Protect

Browser fingerprinting is a way of recognising you across websites without ever storing anything on your device. Instead of dropping a cookie, a site reads the configuration your browser reveals to it and builds an identifier out of the combination. The Electronic Frontier Foundation describes it as a method of tracking web browsers by the configuration and settings information they make visible to websites, rather than by traditional means such as IP addresses and cookies.

The individual pieces sound harmless, and on their own they are. Your browser and operating system version. Your screen resolution and colour depth. Your timezone and language. The fonts you have installed. Whether you have a touchscreen. How your machine draws a hidden image, which produces a canvas or WebGL hash. Whether you accept cookies, and even whether you send a Do Not Track header.

The power comes from combination. Millions of people share your browser version. Far fewer share your browser version and your exact screen size. Fewer still share those plus your font list and your timezone. Stack enough of these together and the result can single out one machine among millions, which is why the technique works at all.

Here is the part that surprises people, and it is the reason this matters more than another tracking article. Clearing your cookies does not help. The EFF puts it plainly: deleting your cookies will not help, because it is the characteristics of your browser configuration that are being analysed. There is nothing to delete. The fingerprint is not stored on your machine, it is recalculated every time you arrive.

This is also why private browsing does less than its name suggests. Incognito mode clears history and cookies from your device when you close the window. It does not change your screen resolution, your fonts or the way your graphics card renders an image, so the fingerprint you present is largely the same one you presented before. Private browsing hides your trail from other people using your computer, not from the sites you visit.

The uncomfortable consequence is that some privacy measures can make you easier to identify rather than harder. A rare browser, an unusual font set, a long list of extensions or an uncommon screen size all make you stand out. Blending in works better than standing out, which is an awkward trade-off when the instinct is to customise everything.

It is worth being honest about how hard this is to solve. The EFF calls fingerprinting both difficult to detect and extremely difficult to thwart, and says of the available defences that none of them are ideal. Anyone promising to make you unfingerprintable with a single setting is overselling it.

That said, the situation is not hopeless, and the realistic options are worth knowing. Tor Browser takes the blending-in approach seriously: it aims to make its users look alike, which is a different strategy from making each user unique. Some mainstream browsers now include fingerprinting protections of varying strength. Tracker-blocking extensions reduce how many parties get to run the measurement in the first place.

You can also simply look at your own result. The EFF runs a free tool, Cover Your Tracks, which tests your browser and tells you how identifiable it is. It is the fastest way to turn an abstract worry into a concrete number for your specific setup, and it costs nothing.

The bottom line is a change of mental model rather than a checklist. Tracking is not only about what a site stores on your device. It is also about what your device tells every site, automatically, before you click anything. Understanding that makes the limits of cookie banners and private windows much easier to see.