Browser Fingerprinting Explained: How Sites Track You With No Cookies At All

Third-party cookies spent a decade as the villain of web privacy, and the industry built an entire consent-banner apparatus around them. Meanwhile the technique that replaced them has no banner, no stored artifact, and no delete button.

Fingerprinting does not put anything on your device. It reads what your browser tells every page anyway — the GPU it renders with, the fonts it has, the timezone it is in, how wide the window is — and hashes the combination into an identifier. Clear your cookies, open a private window, switch profiles: every one of those values is unchanged, so the identifier is unchanged.

The arithmetic is what makes it work. Eight billion people is about 2^33, so roughly 33 bits of entropy is enough to single out one individual on earth. A typical desktop browser hands over considerably more than that across a handful of API calls.

The signals, and which ones actually matter

Not all fingerprint inputs are equal. A few carry most of the discriminating power, and knowing which ones changes what is worth defending.

The first four do the real work, and all four describe hardware rather than configuration — which is why they survive every reinstall, every profile switch, and every cookie purge.

Three mechanisms you can run yourself

Canvas

The oldest and still the most instructive. Draw the same text and shapes on a <canvas> on two different machines and the pixel output differs, because anti-aliasing, sub-pixel positioning, and font rasterization depend on the GPU, the driver, and the installed font stack.

function canvasFingerprint() {
  const c = document.createElement('canvas');
  c.width = 240; c.height = 60;
  const ctx = c.getContext('2d');
  ctx.textBaseline = 'alphabetic';
  ctx.font = '16px "Arial"';
  ctx.fillStyle = '#f60';
  ctx.fillRect(10, 1, 62, 20);
  ctx.fillStyle = 'rgba(0, 102, 153, 0.7)';
  ctx.fillText('Cwm fjord bank glyphs vext quiz', 2, 40);
  return c.toDataURL();   // stable per device, different across devices
}

That pangram is not decorative — it exercises a wide glyph range so font substitution differences show up in the output. Hash the data URL and you have a value that is stable for a given machine across months.

WebGL

One call, enormous entropy:

const gl = document.createElement('canvas').getContext('webgl');
const info = gl.getExtension('WEBGL_debug_renderer_info');
console.log(gl.getParameter(info.UNMASKED_RENDERER_WEBGL));
// e.g. "ANGLE (NVIDIA, NVIDIA GeForce RTX 4070 Direct3D11 vs_5_0 ps_5_0, D3D11)"

That string typically names the graphics chip, the rendering backend, and the shader model. Combined with a timezone it can narrow a population to a very small group before any other signal is read. Safari and Brave both restrict or normalise this value for exactly that reason.

AudioContext

The subtlest of the three. Render a waveform through an OfflineAudioContext and read the output buffer: floating-point DSP results differ slightly across audio stacks and CPU implementations, so summing the samples produces a device-correlated number.

async function audioFingerprint() {
  const ctx = new OfflineAudioContext(1, 44100, 44100);
  const osc = ctx.createOscillator();
  osc.type = 'triangle';
  osc.frequency.value = 10000;
  const comp = ctx.createDynamicsCompressor();
  osc.connect(comp); comp.connect(ctx.destination);
  osc.start(0);
  const buf = await ctx.startRendering();
  return buf.getChannelData(0).slice(4500, 5000)
            .reduce((a, b) => a + Math.abs(b), 0);
}

No microphone permission, no user interaction, no visible effect. It renders silently to a buffer.

The mistake almost everyone makes

The intuitive defence is to hide or fake the signals. Install a user-agent switcher, report a different OS, randomize the canvas on every read.

This usually makes things worse, for a reason that is obvious once stated: uniqueness is the thing being measured, and an unusual configuration is more unique than a common one.

Three concrete ways ad-hoc spoofing backfires:

1. Rare values are labels. Claiming to be Firefox 73 on Windows XP in 2026 puts you in a population of approximately one. The spoof is the identifier.
2. Inconsistency is itself a signal. A user agent saying macOS while navigator.platform says Win32, the font list contains Segoe UI, and WebGL reports a Direct3D backend — now you are not just unique, you are detectably lying, which is a flag fraud systems specifically look for.
3. Per-read randomization without scoping is detectable. Call the canvas hash three times in one page load and get three different answers, and the site knows randomization is active. That boolean is a fingerprint bit of its own.

Which leaves exactly two coherent strategies.

Strategy one: look like everyone else

Make your fingerprint identical to a large crowd's, so it identifies the crowd rather than you.

Tor Browser is the reference implementation. Every user reports the same user agent, the same spoofed timezone, the same navigator.platform, a bundled font set rather than the system's, and — through letterboxing — a window size rounded to one of a small set of standard dimensions, with grey margins filling the remainder. You stop being an individual and become a Tor user.

Safari pursues a milder version: it presents a simplified system configuration, declines to enumerate user-installed fonts, and limits what the renderer string reveals. Combined with a large base of near-identical Apple hardware, the result is a genuinely crowded fingerprint without any user configuration.

Firefox offers the strong version behind a flag. In about:config, setting privacy.resistFingerprinting to true spoofs the timezone to UTC, reports a generic user agent, restricts font enumeration, and enables letterboxing. It is effective and it is visible — pages render with margins and timestamps show in UTC. Firefox also ships a lighter "Fingerprinting Protection" in normal browsing that blocks known fingerprinting scripts without altering your own values.

The cost of uniformity is that you must accept the crowd's configuration instead of your own.

Strategy two: be a different person on every site

Brave takes the opposite approach, called farbling. Rather than normalising values, it perturbs them deterministically per session and per top-level site. Canvas reads, audio output, WebGL parameters, and plugin lists all return slightly altered values — consistent within a single site so pages do not break, different across sites so cross-site correlation fails, and reseeded each session so long-term tracking fails too.

The elegance is that it attacks linkage rather than identifiability. Brave does not try to make you look common. It makes the fingerprint that site-a.com computes useless to site-b.com, which is what cross-site tracking actually requires.

What each browser does, side by side

Chrome's contribution is real but narrow. User-Agent Reduction froze the detailed version and platform strings in the UA header, moving that information behind Client Hints, which sites must explicitly request. It removes passive entropy from one header. It does not touch canvas, WebGL, audio, or fonts — which is where the entropy actually lives.

A decision tree that matches real goals

"I want ads to stop following me across sites." Brave with default shields, or Firefox with Strict Enhanced Tracking Protection plus uBlock Origin. Blocking the scripts that compute fingerprints is more effective here than altering the values they would read, because most commercial tracking relies on a handful of well-known third-party domains.

"I need a session that cannot be linked to my normal browsing." Tor Browser, with nothing changed from its defaults. Not a private window — private windows alter stored state, not fingerprints, a distinction covered in what incognito mode actually hides.

"I am a developer and I need my real configuration." Accept that you are identifiable and manage it at the network and storage layer instead: container tabs, separate profiles per context, a content blocker. Fighting fingerprinting while running a custom font stack and an unusual GPU is not a fight you win.

"I just want fewer trackers without breaking anything." uBlock Origin plus your browser's built-in tracking protection. This is the highest ratio of benefit to effort available, and it is the right answer for most people.

To see where you actually stand, EFF's Cover Your Tracks and amiunique.org both compare your configuration against a live sample and, more usefully, tell you which signal is making you distinctive. The browser privacy score tool here reports the specific values your browser is exposing, which is the practical starting point before changing any setting.

Why this will not be deprecated

Third-party cookies could be phased out because the ad industry had alternatives. Fingerprinting has a constituency that privacy regulation cannot easily dislodge: fraud prevention.

Payment processors score transactions on device consistency. Login systems flag an authentication from a device fingerprint that has never been seen on an account. Bot-detection services distinguish real browsers from automation frameworks precisely by checking whether the fingerprint is internally coherent — which is also why aggressive spoofing gets you served CAPTCHAs.

So the same mechanism underlies both surveillance advertising and the control that stops someone using your stolen session on their own laptop. That dual use is why the realistic goal is unlinkability across sites rather than invisibility, and why the browsers making real progress — Brave by partitioning, Safari by reduction, Tor by uniformity — all attack linkage rather than attempting to make you disappear.

Where the law sits

Under the EU's ePrivacy Directive, Article 5(3) covers gaining access to information stored in terminal equipment, and European data protection authorities have taken the position that reading device characteristics for identification purposes falls within it and therefore requires consent. The GDPR treats a persistent identifier derived this way as personal data. The UK ICO and France's CNIL have both published guidance that reaches the same conclusion.

Enforcement lags because there is no artifact to audit. A cookie is a file an investigator can point at. A fingerprint is a hash computed in memory from values the page was always going to receive, which makes the violation visible only by reading the script.

The honest summary

Cookie controls were a solvable problem with a visible mechanism and a clear remedy. Fingerprinting is neither. It extracts identity from the properties that make your device yours, which is why there is no setting that simply turns it off.

Pick a coherent strategy rather than assembling defences: uniformity if anonymity is the goal, randomization if cross-site unlinkability is the goal, script blocking if reducing commercial tracking is the goal. What does not work is spoofing individual values in an otherwise normal browser — the most common approach, and the one that reliably makes a fingerprint more distinctive than leaving it alone.