Browser fingerprinting: how websites recognize you without cookies

You can clear your cookies, open a private window and decline every banner, and a website may still know it’s you. The technique is called browser fingerprinting, and we think it’s one of the most unfair ways to track people online. Not because it’s clever, but because it takes away the one thing cookies at least left you: a way to say no.

This post explains how it works, who uses it, and what you can realistically do about it.

What a browser fingerprint is

A cookie is a small file a site stores in your browser. You can see it, block it and delete it, and in many places sites have to ask before setting one for advertising.

A fingerprint stores nothing on your device. Instead, a script reads details your browser already exposes (your screen size, time zone, fonts, graphics chip and dozens more) and combines them into an identifier. The UK Information Commissioner’s Office describes it as collecting “pieces of information about a device’s software or hardware, which, when combined, can uniquely identify a particular device and user.”

That difference is the whole problem:

• There’s nothing to delete. Clearing cookies doesn’t change your fonts or your graphics card. EFF compares cookies to a tag that falls off, and fingerprints to recognizing a car by its make, model, colour and licence plate: “harder to change and impossible to delete.”
• Private browsing doesn’t stop it. Private and incognito modes keep history off your own computer. They were never designed to hide you from the sites you visit. Mozilla says fingerprinting can “track you for months, even when you use any browser’s private browsing mode.”
• There’s no banner and no permission prompt. As researcher Pierre Laperdrix put it on the Tor Project’s blog, any script on a page “can silently build a fingerprint of your device without you even knowing about it.”

Even Google once agreed. In 2019 it wrote that “users cannot clear their fingerprint” and so can’t control how their information is collected: “We think this subverts user choice and is wrong.” (More on what Google did next below.)

What goes into a fingerprint

None of these details is secret, and most exist for good reasons. A video call needs to know your camera exists; a calendar needs your time zone. The trouble is that any script can read them, for any reason.

Three of these deserve a closer look, because they’re the ones people find hardest to believe.

Canvas, WebGL and audio don’t ask your browser what it is. They ask it to do something, then measure the result. Researchers showed in 2012 that canvas drawings differ between machines in consistent ways, and the Princeton team behind a 1-million-site study in 2016 found the audio version being used in the wild. Because the differences come from your hardware and drivers, changing browser settings doesn’t remove them.

Network-level fingerprints happen before any page loads. When your browser opens a secure connection, the exact way it says hello (which encryption options it offers, in what order) forms a pattern. Methods called JA3 and its successor JA4 turn that pattern into a short code, and the settings a browser sends over HTTP/2 can be fingerprinted the same way. To be fair about it: on their own, these mostly reveal what software you’re using, not who you are, and they’re a staple of bot detection. But they work even with JavaScript turned off, and they add to the pile.

How small details add up to you

Each detail on its own is shared by millions of people. Lots of people use Windows. Lots of people are in Mountain time. Far fewer use Windows, in Mountain time, with French as their second language, a particular graphics chip and one unusual font from a design app.

Researchers measure this in bits of entropy. Each bit halves the crowd you could be hiding in. Ten bits narrows you to about one in a thousand; 20 bits, about one in a million. Around 33 bits is enough, in theory, to pick out one person among the roughly eight billion on Earth.

What the research found:

• EFF’s original Panopticlick study in 2010 found 83.6% of 470,161 browsers had a unique fingerprint, with at least 18.1 bits of entropy.
• The AmIUnique study, published in 2016, found 89.4% of 118,934 fingerprints were unique, and showed canvas was one of the most telling signals.
• Both studies used volunteers who visited a privacy test site, so the authors cautioned that their data leaned towards privacy-minded people. A 2018 follow-up on over two million visitors to a major French website found a much lower figure: 33.6% unique. It also found that the non-unique fingerprints were fragile: change a feature or two and they often became unique.

Fingerprints also change, as browsers update. But that’s less protection than it sounds. Eckersley found a simple rule could guess which new fingerprint belonged to a returning browser correctly 99.1% of the time, and later research showed changing fingerprints can be linked for months. Trackers also rarely use a fingerprint alone. Combined with your IP address, it gets much sharper.

So the honest summary is: not everyone is unique, but a lot of people are, and you can’t easily tell which group you’re in.

From a device to a person

A fingerprint identifies a browser, not a name. It becomes you when it’s linked to something that is.

• Sign-ins and forms. The moment you log in, buy something or type your email into a newsletter box, the device and the identity meet. A 2022 study of the top 100,000 websites found trackers collecting email addresses from forms before people pressed submit, on 1,844 sites when crawling from the EU and 2,950 from the US.
• Bringing cookies back. When you clear cookies, a fingerprint can tell a tracker the “new” visitor is the old one, so it can relink your history. Researchers note that fingerprints can be used to regenerate or de-duplicate cookies, and found about one in six fingerprinting vendors also syncing cookies with other ad-tech companies.
• Across your devices. The US Federal Trade Commission’s report on cross-device tracking describes companies matching phones, laptops and TVs either through shared logins or by inference from signals like shared IP addresses, browsing patterns and device fingerprints.
• Into data broker profiles. In a 2014 study of nine data brokers, the FTC found they “combine online and offline data to market to consumers online”: things like store purchases and magazine subscriptions, matched to the identifiers that follow people around the web.

None of this needs a fingerprint to be perfect. It only needs to be good enough to join one database to another.

Who uses it

Fingerprinting is not rare. A study published in 2021, using 2019 crawl data, found fingerprinting scripts on 10.18% of the top 100,000 websites and 30.6% of the top 1,000. News sites had the most. The most common vendors included ad-verification and anti-fraud companies, alongside services that also take part in cross-site tracking.

Then, in December 2024, Google told advertisers that from February 16, 2025 it would no longer ban fingerprinting in its ad products. The ICO called the change “irresponsible” and warned that fingerprinting “could now replace the functions of third-party cookies.” It said businesses must still get consent where the law requires it, and that for advertising, meeting the law is “a high bar.”

The fraud argument, honestly

Fingerprinting has a real defensive use, and it’s fair to say so. Banks use device signals to notice a login from an unfamiliar machine. Ticket sellers and shops use them to spot bots. Anti-fraud vendors use them to catch fake ad clicks. Some of that protects you.

But using a device check to protect your bank login is very different from using the same technique to follow you from site to site so you can be profiled and sold ads. One happens at a moment you can see, for a purpose you’d agree to. The other happens everywhere, invisibly, with no way to decline.

Regulators have drawn the same line. Canada’s privacy commissioner says that if people can’t decline a tracking technology, it shouldn’t be used for behavioural advertising at all, and names device fingerprinting as an example. We agree. Security is not a blank cheque for surveillance.

What you can do

You can’t make fingerprinting impossible. You can make it a lot less useful.

Use a browser that fights it for you

Built-in protection beats anything you bolt on, because it’s shared by many people and tested against real trackers.

• Tor Browser is the strongest option. It tries to make every user look the same: it standardizes the user agent, limits fonts, and rounds the window to set sizes (“letterboxing”) so your screen doesn’t give you away. It also routes your traffic through the Tor network, which hides your IP address. The tradeoff is speed, and some sites block or challenge Tor users.
• Brave takes the opposite approach by default. It adds small random noise (“farbling”) to values like canvas and audio output, with a different seed for each site and each session, so the same browser looks different to every site and changes again after a restart.
• Firefox blocks known fingerprinters through Enhanced Tracking Protection. Firefox 145 (November 2025) added broader protections, starting in private windows and Strict mode, that Mozilla says cut the share of users who look unique by almost half. There’s also a stricter, hidden setting called privacy.resistFingerprinting, which brings in protections developed for Tor Browser. Expect it to break things: as Mozilla points out, calendars and video-call tools legitimately need your real time zone, and stricter protections get in their way. It’s only for people prepared to deal with that.
• Safari 26 now stops known fingerprinting scripts from reliably reading things like screen size, processor cores, audio and canvas output.

Blend in, or keep changing

There are two strategies, and it helps to know which one you’re using.

• Blend in (Tor Browser): look exactly like everyone else using the same browser, so there’s no way to tell you apart. It works best when lots of people share the same settings, which is why Tor Browser doesn’t let you choose which operating system you appear to run.
• Randomize (Brave): look different every time, so today’s fingerprint can’t be matched to yesterday’s. A fingerprint that never repeats is useless for tracking, even if it’s unique.

Both are reasonable. What doesn’t work is a halfway mix you build yourself.

Don’t pile on extensions

It’s tempting to install every privacy add-on you find. But extensions change how your browser behaves, and those changes can be detected. EFF warns that your protections can make you a “mystery user with a very specific combination of privacy protections installed.” An extension that fakes your user agent but forgets another setting creates a combination that doesn’t exist anywhere else, which makes you easier to spot.

One or two well-known tools are fine. A good tracker blocker, like EFF’s Privacy Badger or the one built into your browser, stops many fingerprinting scripts from loading in the first place, which helps more than trying to disguise what they’d see.

Test yourself

EFF’s Cover Your Tracks shows how your browser looks to trackers: whether it’s blocking them, and whether your fingerprint is unique, randomized or shared with many others. Two tips for reading the results:

• “Unique” on a test site isn’t a verdict on your whole life online. It compares you with that site’s visitors.
• With Brave, a “randomized” result is the goal. With Tor Browser, the goal is to look like other Tor Browser users.

Know the limits

Nothing here is perfect. Your IP address, network-level fingerprints, and any account you sign in to can still link your visits. The W3C’s own guidance for people designing web standards says completely eliminating fingerprinting by technical means alone is “implausible.” The point isn’t to become invisible. It’s to stop being cheap and easy to follow.

How Frame fits in

Frame doesn’t block fingerprinting. That’s your browser’s job, and the browsers above do it far better than any service could.

Where Frame helps is the other end of the pipeline: the people-search sites and data brokers where tracking data and real identities end up together. Frame looks for your listings on people-search sites and helps you send removal requests you approve, so there’s less of you out there to match a device against.

Why it matters, and what should change

Cookies were never great for privacy, but they came with controls: you could see them, block them and delete them, and laws could require consent. Fingerprinting removes all of that. If it replaces cookies for advertising, we’ll have quietly traded a tracking system people can partly control for one they can’t.

It doesn’t have to go that way. Here’s what we think should happen:

• Regulators should treat fingerprinting for ads as off-limits without real consent, and enforce it. The ICO and Canada’s privacy commissioner have already said the law applies. The next step is acting on it.
• Browser makers should keep shrinking what sites can read, following the W3C’s guidance to expose only what a feature actually needs, and turn protections on by default rather than hiding them in private modes.
• Google should reverse its 2025 policy. Its own 2019 words were right: fingerprinting “subverts user choice and is wrong.”
• Security uses should stay security uses. Device signals collected to stop fraud shouldn’t be reused for advertising or sold on.

Until then, a good browser and a few habits go a long way. You don’t need to be invisible. You just need to be harder to follow than it’s worth.

Sources

• Information Commissioner’s Office (UK), Our response to Google’s policy change on fingerprinting, December 19, 2024
• Office of the Privacy Commissioner of Canada, Guidelines on privacy and online behavioural advertising
• Google, Building a more private web, August 2019
• Electronic Frontier Foundation, Cover Your Tracks and How do trackers work?
• Peter Eckersley (EFF), How Unique Is Your Web Browser?, Privacy Enhancing Technologies Symposium, 2010
• Pierre Laperdrix, Walter Rudametkin and Benoit Baudry, Beauty and the Beast: Diverting modern web browsers to build unique browser fingerprints (the AmIUnique study), IEEE Symposium on Security and Privacy, 2016
• Alejandro Gómez-Boix, Pierre Laperdrix and Benoit Baudry, Hiding in the Crowd: an Analysis of the Effectiveness of Browser Fingerprinting at Large Scale, The Web Conference, 2018
• Antoine Vastel et al., FP-STALKER: Tracking Browser Fingerprint Evolutions, IEEE Symposium on Security and Privacy, 2018
• Umar Iqbal, Steven Englehardt and Zubair Shafiq, Fingerprinting the Fingerprinters: Learning to Detect Browser Fingerprinting Behaviors, IEEE Symposium on Security and Privacy, 2021
• Steven Englehardt and Arvind Narayanan, Online Tracking: A 1-million-site Measurement and Analysis, ACM CCS, 2016
• Keaton Mowery and Hovav Shacham, Pixel Perfect: Fingerprinting Canvas in HTML5, W2SP, 2012
• Łukasz Olejnik, Steven Englehardt and Arvind Narayanan, Battery Status Not Included: Assessing Privacy in Web Standards, IWPE, 2017
• Asuman Senol et al., Leaky Forms: A Study of Email and Password Exfiltration Before Form Submission, USENIX Security, 2022
• Federal Trade Commission, Cross-Device Tracking: An FTC Staff Report, January 2017
• Federal Trade Commission, Data Brokers: A Call for Transparency and Accountability, May 2014
• W3C Privacy Working Group, Mitigating Browser Fingerprinting in Web Specifications, September 2025
• Mozilla, Firefox expands fingerprint protections, November 10, 2025, and Browser fingerprinting protection in Firefox
• The Tor Project, How Tor Browser protects you against browser fingerprinting, and Pierre Laperdrix, Browser Fingerprinting: An Introduction and the Challenges Ahead, September 4, 2019
• Brave, Fingerprinting Protections and Fingerprinting defenses 2.0
• WebKit, WebKit Features in Safari 26.0
• MDN, User-Agent Client Hints API
• John Althouse (Salesforce), Open Sourcing JA3, 2017, and FoxIO, JA4+ network fingerprinting
• Elad Shuster (Akamai), Passive Fingerprinting of HTTP/2 Clients, Black Hat Europe, 2017