You open a browser tab — incognito, because you’re on a shared laptop at a hotel. You navigate to a news site. It’s your first visit from this machine. You’ve never logged into anything. You’ve never clicked an ad on this device.
And then the sidebar loads. Running shoes. Specifically, the pair you were comparing on your home computer three days ago.
This is not a coincidence. It is not a targeting algorithm that happened to guess right. A tracking system matched the browser on this hotel laptop to a profile it already built from your home machine. No cookies, no login, nothing you did to connect them. It did this in the time it took the page to load.
That method is called browser fingerprinting. And most people who think they’ve protected their privacy by going incognito have never heard of it.
The short answer: Browser fingerprinting builds a near-unique ID from your device’s technical details: screen size, installed fonts, timezone, and how your GPU renders a hidden image. It needs no cookie and no login, so incognito mode and most VPNs don’t stop it. You can’t delete a fingerprint, because it lives on the tracker’s servers. What works is a browser that spoofs or randomizes those signals: Brave by default, Firefox with resistFingerprinting, or Tor for maximum protection.
Jump to: What a fingerprint is · Canvas fingerprinting · The commercial infrastructure · Why consent banners miss it · How browsers fight back · What works and what doesn’t · Test your own fingerprint · What to do
What a fingerprint actually is
Every browser that visits a website sends information about itself. Some of this is necessary. The browser needs to tell the server what kind of content it can display, what language to serve, and what screen dimensions to render for. But the combination of all this technical data, taken together, turns out to be nearly unique.
Your screen resolution. Your color depth. Your timezone. Your system language and any additional languages your browser is set to accept. The list of fonts installed on your operating system — not the fonts your browser uses, but fonts your system has, which JavaScript can probe for. Your browser plugins and their versions. The number of CPU cores your device reports. How your browser handles audio — the AudioContext API produces slightly different numerical output depending on your hardware and drivers, and that deviation is measurable. Your device’s battery level and charging state, where exposed. Whether your device has a touchscreen. How your graphics card renders a hidden test image.
That last one is important enough to explain on its own.
Canvas fingerprinting: your GPU draws your identity
Canvas fingerprinting was first described in academic literature around 2012. It spread quickly through ad tech infrastructure, because it works reliably and requires almost nothing to implement.
Here is what happens. When you visit a page, a JavaScript snippet instructs your browser to draw an invisible image. It’s often a string of text using a specific font, with specific colors, on a specific background. This image is drawn using the HTML5 Canvas API. Your browser renders it using your GPU, your graphics drivers, and your operating system’s text rendering stack.
Here’s the critical part: that rendering is not identical across devices. The anti-aliasing, subpixel rendering, font hinting, and floating-point math in the GPU all introduce tiny variations. A MacBook Air renders the test image slightly differently than a Windows laptop with an NVIDIA card. And that renders it slightly differently than a Chromebook. These differences are invisible to the human eye. But they’re measurable, and they’re consistent. The same hardware and driver setup will produce the same rendering every time.
The script takes that rendered image, converts it to a string of data using a process called hashing, and sends that hash to the tracking server. Your canvas hash is your signature. The next time you visit — or the next time any site using the same fingerprinting infrastructure loads — your canvas renders the same way. It produces the same hash, and you’re recognized.
You can’t clear your canvas fingerprint. It isn’t stored anywhere on your device. It lives on the server, linked to the profile they’ve built for you.
How many attributes combine into a unique identity
The research on this is specific and worth citing. A 2010 study by Peter Eckersley at the Electronic Frontier Foundation tested 470,161 browsers. It found that 83.6% of them had a unique fingerprint, based on browser and plugin version, timezone, screen resolution, system fonts, and a few other attributes. For browsers with Flash or Java installed, the majority at the time, that figure rose to 94.2%.
A 2022 study in Proceedings on Privacy Enhancing Technologies analyzed modern browser fingerprinting with updated attributes. It found that combining canvas fingerprinting, WebGL, audio fingerprinting, and standard attributes created a fingerprint unique to roughly 1 in 286,000 browsers. That’s a far smaller population than most cities. Across the scale of the internet, it’s more than enough to pick you out.
A 2019 paper from INRIA in France tracked users over time. It found that fingerprints remain stable across browser sessions for most users. And even when attributes change, after a browser update say, the tracking companies have developed algorithms to link the old fingerprint to the new one with high confidence.
The commercial infrastructure behind this
Browser fingerprinting isn’t something shady actors built in basements. It is industrial-scale commercial technology deployed by major ad tech companies and sold as a product.
FingerprintJS, which rebranded to Fingerprint.com in 2022, is the most prominent commercial provider. They operate a browser fingerprinting library used by thousands of websites. Their claimed accuracy is 99.5% — they say their system can correctly identify a returning user 99.5% of the time. They market this explicitly to banks and financial institutions as fraud prevention, and to e-commerce and ad tech as visitor identification. Their library is open source for basic use; the commercial product adds server-side processing and their cross-site identification network.
Lotame operates a data management platform that uses fingerprinting to build cross-device identity graphs — linking a person’s phone browser, laptop browser, and tablet without any shared login. Their “Panorama ID” is built partly from fingerprinting signals.
Nielsen uses fingerprinting in its digital audience measurement systems. Sizmek, before its acquisition by Amazon, was one of the earlier large-scale ad server users of canvas fingerprinting for retargeting.
The ad tech supply chain is layered enough that fingerprinting infrastructure can be present on a page without the site operator having made any deliberate choice to include it. An ad network includes it. A third-party widget includes it. A hosted font service includes it. The site owner agreed to display ads or embed a social sharing button and got fingerprinting as an undisclosed dependency.
The cookie consent dialog does not cover this
You’ve clicked “Reject All” on a cookie consent banner. You felt like you did something. You didn’t do nothing: rejecting cookies does block some tracking. But fingerprinting is a separate mechanism. Its legal treatment under GDPR and the EU’s ePrivacy Directive has been inconsistent enough that many operators treat it as outside the scope of cookie consent entirely.
The GDPR defines personal data as any information relating to an identified or identifiable person. A browser fingerprint that uniquely identifies a device and, by extension, a person is personal data under that definition. The Court of Justice of the European Union confirmed in 2019 that dynamic IP addresses can constitute personal data — fingerprints carry the same logic.
But the cookie consent framework, technically established under the ePrivacy Directive, specifically addresses cookies and similar technologies that involve storage on the user’s device. Fingerprinting involves no storage on your device — the data lives entirely on the tracker’s servers. Regulators in some countries, including France’s CNIL, have stated that fingerprinting requires consent. Others haven’t taken a firm position. The result is a legal gray zone that companies have operated inside for years.
The practical outcome is this. You go through the ritual of the consent banner. You reject tracking. The banner disappears. And then the fingerprinting infrastructure that was already running in the page’s background keeps running. Your explicit choice about tracking is, in effect, honored for one method and ignored for another.
Cross-device tracking without a login
Here is where fingerprinting gets more troubling than just recognizing you on a single return visit.
Ad tech companies are trying to answer a specific question: is the person using this phone the same person who uses that laptop? Without a shared login, they have to infer this relationship. They do it through what the industry calls probabilistic matching.
The method works like this: your phone and your laptop originate requests from the same IP address at the same times (because they’re both on your home Wi-Fi). Both visit similar sites. Both exhibit similar browsing behavior — you read tech news in the morning, check certain publications in the evening, show interest in the same product categories. The fingerprints from both devices go into a model that calculates the probability that they belong to the same person.
When that probability crosses a threshold, the two devices are linked in an identity graph. Your ad targeting profile is now shared across both devices. This is why you can look at a product on your phone and see an ad for it on your laptop later that day. You never logged into anything on either device.
The alternative is deterministic matching — linking devices through a shared login, like seeing you’re signed into the same Google account on both. Fingerprinting enables the probabilistic version. Both approaches end up in the same place: a single profile spanning multiple devices, built without your knowledge or any explicit consent.
How browsers are fighting back
Browser vendors have been aware of this problem for years and have taken different approaches.
Firefox added a setting called privacy.resistFingerprinting that has been available in about:config since around 2018. When enabled, it standardizes a range of fingerprinting surfaces. Firefox reports a fake, generic screen resolution, returns a fixed user-agent string, and spoofs timezone as UTC. It also limits font enumeration and randomizes canvas output. It makes your Firefox look like many other Firefox installations rather than your specific system. The trade-off is that some sites break when they receive inconsistent data — a screen that reports one resolution while displaying at another can confuse layout code.
Brave Browser takes a different approach: randomization rather than standardization. Rather than making everyone’s canvas hash the same, Brave adds a small, consistent random noise to canvas output that changes every session and every site. Your canvas hash on site A is different from your canvas hash on site B, which breaks cross-site fingerprint matching. The noise is small enough that it doesn’t visibly affect what you see, but large enough to make fingerprint matching unreliable. Brave does the same for WebGL, audio fingerprinting, and font enumeration.
Safari uses Intelligent Tracking Prevention (ITP), which focuses more on cookie and storage-based tracking than fingerprinting, though Apple has added some fingerprinting mitigations. Safari limits the JavaScript APIs that expose fingerprinting surfaces and restricts access to certain APIs entirely.
Chrome and its Privacy Sandbox initiative is a different story. Chrome’s approach has largely focused on replacing third-party cookies with alternative ad targeting systems — Topics API, Protected Audience — rather than addressing fingerprinting as a fundamental threat. Critics have argued that Google, as both a browser vendor and the largest ad tech company in the world, has a structural conflict of interest here. Chrome has added some fingerprinting mitigations but has not taken the aggressive approach that Brave or Firefox with resistFingerprinting have.
Tor Browser goes furthest. It standardizes everything: a fixed screen size, identical fonts across all users, the same user-agent string, and caps on all APIs that could expose hardware-level variation. Every Tor Browser installation looks essentially identical. This is the maximum anti-fingerprinting stance, and it comes with real costs. Some sites don’t work, the user experience is noticeably constrained, and performance is slower because all traffic routes through the Tor network.
What actually works — and what doesn’t
This is where the advice gets more specific than “use a VPN” or “browse incognito.”
Incognito mode does not help with fingerprinting. Incognito stops your browser from saving cookies and history locally after the session ends. It does not change your screen resolution, your GPU, your installed fonts, or any of the signals that fingerprinting uses. Your fingerprint in an incognito window is the same as your fingerprint in a normal window. The tracking companies see no difference.
Most VPNs do not help with fingerprinting. A VPN hides your IP address from the sites you visit — they see the VPN server’s IP instead of yours. This limits IP-based tracking and prevents your ISP from seeing your traffic. But fingerprinting doesn’t rely on your IP address. Your canvas hash, WebGL renderer, and screen configuration are the same regardless of which VPN server your traffic routes through. Adding a VPN does nothing to your fingerprint.
Cookie blockers alone do not help. Extensions that block third-party cookies are effective at one thing: blocking third-party cookies. Fingerprinting is not a cookie. It doesn’t fall under cookie blocking.
Brave Browser genuinely helps. Its randomization approach — per-session, per-site noise added to canvas, audio, and WebGL fingerprinting surfaces — makes fingerprint matching unreliable across sites and sessions. This is among the most effective anti-fingerprinting approaches available in a browser that doesn’t significantly break the normal web experience.
Firefox with privacy.resistFingerprinting = true genuinely helps. Set it in about:config. The main cost is that a small number of sites will display incorrectly because they receive a spoofed screen resolution. Most sites work fine.
Tor Browser completely works, at the cost of usability and speed. For high-stakes situations where fingerprinting resistance matters more than convenience, it’s the right tool.
Test your own fingerprint
Before deciding how much any of this matters to you, go look at what your browser is leaking right now.
coveryourtracks.eff.org is run by the Electronic Frontier Foundation. Visit it with your current browser. It tests your fingerprint and tells you three things. Whether your browser is unique among the browsers that have tested against it. Whether your browser blocks tracking ads and invisible trackers. And a breakdown of the specific attributes it could collect. The results are specific: you’ll see your exact user-agent string, your screen resolution and color depth, your system timezone, and your list of plugins. You can run it on your regular browser and then on a Brave or Firefox session to compare directly.
AmIUnique.org, a research project from INRIA, runs a similar test and maintains an ongoing dataset of browser fingerprints. It will show you how unique your browser configuration is compared to fingerprints in its database, and break down which attributes are rarest.
browserleaks.com goes deeper into individual APIs — separate tests for WebGL, canvas, audio fingerprinting, WebRTC, fonts, and more. More technical but more comprehensive.
Run the EFF test first. It’s designed for general audiences and gives you a clear verdict. If your browser shows up as unique among even a few thousand tested browsers, you are being fingerprinted reliably and precisely.
The persistence problem
Unlike cookies, there is no “clear fingerprint” button. A cookie is a file stored on your device. Delete it, and the tracking data is gone from your machine. Your fingerprint doesn’t live on your device at all. It lives on servers operated by Fingerprint.com, or inside Lotame’s identity graph, or in whatever third-party data management platform the site operator has contracted with.
So you can switch browsers, clear every cookie and cache, reset your browser to factory settings, or reinstall your operating system. Your fingerprint still reappears the moment you visit a site that’s seen it before. That’s because the fingerprint is a function of your hardware: your GPU, your screen, your CPU. Those don’t change when you clear your browser history.
The only way to change your hardware fingerprint is to change your hardware, or to use a browser that actively spoofs or randomizes those hardware signals.
This is why the browser choice matters. You can’t clean up a fingerprint that’s already been linked to a profile, but you can stop generating a consistent, reliable fingerprint going forward.
What to actually do
This is a sliding scale based on how much fingerprinting bothers you specifically.
If you want meaningful protection without changing your workflow much: switch to Brave Browser for daily use. No configuration required — fingerprinting protection is on by default. Install it, import your bookmarks, and use it the way you were using Chrome. You lose nothing noticeable and gain substantial fingerprint resistance.
If you’re already using Firefox: open a tab to about:config, search for privacy.resistFingerprinting, and toggle it to true. Also set privacy.trackingprotection.fingerprinting.enabled to true. While you’re in Firefox’s privacy settings, switch Enhanced Tracking Protection to Strict mode. Add uBlock Origin from the Firefox extensions store. This combination blocks tracking scripts from loading in the first place, which addresses the subset of fingerprinting that gets loaded via third-party scripts.
If you want to see what’s leaking before deciding what to do: visit coveryourtracks.eff.org in your current browser. Do this first. The results make the abstract concrete. Seeing your specific timezone, screen configuration, and font list laid out as a single traceable profile tends to land differently than reading about it.
If you care about cross-device tracking specifically, be aware of one thing. Using the same browser across devices, or staying logged into Google or Meta accounts across devices, gives companies deterministic links that are stronger than any fingerprint. Fingerprinting fills the gap when you’re not logged in. Logins close the loop. Limit the accounts you stay signed into on browsers you use for general browsing.
For situations requiring maximum privacy — specific research, sensitive communications, anything where tracking represents a genuine risk rather than a commercial inconvenience — use Tor Browser. It’s available at the Tor Project’s website. The browsing experience is slower and some sites will present CAPTCHAs or break partially, but your fingerprint will be effectively indistinguishable from every other Tor Browser user.
One thing that won’t help: privacy-branded browser extensions that you’ve never heard of. The extensions market includes tools that are themselves data harvesters, or that do approximately what they claim while also transmitting your browsing history somewhere. Stick to uBlock Origin, the EFF’s Privacy Badger, or the built-in protections of Brave and Firefox. Avoid any extension that asks for broad permissions and comes from an unknown publisher.
The hotel laptop scenario at the start of this article is real. Fingerprinting infrastructure is widespread enough and accurate enough that cross-device recognition without any shared login is routine. There is a gap between believing you’ve protected your privacy and actually having done so. In many cases, it’s the gap between “cleared my cookies” and “using a browser that actively spoofs its hardware signals.”
Clearing cookies is table stakes. It was table stakes ten years ago. Fingerprinting moved past it a long time ago, and the companies operating at scale have been exploiting that gap ever since. To also cut the third-party scripts that carry fingerprinting into a page, see our guide to tracker blocking.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.