Browser fingerprinting: identified without a single cookie

Every conversation about online privacy is about cookies, and cookies are the part that has largely been solved. Browsers block third-party ones, consent banners exist, and you can clear them whenever you like.

Fingerprinting is the part nobody has heard of, and it is the harder problem — because there is nothing to clear.

The distinction that matters

A cookie is something you have. A file placed on your device so a site can recognise it later. You can delete it, block it, or refuse it.

A fingerprint is something you are. It is derived, fresh on every visit, from the configuration of the device in your hand. Nothing is stored, so there is nothing to delete.

What is actually revealed

Your browser tells every site it loads a surprising amount, mostly for genuine reasons — rendering pages correctly, formatting dates, choosing a language.

• Screen — resolution, colour depth, available area, pixel ratio
• Browser — name, exact version, feature support
• System — operating system and version, CPU cores, memory class
• Fonts — which typefaces are installed, which varies by software installed
• Time zone and language — both, and whether they are consistent
• Graphics — how your specific GPU and drivers render a test image, down to minute differences
• Audio — how your audio stack processes a test signal
• Hardware — touch support, connected input devices

None identifies you alone. Millions of people share your screen resolution.

But the combination — that resolution, with those fonts, in that time zone, with that language, on that browser version, rendering graphics that particular way — is frequently unique among millions of users.

What it is used for

Advertising and analytics, which is the bulk of it — following you across sites where cookies are blocked.

Fraud detection, which is legitimate and widespread. Banks use device fingerprinting to notice when a login comes from an unfamiliar device. This is genuinely protective and worth acknowledging: the technique is not inherently adversarial.

Price and content differentiation, where what you are shown depends on inferences about your device and location.

Deanonymisation, linking activity you believed was separate — for example a private-mode session to a logged-in one.

What actually reduces it

Anti-fingerprinting does not hide you. It makes many users report the same values, so the identifier stops distinguishing anyone.

Browser choice

This does more than any individual setting.

• Tor Browser — the strongest available. It deliberately makes users identical, including standardised window sizes. The cost in convenience is real.
• Firefox — resistFingerprinting available, and strict Enhanced Tracking Protection blocks known fingerprinting scripts.
• Brave — randomises certain signals per site and session, so a fingerprint is unstable and cannot be used to link visits.
• Safari — presents a simplified profile to reduce distinguishing detail.

Sensible habits

• Keep your browser updated, so you are in the largest possible group running the current version.
• Use few extensions, and common ones.
• Do not resize windows to unusual dimensions if you are using a browser that standardises them.
• Block known fingerprinting scripts via strict tracking protection.

What does not help

• Private browsing. Local history only.
• Clearing cookies. No effect whatsoever.
• A VPN alone. It changes your apparent location, which is one signal out of dozens, and can even make you more distinctive if your time zone and language no longer match your apparent country.

Why this connects to scams

A detailed profile is not only an advertising asset. It is the raw material for a convincing approach.

The FTC's guidance on avoiding social media scams begins with limiting what others can see about you, because scammers "exploit what a user posts to figure out how to target them". Behavioural and device data feeds the same machinery from a different direction — see data brokers for where these profiles are assembled and sold, and online privacy for the practical changes worth making.