What Is Browser Fingerprinting and Why Clearing Cookies Isn't Enough
You clear your cookies, open a private window, maybe switch search engines. Then a site you have never logged into still serves the same ad, remembers your theme preference, or shows content in your local language. There is no cookie left to explain it. That is the quiet work of browser fingerprinting.
Browser fingerprinting is the practice of identifying a device and browser by the traits they expose, rather than by a file stored on your computer. It is not one trick. It is dozens of small signals collected together: screen size, fonts, time zone, graphics hardware, language, and more. Individually, most are boring. Combined, they can be close to unique.
Some signals are passive. Your browser sends HTTP headers with every request, including a user-agent string, language preferences, and sometimes a hint about your platform. Your IP address reveals your rough network location. Your device may also expose screen resolution and color depth without asking you.
Other signals require JavaScript, but they are just as quiet. A page can read your time zone, installed fonts, hardware concurrency, touch support, and media devices. It can check which codecs your browser supports and how it handles certain image formats.
Three techniques deserve special attention. Canvas fingerprinting asks your browser to draw text and shapes offscreen, then reads back the pixels. Tiny differences in GPU drivers, fonts, and anti-aliasing make the result slightly different on each machine. Audio fingerprinting plays a near-silent sound through the Web Audio API and measures how your system processes it. WebGL fingerprinting asks your graphics stack to render a 3D scene and reports details about the renderer. None of these require a cookie. All can be repeated on your next visit.
Cookies are explicit identifiers. A site says, in effect, “Here is a number. Bring it back next time.” Clearing cookies removes the number. Fingerprinting says, “Stand still while I measure you.” The measurement happens again when you return. Incognito or private mode gives you a fresh cookie jar, but it does not change your screen, fonts, time zone, or GPU. That is why private browsing can feel less private than its name suggests.
Sites often combine both methods. They use cookies when they can and fingerprinting as a fallback. Others store identifiers in local storage, IndexedDB, cache, or ETags. Clearing one storage area may not clear them all. If your fingerprint matches, a site can even recreate a cookie after you delete it.
Fingerprinting works best when your setup is rare. A standard phone with default settings looks like many other phones. A desktop with a custom font pack, an unusual screen resolution, and five privacy extensions can be memorable. Common contributors include:
Two people can run the same browser version and still differ on fonts, screen size, and GPU. Add a few more values, and the combination gets narrow. This is why privacy extensions can backfire: if your set of extensions is uncommon, it adds another identifying detail.
Built-in protections are the best first step because they are consistent across sites and less likely to break pages. No browser makes you anonymous by default, but some reduce the size of the fingerprint.
Firefox’s Enhanced Tracking Protection blocks many trackers. For stronger anti-fingerprinting, open about:config and set privacy.resistFingerprinting to true. It standardizes or spoofs many values, including time zone and screen metrics, and may prompt before allowing canvas reads. Expect some sites to behave oddly. Letterboxing can standardize window dimensions at the cost of visible margins. Firefox containers let you separate accounts into isolated cookie jars, which helps with tracking even if the device fingerprint remains.
Brave blocks trackers and ads by default. Its Shields menu includes fingerprinting protection; the strict setting randomizes or blocks several fingerprinting APIs. Randomized values can still be distinctive if they are too far from normal, but Brave’s approach is designed to be shared across many users. Test sites you rely on, especially banking and video.
Safari blocks third-party cookies by default and limits cross-site tracking. It also reduces some fingerprinting surfaces, but it is not a full anonymity tool. Safari plus a content blocker is a sensible baseline for everyday use.
Chrome and Edge offer privacy settings and are moving on third-party cookies, but their fingerprinting surfaces remain broad. Extensions can help, but the browser itself is not built for anti-fingerprinting first. If privacy is a priority, use a different browser for sensitive browsing.
Extensions can close gaps, but each one changes your fingerprint. Prefer a small, well-known set.
More extensions are not better. A long, unusual extension list is itself a fingerprint. If you install CanvasBlocker, read its options and keep them consistent.
Privacy tools are not a costume you put on once. They are a set of trade-offs you choose for a specific threat model.
Here is a routine that reduces fingerprinting without turning browsing into a second job.
Photo: Firmbee / Pixabay
Previous Post
10 Router Settings to Change Before Your Next Work-from-Home Day
Next Post
Tax Refund Phishing: How to Spot Fake IRS and HMRC Emails
