How Browser Fingerprinting Tracks You Without Cookies

How does browser fingerprinting track you without cookies?

A cookie is a small piece of data a website can store in your browser. Browser fingerprinting works differently: a site collects details the browser reveals and combines them into a short identifier. A device fingerprint is a label made from information about a device’s software or hardware; a browser fingerprint focuses on information gathered through the browser. ⁴⁵

The result can help a site recognize a returning browser without relying on a saved cookie. But it is not the same as knowing a person’s name. A fingerprint can be used to associate visits or activity with a browser, while connecting that activity to a named account would require other information. ⁴⁵

What information can make up a browser fingerprint?

Some details are ordinary browser settings. A fingerprinting system may use the browser and operating system, language preference, or time zone. On their own, these details may not identify one visitor, but combining more details can make a browser easier to distinguish from others. ⁴

If JavaScript is available, a site may be able to check additional features, such as installed fonts or browser extensions. Canvas fingerprinting is another technique: code asks the browser to draw something, and the resulting output can provide another detail for the identifier. ⁴

Which details are collected depends on the site and its methods. The supplied sources do not provide a standard list that every fingerprinting system uses. ²⁴

Does incognito mode or a VPN stop fingerprinting?

Do not assume that private browsing makes a browser invisible. The sources describe fingerprinting as a way to recognize a browser from its characteristics, rather than from a cookie alone. One source reports that a demonstration produced a consistent identifier across incognito use, but that example does not establish what every site can do. ¹⁴

A VPN changes how a connection appears on the network, but the sources do not show that it removes browser details such as language, fonts, or rendering behavior. A security company also says some services use fingerprinting to recognize suspicious repeat activity, including when visitors use identity-concealing tools. That is a vendor’s description of its own use case, not independent proof about all fingerprinting systems. ³⁴

What can you do to reduce browser fingerprinting?

There is no guaranteed fix described in these sources. Disabling JavaScript can prevent techniques that depend on it, according to one demonstration, but that same source warns that network-based methods may still be possible. Turning JavaScript off may also affect how websites work. ¹

Browser privacy settings and privacy-focused tools may limit some data collection, but the research provided does not compare particular browsers or tools, or establish which settings work best. A browser fingerprint test can show information a site can observe; it is a check, not proof that tracking has stopped. The GitHub project in the sources describes itself as a browser fingerprinting and privacy analysis platform, but it does not provide independent evidence of protection. ²

For current guidance, check the privacy documentation for your browser and any tools you use. Treat claims that a single setting makes you untrackable with caution, because the sources do not support that promise.

Why do websites use fingerprints, and what remains uncertain?

Fingerprinting can be used for more than advertising. A fingerprinting company describes using visitor identifiers to connect repeat activity with fraud patterns and apply additional security checks. The same general ability to recognize a browser can also raise privacy concerns when used to follow activity. ³⁴

The supplied sources do not settle how widespread fingerprinting is, how often it identifies one person rather than a browser, or how well specific privacy protections work. They also do not establish what information a particular website collects. A site’s privacy notice is the place to look for its stated data practices; what it says may depend on its own policies and applicable rules. ¹³