement patterns, typing cadence, scroll speed, and even how you tap on mobile. These behavioral signatures are difficult to spoof because they reflect unconscious habits.

Why Websites Use Browser Fingerprinting

Fingerprinting is not always malicious. There are legitimate use cases alongside the more concerning ones. Understanding the motivations helps you decide which defenses to prioritize.

Legitimate Uses

Fraud prevention: Banks and payment processors use fingerprinting to detect account takeovers and suspicious logins.
Bot detection: Websites block scrapers and credential stuffing attacks by recognizing automated browsers.
Account security: Services flag logins from unfamiliar devices to prevent unauthorized access.
License enforcement: Software vendors ensure licenses are not shared across unlimited devices.

Privacy-Invasive Uses

Cross-site advertising: Ad networks track users across websites to build detailed behavioral profiles.
Price discrimination: Some retailers show different prices based on your perceived purchasing power.
Cookie-less tracking: Analytics providers circumvent cookie consent requirements by fingerprinting instead.
De-anonymization: Linking a fingerprint to a known identity can unmask users who thought they were browsing anonymously.

How to Check Your Browser Fingerprint

Before you can defend against fingerprinting, it helps to see what your browser reveals. Several free tools let you check how unique your fingerprint is.

AmIUnique.org: Operated by researchers at Inria, this site shows every attribute collected and tells you how many other visitors share your exact fingerprint.
CoverYourTracks (EFF): The Electronic Frontier Foundation's tool tests both tracker blocking and fingerprint uniqueness.
BrowserLeaks: A technical suite showing exactly what each fingerprinting technique reveals about your device.

Most users are shocked to discover their fingerprint is one in a million, or even completely unique within the test database. That uniqueness is exactly what makes you trackable.

How to Protect Yourself from Browser Fingerprinting

No single tool makes you invisible, but combining several strategies dramatically reduces your trackability. The goal is to either blend in with the crowd (anti-fingerprinting) or constantly change your fingerprint (randomization).

1. Use a Privacy-Focused Browser

Modern browsers vary widely in their anti-fingerprinting features:

Tor Browser: The gold standard. Every Tor user looks nearly identical because the browser standardizes window size, user agent, and blocks most fingerprinting APIs.
Brave: Includes built-in fingerprint randomization that slightly alters canvas and audio outputs on every session.
Firefox: Offers resist fingerprinting mode (toggle privacy.resistFingerprinting in about:config) that standardizes many attributes.
LibreWolf: A hardened Firefox fork with anti-fingerprinting enabled by default.

2. Install Anti-Tracking Extensions

Browser extensions can block fingerprinting scripts before they load:

uBlock Origin: Blocks known tracking and fingerprinting domains using filter lists.
Privacy Badger: Learns to block trackers based on behavior.
CanvasBlocker: Prevents or randomizes canvas and WebGL fingerprinting attempts.

3. Disable JavaScript on Untrusted Sites

Most fingerprinting relies on JavaScript. Using NoScript or similar extensions to disable JavaScript on sites you do not trust effectively neutralizes most fingerprinting attempts, though it may break site functionality.

4. Keep Your Browser Updated but Standard

Counterintuitively, over-customizing your browser can make you more unique. Installing dozens of extensions, exotic fonts, or unusual settings creates a highly distinctive fingerprint. Stick with default settings on a popular browser version to blend in.

5. Use Encrypted DNS and Network-Level Protection

While network protections do not stop fingerprinting directly, they prevent other correlation techniques. Enabling encrypted DNS (DoH or DoT) in your browser hides your lookups from your internet provider, and router-level filtering can block known tracking domains for your entire network.

6. Compartmentalize Your Browsing

Use separate browsers or browser profiles for different activities: one for banking, one for social media, one for shopping. This prevents trackers from correlating activity across the different parts of your life, even if each profile has a unique fingerprint.

7. Be Mindful of Shared Links

Clicking tracking-laden links is one of the easiest ways to be fingerprinted and profiled. When sharing links, use a privacy-respecting URL shortener like Lunyb that does not harvest visitor data for ad profiles. For more context, see our honest review of Lunyb and our 2026 buyer's guide to URL shorteners.

The Future of Browser Fingerprinting

As third-party cookies are being phased out across major browsers, advertisers are doubling down on fingerprinting as a replacement. Expect to see more sophisticated techniques, more legal scrutiny, and more browser-level defenses in the coming years.

Regulators are catching up. The EU's ePrivacy framework and various state-level laws in the US are starting to treat fingerprinting as a form of personal data collection requiring consent. However, enforcement is uneven, and users still need to take personal responsibility for their privacy.

On the technical side, browser vendors like Apple (Safari), Mozilla (Firefox), and the Tor Project are leading efforts to standardize or randomize fingerprintable attributes. Google's Privacy Sandbox proposes alternative tracking methods but has drawn criticism for still enabling user profiling.

Frequently Asked Questions

Can incognito or private browsing stop browser fingerprinting?

No. Private browsing modes only prevent your browser from saving history, cookies, and form data locally. Your fingerprint, built from hardware and software characteristics, remains the same whether you are in regular or private mode. Websites can still identify you across sessions.

How unique is my browser fingerprint?

According to studies by the EFF and academic researchers, 80 to 90% of browsers have completely unique fingerprints. The more customization you have (extensions, fonts, unusual settings), the more unique and trackable you become. Testing at AmIUnique.org or CoverYourTracks will show your exact uniqueness score.

Does changing my IP address prevent fingerprinting?

No. Your IP address is just one of many fingerprinting data points, and most trackers do not rely on it heavily because IPs change frequently. Even if you route traffic through a different network, your canvas fingerprint, fonts, and hardware signals remain identifiable.

Is browser fingerprinting legal?

It depends on jurisdiction. In the EU, under GDPR and the ePrivacy Directive, fingerprinting for tracking generally requires user consent, same as cookies. In the US, regulation is patchwork and often weakly enforced. Many websites fingerprint users without clear disclosure, operating in legal gray areas.

What is the single best way to reduce fingerprinting?

Using Tor Browser offers the strongest protection because it standardizes nearly every fingerprintable attribute, making all Tor users look alike. For a balance between usability and privacy, Firefox with resist fingerprinting enabled, combined with uBlock Origin, is an excellent everyday setup.

Final Thoughts

Browser fingerprinting is one of the most pervasive and least understood tracking techniques on the modern web. Unlike cookies, you cannot simply delete it, and unlike IP tracking, you cannot easily hide it. Awareness is the first step toward meaningful protection.

The practical defense is layered: choose a privacy-respecting browser, limit your use of unnecessary extensions, block known tracking scripts, compartmentalize sensitive activities, and favor services that do not treat your attention as a product. No approach is perfect, but each layer meaningfully reduces how much of your digital life is harvested, profiled, and sold without your knowledge.