Browser Fingerprinting: What Trackers Use When Cookies Are Gone
Blocking third-party cookies removes the most familiar tracking mechanism, but it does not make a browser anonymous. A site can still observe a collection of characteristics about the device and software, combine them, and recognise the same browser on a later visit. That is fingerprinting, and it is worth understanding before deciding which privacy settings actually matter.
Table of contents
- Recognition without storage
- The signals that carry the most information
- Why ordinary blockers miss it
- What browser-level defences actually do
- Mitigations that are realistic
- The honest trade-off
- FAQ
- Bottom line
Recognition without storage
Cookie-based tracking works by writing an identifier and reading it back. Fingerprinting works by measuring the browser: what it reports about itself and how it renders or behaves. No file needs to be stored on the device, which is why clearing cookies does not reset it and why a blocker that only filters known tracking domains may see nothing to block.
Recognition is probabilistic. Any single characteristic is shared by many people; a combination of enough of them becomes distinctive. The useful mental model is not a unique serial number but a progressively narrowing description: a particular operating system, on a particular browser build, with a particular set of fonts, at a particular screen size and timezone.
The signals that carry the most information
- User agent and platform strings, including browser version and operating system details.
- Screen and window geometry, device pixel ratio, and available screen space.
- Installed fonts and language settings, which vary with software installed and locale.
- Timezone, locale, and keyboard layout, which narrow geography and configuration.
- Canvas, WebGL and audio rendering, where tiny differences in graphics hardware and drivers produce measurable output differences.
- Hardware concurrency, memory hints and media device enumeration, where exposed by the browser.
- Behavioural signals such as typing cadence or pointer movement, which are used in some fraud-detection systems rather than in ordinary advertising.
The relative weight of each signal depends on the population being measured. Fonts and rendering APIs are commonly cited because they vary a great deal between machines while remaining stable across visits on the same machine.
Why ordinary blockers miss it
A blocklist works by naming things: domains, URLs, and script patterns. A fingerprinting script can be served from the site's own domain, bundled with the analytics or anti-fraud code the page needs, and use standard browser APIs that are also used for legitimate rendering. There is no obvious request to filter and no third-party cookie to refuse.
This is why measures such as blocking third-party cookies, using a private window, or clearing site data have limited effect against fingerprinting. They address storage and known-network requests, while the measurement happens in the page's own JavaScript context. Some browsers now reduce or randomise the information returned by specific APIs, which is a different kind of defence and a more relevant one.
What browser-level defences actually do
Three approaches exist. Reduction returns less precise values for properties such as screen size, hardware hints, or timezone. Randomisation or noise adds small variations to rendering outputs so that repeated measurements do not match exactly. Uniformity tries to make many users look identical by returning a common value, which works best when a large population shares the same configuration.
Each has a cost. Overly uniform or noisy values can break sites that legitimately need to know a screen size or graphics capability, and can make a browser more conspicuous if very few users have that exact configuration. This is the reason protective features are usually enabled by default for everyone in a browser, rather than offered as a toggle for a small group.
Mitigations that are realistic
- Keep the browser updated and use its built-in fingerprinting protections where available; these are more effective than an extension bolted on afterwards.
- Avoid adding unusual extensions purely for privacy. Extensions change the browser's observable surface and can make it more distinctive.
- Prefer a mainstream configuration over a heavily customised one if the goal is to blend into a large population.
- Understand what a private window does: it isolates storage and history locally; it does not by itself change what the browser reports about the device.
- Separate identities where it matters using distinct browser profiles or accounts, so that activity which should not be linked stays unlinked by the services themselves.
The honest trade-off
Aggressively spoofing every observable value is a recognisable strategy in itself, and some sites respond by challenging browsers that look inconsistent. A VPN changes the network address but not the browser's fingerprint; combining the two does not automatically produce anonymity, and a logged-in account identifies the session regardless of either.
For most readers, the sensible goal is narrower: reduce the amount of stable, distinctive information available to sites you do not have a relationship with, and avoid building a configuration that is unique to you in the name of privacy. The built-in protections of a widely used, current browser plus ordinary cookie blocking achieve more of that goal than a stack of custom tweaks.
FAQ
Does clearing cookies stop fingerprinting?
No. Clearing cookies removes stored identifiers, but fingerprinting measures the browser and device on each visit. It is designed to work without writing anything to the device.
Does a VPN hide my browser fingerprint?
No. A VPN changes the apparent network address; the browser still reports the same screen, fonts, locale, and rendering behaviour to the page. The two address different signals.
Will a private or incognito window help?
It prevents local history and storage from persisting, and may isolate some state, but the fingerprint a page can observe remains largely the same unless the browser applies specific protections in that mode.
Are anti-fingerprinting extensions a good idea?
Be cautious. A small number of users with an unusual extension configuration can become easier to identify, and some extensions require broad permissions. Prefer the protections built into a mainstream browser and keep the rest of the configuration ordinary.
Bottom line
Fingerprinting is recognition by measurement rather than by storage, which is why cookie controls and domain blocklists do not settle it. The informative signals are ordinary browser properties — fonts, geometry, locale, graphics behaviour — and the most useful defences are the reductions and noise that browser vendors apply for everyone, not a pile of individual tweaks. For everyday use, keep the browser current, leave its built-in protections on, avoid unusual extension stacks, and separate identities with profiles or accounts where it matters. Be realistic about the goal: reducing what unrelated sites can learn is achievable; making a logged-in browser unrecognisable is not.
If you want to compare current plans in this category, the link below goes to our own product page.