Data & Privacy
Blocking cookies did not stop tracking, it changed the method
Your browser answers dozens of ordinary technical questions on every page, and the combination of those answers is frequently unique.
The options around browser fingerprinting are set out side by side below, with the conditions that genuinely favour one over the other.
The difference in one place
- Identity emerges from combining many individually unremarkable attributes.
- Each attribute narrows the population, and a handful is often enough.
- Unusual configurations can make a browser easier to recognise, not harder.
Identity assembled from ordinary details
A page can ask the browser for its language, time zone, screen dimensions, available fonts and how it handles various features. Each answer is entirely mundane on its own, and none of them identifies anybody in isolation.
Combining them produces a pattern, and patterns built from enough independent details become rare very quickly. Nothing is stored on the device, so clearing cookies and browsing data leaves the pattern completely unchanged. This is why tracking survived the restrictions placed on cookies rather than disappearing along with them.
Each detail narrows the crowd
Every attribute divides the population, and attributes that vary independently multiply their effect together. A common time zone barely narrows anything, while an unusual combination of screen size and font list narrows a great deal. Researchers describe this in terms of how many people share a given value, and the useful attributes are the varied ones.
A handful of moderately varied attributes is frequently sufficient to single out one browser among a very large population. The measurement depends heavily on the population being compared against, so figures quoted for one study rarely transfer to another.
Active probing goes further than asking
Rather than only reading properties, a script can ask the browser to perform a task and examine exactly how it turns out. Rendering text or shapes to a hidden canvas produces slightly different pixels depending on the graphics stack and drivers involved.
At the protocol level, processing an audio signal produces small numerical differences that follow the same hardware and software combination. Measuring which fonts are available reveals installed software, since applications commonly install fonts alongside themselves. None of these require permission, because each one is an ordinary capability being used for an unintended purpose.
Stability is what makes it valuable
A fingerprint is only useful for tracking if it stays the same across visits, and configurations do change over time. Updates alter version strings, new fonts appear and window sizes change, so the pattern drifts gradually rather than persisting forever.
At the protocol level, trackers handle this by matching approximately and by linking a new pattern to a recent one that mostly agrees. That linking is why small changes do not reset anything, and why a truly fresh identity is hard to obtain.
Fingerprinting is also used for detecting fraud and repeated abuse, which is a genuine use of the same mechanism.
Hardening can make you easier to spot
A browser configured unusually, with rare extensions or uncommon settings, produces a pattern that few others share. Blocking some attributes while allowing others can itself be distinctive, since the pattern of refusals is a signal.
Under load, reporting false values inconsistently is worse than reporting real ones, because inconsistency stands out sharply. This is the central awkwardness of the problem: individual defences can reduce anonymity rather than increasing it. The observation is well established in the research literature and is regularly rediscovered by people configuring their browsers.
Firmware updates change this behaviour more often than hardware does.
What actually reduces the surface
Approaches that work aim at uniformity, making many users report identical values rather than making values hard to read. Some browsers deliberately round window dimensions, limit font enumeration and add noise to canvas and audio results. Blocking the scripts that perform the probing prevents the measurement entirely, which is more effective than altering answers.
Using a widely shared default configuration is unglamorous and places you inside a large crowd rather than beside it. No approach is complete, and anyone claiming a browser cannot be fingerprinted is overstating what is currently achievable.
Side by side
| Consideration | What it means in practice |
|---|---|
| Identity assembled from ordinary details | Identity emerges from combining many individually unremarkable attributes. |
| Each detail narrows the crowd | Each attribute narrows the population, and a handful is often enough. |
| Active probing goes further than asking | Unusual configurations can make a browser easier to recognise, not harder. |
The takeaway
You are not recognised by what you stored; you are recognised by what you answered.
Once you know what it is trading away, the design stops looking arbitrary.
Questions readers ask
Does private browsing prevent fingerprinting?
No. It clears stored data at the end of the session, and the attributes used for fingerprinting are read fresh each time anyway.
Do extensions help?
Script blocking genuinely reduces the probing. Extensions that spoof values can add distinctiveness, and their presence is sometimes detectable.
