Tracked Without Cookies? What is Browser Fingerprinting and How to Reduce It

what is browser fingerprinting and how to reduce it?

Browser fingerprinting is a technology that allows the website to track you down even without the use of cookies. Browser fingerprints are made up of tens of information such as the fonts installed on your computer, screen resolution, output of your graphic card, and JavaScript behaviors that are used to identify a user uniquely. These fingerprints are much more persistent than the cookies, do not get wiped out when a person uses an incognito window or deletes his/her browsing history. Most likely, users have never heard about this practice before.

Clear your cookies. Turn off incognito window. Use a virtual private network. Everything done correctly – but still, the ads are following you everywhere. The website still recognizes you despite the absence of logging-in. How is it possible that the shoes you viewed some time ago keep appearing in your news feed?

That is all because of browser fingerprinting – and what is even worse, your own browser gives away most of this information voluntarily through its built-in features.

The article explains all the settings and browser features that contribute to your unique browser fingerprint, and also reveals how the advertisers use it against you and how you can effectively manipulate your fingerprint without the need for any knowledge in computer science.

---

What Makes Browser Fingerprinting Different From Cookie Tracking

All the attention is on cookies. Banners are built around consent for them. Laws have been drafted about them. They are being phased out by browsers. However, fingerprinting is a completely different ball game and is immune to many of the protections we just discussed.

When a website uses a cookie to track you, it leaves a tiny file in your device. Deleting the file deletes the tracking too. However, fingerprinting does not leave anything behind in your device. The tracking script sends a few questions to your browser. Your browser responds to all of them honestly since that is precisely how it was designed.

The answer from your browser is hashed along with a number of other parameters such as your screen size, fonts, GPU render behavior and time zone. This hash forms an identifier. This identifier is stored in the tracker’s server and not your computer. It cannot be deleted since it never existed in your device in the first place.

According to research by the Electronic Frontier Foundation’s Cover Your Tracks project, over 83% of browsers have a fingerprint that is unique or nearly unique among the millions tested. That number is higher for desktop users with installed fonts and graphics cards.

Understanding this tracking method is actually one of the first things covered in a complete browser privacy guide — because most of the common advice (clear cookies, use incognito) simply doesn’t address it.

---

The 7 Default Browser Features That Build Your Fingerprint

Here is the shocker: all of these attributes have been developed for no tracking purposes at all. They were actually developed for some very good reasons such as ease of access, better performance, and compatibility. The trackers take advantage of them quite effectively.

1. JavaScript Engine Behavior

All major websites work with JavaScript. As it is enabled by default, and otherwise most websites wouldn’t be functioning, fingerprinting software could use scripts to examine how the JavaScript engine of your particular browser performs various calculations. The thing is that all browsers perform differently, not only different from each other but even the same browser in different versions does. So these calculations are performed in different ways, which makes it possible to distinguish them.

From a broader perspective, it is JavaScript which allows trackers to get information about your environment: the browser vendor and version, the number of logical cores of your CPU, memory, plug-ins, navigator properties – the list goes on and on. And the function navigator.userAgent returns everything to a tracker just in one JavaScript call.

2. Installed Fonts

This one will really take you by surprise. You come with your own set of fonts because you have the operating system on which they come pre-installed. However, over the course of several years you download more and more software such as Adobe, Microsoft Office etc.

Fingerprinting scripts enumerate your fonts by attempting to render text in different typefaces and measuring the resulting dimensions. Fonts that don’t exist fall back to a default size. Fonts that do exist render slightly differently. The resulting pattern of “present / absent” across hundreds of font names creates a stable, high-entropy signal. Research published by BrowserLeaks shows that font enumeration alone can narrow down a browser to a very small group.

3. Canvas API

Canvas is an API for drawing graphics within a web page using HTML5. Originally designed for data visualization, games, and graphics manipulation, it became one of the most versatile fingerprinting surfaces.

Here’s how it functions: the script generates a hidden picture – usually several lines of text in a particular font on a colored background with some geometrical shapes drawn. Then your browser renders the picture. Your GPU, graphics drivers, operating system, antialiasing settings, and even the browser itself affect how the pixels will look like. Next, the script reads the pixel values and produces a hash from those values. That hash is always unique and does not vary during the session. Erasing the cookies makes no difference here.

Canvas fingerprinting was first documented academically in 2012, and it’s now one of the most widely deployed fingerprinting techniques across the web. The W3C HTML5 specification for Canvas makes no mention of privacy protections, because the API was never designed with tracking in mind.

4. WebGL Fingerprinting

WebGL (Web Graphics Library) enables a browser to draw 3D graphics based on the GPU of your computer. It was developed to enable games and interactive graphics within a browser. Also, it reveals the specific model of GPU used, its graphics driver version and hardware-level rendering features without needing any special permission.

The WebGL fingerprint is generated by rendering a scene and capturing the output. Since GPU hardware draws in unique hardware-specific ways, the output will be different even if the input is the same if the GPUs differ. The GPU vendor and renderer strings themselves, which can be obtained from WEBGL_debug_renderer_info, make up a significant hardware fingerprint already.

In combination with Canvas fingerprint, WebGL makes up an exceptionally stable hardware-level fingerprint.

5. Browser Plugins and Extensions

The extensions and plugins loaded in your browser add to the fingerprinting puzzle as well. The exact combination of certain extensions – for example, a password manager, a certain video downloader, an accessibility feature, and uBlock Origin – may be unique enough on its own to generate a distinct fingerprint. In an ironic twist, privacy extensions may even help create a unique fingerprint if the combination of extensions used is uncommon.

Older browsers had the problem of allowing JavaScript access to all the information about your installed plugins. Modern browsers have improved the situation somewhat, although not entirely, and the extensions may be detected indirectly through their activity.

6. Screen Resolution and Hardware Details

Your screen resolution, color depth, pixel ratio, screen size (excluding taskbars), and the number of monitors that you have connected, all these parameters can be obtained by any script executing on your page. None of these parameters will provide unique identification individually, but taken into account together with everything else, they are providing extra entropy.

Device pixel ratio, for example, is especially important since on a monitor with high DPI (such as Retina displays produced by Apple), this parameter is usually more than 2, while on conventional monitors this ratio is 1.

7. Timezone, Language, and System Settings

Your browser sends data about the time zone that you are in (according to your operating system), your system language, your preferred languages for websites, your preferred date and number format, and the status of some browser functionality (cookies, local storage, session storage).

Even just the time zone is a good identifier – there aren’t many time zones, and when combined with language, the number of potential users is limited dramatically. A user browsing on a browser that is set in Arabic, in a time zone with an offset of +3, and has a Windows locale, is a much more unique user than one browsing in Chrome on English in UTC.

How Unique Is Your Fingerprint Right Now?

The best way to understand this isn’t to read about it — it’s to see it. The EFF’s Cover Your Tracks tool analyzes your browser fingerprint and tells you how unique it is compared to the millions of browsers in their database. Most people who run it are genuinely surprised by the result.

You can also visit BrowserLeaks.com for a detailed breakdown of every signal your browser is leaking — Canvas, WebGL, fonts, JavaScript properties, and more. Running it once is a more effective privacy education than reading ten articles.

---

Fingerprinting vs. Cookie Tracking: A Side-by-Side Comparison

Feature	Cookie Tracking	Browser Fingerprinting
Where data is stored	Your device (deletable)	Tracker’s server (not deletable)
Survives incognito mode	No — incognito blocks cookies	Yes — hardware doesn’t change
Cleared by history deletion	Yes	No
Blocked by cookie banners	Yes, if you reject non-essential	No — consent isn’t required
Requires JavaScript	No	Usually yes (some methods use CSS)
Changes over time	Every time cookies are cleared	Only when hardware or software changes
Legal gray area	Regulated under GDPR / CCPA	Largely unregulated in most countries
Affected by VPN	No	No (changes IP, not fingerprint)

This table makes one thing clear: the tools most people use to protect their privacy online — cookie deletion, incognito mode, VPNs — have essentially zero effect on fingerprinting. This is worth sitting with for a moment. If you want to understand the full picture of what your browser is leaking, this breakdown of what your browser knows about you covers the wider context beyond fingerprinting.

---

Who Actually Uses Browser Fingerprinting?

Not just advertisers. The real answer is more varied — and more nuanced — than most people expect.

Advertising and Data Brokers

This is the most common use. Ad networks use fingerprinting to maintain persistent identifiers for users who delete cookies or block them. When you clear your cookies and the ad for that hotel you looked at three weeks ago reappears the next day, fingerprinting is the likely explanation. This connects directly to how ad-targeting algorithms build profiles from behavioral data — fingerprinting is one of several persistent signals in that pipeline.

Fraud Prevention

Banks and payment gateways use fingerprinting for legitimate purposes when they try to find out any irregularity in activities. For example, if your account has been accessed only through a Windows computer in London until now and a login happens via a Linux computer in another country, fingerprinting will identify this discrepancy.

Paywall Bypass Detection

News websites that have metered paywalls (where you can access a certain number of articles for free before being prompted to subscribe) use something called fingerprinting to monitor how many articles you have viewed even after you delete cookies. You might have often thought why deleting cookies does not set your article count back to zero.

Government and Surveillance

Browser fingerprinting has been documented in use by government surveillance tools. The Electronic Frontier Foundation has documented cases where law enforcement and intelligence agencies use fingerprinting-based tools to track individuals across sessions without needing to compromise their devices directly.

---

The Pros and Cons of Browser Fingerprinting

✅ Legitimate Uses (Arguments For)

• Fraud detection: Banks and e-commerce platforms genuinely benefit from identifying suspicious device changes without relying on deletable cookies.
• Account security: Detecting logins from unrecognized devices is a legitimate security use case, similar to 2FA context checks.
• Analytics without personal data: Some developers use lightweight fingerprinting purely for anonymous usage analytics without building advertising profiles.
• Bot detection: Cloudflare and similar services use fingerprinting to distinguish real browsers from automated scrapers and credential-stuffing bots.

❌ Privacy Violations (Arguments Against)

• No consent required: Unlike cookies, fingerprinting doesn’t need your permission under most current laws. There is no opt-out button.
• Impossible to escape passively: You cannot “clear” a fingerprint. Every normal browser usage generates one.
• Enables persistent cross-site tracking: The same profile that fraud detection uses for security, advertisers use for surveillance.
• Legal ambiguity gives cover to bad actors: The lack of clear regulation means the same technique used responsibly by a bank is used irresponsibly by a data broker with no accountability.
• Privacy tools can backfire: Installing privacy extensions may paradoxically make your fingerprint more unique, not less — if your exact combination of tools is rare.

---

How to Reduce Your Browser Fingerprint (Practical Steps)

To start off with an obvious statement, you can never completely remove your fingerprint from the browser. It would be impossible to do that because even a browser capable of displaying current web pages will give away some sort of information about itself.

1. Switch to Brave Browser

Brave is the one with the most robust fingerprinting protection among mainstream browsers. The fingerprints produced by Canvas, WebGL, Audio, and font enumeration are randomized in each session. As a result, each time you open the browser, it will be as if you are someone else because there will be differences in your fingerprints. This will ensure that you cannot be persistently tracked. Unlike in the case of Firefox, you do not have to configure anything for this in Brave.

2. Use Firefox With Resist Fingerprinting Enabled

There is an option in Firefox that can be found under about:config called privacy.resistFingerprinting that standardizes a lot of fingerprinting properties. The user gets reported a consistent screen size, canvas data is blocked, a uniform timezone is provided, and font enumeration is reduced. Adding to this uBlock Origin for blocking fingerprinting scripts and making them not even run, Firefox becomes a very powerful anti-fingerprinting browser.

It should be mentioned that some websites will act strangely when Resist Fingerprinting is enabled; in most cases, this is caused by the fact that it lies about the user’s screen size.

3. Install uBlock Origin and Enable Fingerprinting Filters

Though you might not be able to disable fingerprinting in the browser settings, it’s possible to block scripts that would launch such activities. With uBlock Origin using “AdGuard Tracking Protection” and “Peter Lowe’s Tracking Servers,” you will be able to prevent access to lots of fingerprinting servers. Without an access to the server, no fingerprinting can take place.

4. Do Not Use Chrome for Sensitive Browsing

There are no means of fingerprinting prevention in Chrome. The browser returns accurate data on the canvas, all information about WebGL renderer string, precise information about the screen size and font list. There is nothing commercially beneficial for Google in adding the feature, because its business model is based precisely on this sort of identification. This is not some out-of-the-box view on the matter; this is how the system works.

5. Minimize Installed Fonts

Less use of non-standard fonts will result in a less distinctive font fingerprint. It is not necessary to remove all programs, but you should note that any third-party program that loads fonts into your system (such as Adobe and Microsoft Office) is increasing the size of your fingerprint.

6. Use Tor Browser for Maximum Protection

Tor Browser is deliberately engineered so that all users have the same fingerprint. It normalizes screen resolution, eliminates JavaScript that gives away hardware information, uses only certain fonts, and uses relays that hide your IP address. The downside is that the performance suffers and many websites are incompatible since they block all Tor exit nodes. However, it’s the most secure way to browse when it really matters.

7. Review Your Default Phone Settings, Too

Mobile browsers fingerprint just as aggressively as desktop browsers — and mobile devices leak additional signals like battery level, accelerometer behavior, and screen touch pressure. Combined with the tracking risks that exist at the operating system level, several phone settings that ship turned on by default compound the fingerprinting exposure significantly.

---

Browser Fingerprinting Protection: Tool Comparison

Tool / Browser	Fingerprint Protection	Method Used	Breaks Websites?	Best For
Brave	🟢 Strong	Randomization per session	Rarely	Most users — strong defaults, no config
Firefox + RFP	🟢 Strong	Normalization (lies to trackers)	Occasionally	Users comfortable with about:config
Tor Browser	🟢 Maximum	Full standardization + routing	Often	High-risk, high-sensitivity use cases
Safari (iOS/macOS)	🟡 Partial	ITP + limited canvas noise	Rarely	Apple users who want improvement over Chrome
Chrome	🔴 None	None built-in	Never	Not recommended for privacy
uBlock Origin	🟡 Partial	Script blocking	Occasionally	Add-on layer to any browser

---

What About VPNs — Do They Help With Fingerprinting?

This is probably the most common misconception in online privacy. A VPN hides your IP address and encrypts your traffic from your internet service provider. It does exactly nothing for browser fingerprinting.

Your Canvas output, your fonts, your GPU renderer string — none of these change when you connect to a VPN. A tracking script running on a page you visit while connected to a VPN will generate the exact same fingerprint as it would without the VPN. You’re just generating that fingerprint from a different IP address.

That said, VPNs are still valuable for other reasons — hiding your traffic from your ISP, protecting yourself on public networks, and reducing location-based profiling. But they’re a different tool solving a different problem. If you’ve been relying on a VPN as your primary privacy protection, it’s worth reading about the VPN privacy myths most people still believe — several of them directly relate to this kind of misunderstanding. And if public Wi-Fi is part of your concern, the specific risks of public Wi-Fi networks are quite different from fingerprinting threats.

---

🏆 Final Verdict

Browser fingerprinting is not a fringe concern for security researchers. It’s an active, deployed tracking technology used on millions of websites right now, and your browser’s default settings make you easy to identify.

The good news: reducing your fingerprint is genuinely possible without giving up normal web browsing. Switch to Brave or Firefox with Resist Fingerprinting enabled. Install uBlock Origin. Stop treating incognito mode as a privacy shield — it isn’t one, at least not against this.

The uncomfortable truth: even with all of these protections, a determined tracker with access to multiple data signals can still narrow down your identity. The goal isn’t to become invisible. It’s to stop being the easiest target in the room.

Fingerprint protection rating without changes: 1/10.
Fingerprint protection rating with Brave + uBlock Origin: 7/10.
The gap is an afternoon of setup.

---

❓ Frequently Asked Questions

Does incognito mode prevent browser fingerprinting?

No. Incognito mode prevents your browser from saving local history, cookies, and form data — but it has no effect on the hardware and software signals that make up your fingerprint. Your GPU, screen resolution, fonts, and Canvas output are identical in incognito mode to regular browsing. Trackers that rely on fingerprinting don’t notice the difference.

Is browser fingerprinting legal?

In most jurisdictions, yes — and that’s the problem. Unlike cookies, which require consent under GDPR and similar laws in the EU, fingerprinting doesn’t store data on your device, so it falls into a legal gray area. The GDPR’s guidance on tracking suggests that fingerprinting may require consent when used for advertising, but enforcement has been inconsistent. In the US, there is currently no federal law specifically regulating it.

Can websites fingerprint me if I have JavaScript disabled?

Some fingerprinting methods don’t require JavaScript — CSS-based font detection and certain HTTP header analysis can build partial fingerprints without JavaScript. However, disabling JavaScript blocks the most powerful fingerprinting APIs (Canvas, WebGL, AudioContext) and significantly reduces the entropy available. The tradeoff is that almost no modern website functions correctly without JavaScript.

Does using a different browser on the same computer help?

Partially. Your fonts, screen resolution, and timezone are likely the same across browsers on the same machine. But your Canvas and WebGL fingerprints may differ slightly between Chrome and Firefox due to rendering differences, and your installed extensions will differ. Using different browsers for different purposes (banking vs. casual browsing) is a reasonable compartmentalization strategy, even if it’s not a complete solution.

Will browser fingerprinting work on my phone?

Yes, and mobile devices actually add more fingerprinting signals: accelerometer data, battery level, screen touch pressure, and hardware-specific GPU characteristics. Mobile browsers generally offer less fingerprinting protection than desktop equivalents. Brave on Android offers the strongest mobile protection currently available.

How does fingerprinting relate to the ads I see?

Fingerprinting is one input into the same advertising profile pipeline described in detail in our article on how ad-targeting algorithms actually work. When cookies are unavailable (blocked, deleted, or in a cookieless environment), ad networks fall back to fingerprinting to maintain a persistent identifier that links your browsing history across sessions and sites.

Does Tor Browser completely eliminate fingerprinting?

It gets closer than anything else available. Tor Browser is specifically engineered to make every user present the same fingerprint — identical screen dimensions, identical fonts, disabled hardware APIs, standardized timezone. But “closer than anything else” is not the same as “eliminated.” Behavior-based fingerprinting (mouse movement patterns, typing rhythm, scrolling behavior) can still distinguish users in a Tor Browser population. For most threat models, Tor Browser is overkill — but for the highest-risk use cases, it’s the right tool.

---

External references: EFF Cover Your Tracks, BrowserLeaks.com, Electronic Frontier Foundation Privacy Resources, GDPR Cookie and Tracking Guidance. Internal resources: Complete Browser Privacy Guide, What Your Browser Knows About You, How Ad-Targeting Algorithms Work, Dangerous Default Phone Settings, VPN Privacy Myths, Public Wi-Fi Security Risks.