Browser Fingerprinting: How Websites Track You Without Cookies

The Invisible Tracking You Cannot See

You have probably heard of cookies. You may have even cleared your browser cookies, enabled “Do Not Track,” or installed a cookie-blocking extension. But what if I told you that websites can track you even without cookies — using a technique called browser fingerprinting?

Browser fingerprinting is one of the most sophisticated and least understood tracking methods available. Unlike cookies, which store a unique identifier on your device that you can delete, fingerprinting works by collecting information about your browser, device, and configuration to create a unique “fingerprint” that identifies you across websites.

According to a 2025 study by the Princeton Web Transparency and Accountability Project, over 35% of the top 100,000 websites now use some form of browser fingerprinting. And because there is no cookie to delete, traditional privacy tools do not protect you against it.

This article explains how browser fingerprinting works, what data it collects, and what you can do to resist it.

---

What Is Browser Fingerprinting?

Browser fingerprinting is a technique that identifies your browser by collecting a combination of attributes that, together, create a unique or near-unique profile. Think of it like a fingerprint on your physical hand — no two are exactly alike, and they can be used to identify you without your knowledge or consent.

When you visit a website, the site can automatically collect information about your browser and device through JavaScript, CSS, and other web technologies. This information is then combined into a “fingerprint” — a set of data points that can identify you across different websites and sessions.

How it differs from cookies

Feature	Cookies	Browser Fingerprinting
Storage	Stored on your device	No storage — computed on the fly
User visibility	Visible in browser settings	Invisible to the user
Deletability	Can be cleared easily	Cannot be “deleted”
Persistence	Cleared when expired or deleted	Persists as long as your setup stays the same
Consent required	Varies by jurisdiction	Rarely requested
Tracking accuracy	High (unique ID)	High (unique combination of attributes)
Cross-site tracking	Blocked by third-party cookie blockers	Not affected by cookie blockers

---

How Browser Fingerprinting Works

The core concept

Every browser has a unique combination of characteristics — the browser version, installed fonts, screen resolution, graphics card, time zone, language settings, and dozens of other attributes. When a website collects enough of these attributes, the resulting combination is statistically unique across the global population of internet users.

A 2024 study found that collecting just 33 attributes is sufficient to uniquely identify 99.5% of all browsers tested. Even with common configurations, the combination of multiple attributes creates a fingerprint that is extremely difficult to make identical to someone else’s.

The fingerprinting techniques

Here is a comprehensive overview of the data points websites use for fingerprinting:

Technique	Data Collected	Uniqueness	Detection Difficulty
Canvas fingerprinting	Rendering of hidden canvas elements	Very high	Very difficult
WebGL fingerprinting	Graphics card and driver details	High	Difficult
AudioContext fingerprinting	Audio processing characteristics	High	Difficult
Font enumeration	Installed fonts on your system	High	Moderate
Screen properties	Resolution, color depth, pixel ratio	Medium	Easy to spoof
Browser plugins	Installed plugins and versions	Medium-High	Easy to spoof
Time zone and language	Geographic and language settings	Medium	Easy to spoof
Navigator properties	User agent, platform, hardware concurrency	Medium	Easy to spoof
WebRTC leaks	Local IP addresses	High	Moderate
CSS fingerprinting	Supported CSS features and fonts	Medium-High	Difficult
HTTP header analysis	Headers sent by the browser	Medium	Moderate
JavaScript API enumeration	Available APIs and features	Medium-High	Difficult
Touch support detection	Touch screen capabilities	Medium	Easy to spoof
Battery status API	Battery level and charging status	Low	Easy to block
Media device enumeration	Connected cameras and microphones	High	Moderate

Canvas fingerprinting explained

Canvas fingerprinting is one of the most common and effective fingerprinting techniques. Here is how it works:

1. The website creates a hidden HTML5 Canvas element (not visible to you)
2. JavaScript draws a specific image on the canvas — often text with custom fonts, colors, and effects
3. The rendered image is converted to a data URL (a text-based representation of the image)
4. The data URL is hashed to create a fingerprint value

The key insight is that the same drawing code produces slightly different results on different systems due to differences in:

• Font rendering engines
• Graphics card drivers
• Operating system text smoothing
• Anti-aliasing algorithms
• Sub-pixel rendering

Even two computers with the same browser and operating system may produce different canvas fingerprints if they have different graphics cards or font configurations.

WebGL fingerprinting

WebGL (Web Graphics Library) provides JavaScript access to the device’s graphics hardware. When a website queries WebGL, it can extract:

• Graphics card vendor and model
• Graphics driver version
• Supported extensions
• Shader precision formats
• Rendering capabilities

This information creates a highly unique fingerprint, especially since graphics hardware varies widely across devices.

Font fingerprinting

Websites can enumerate the fonts installed on your system by rendering text in different fonts and measuring the resulting element dimensions. A system with many custom or unusual fonts has a more unique fingerprint than one with a standard font set.

AudioContext fingerprinting

The Web Audio API allows websites to generate audio signals and analyze how the system processes them. Small differences in audio processing across systems create a unique fingerprint, similar to canvas fingerprinting.

---

How Unique Are Browser Fingerprints?

The research

Multiple studies have quantified the uniqueness of browser fingerprints:

• Electronic Frontier Foundation (Panopticlick project): 83.6% of browsers tested had a unique fingerprint
• Leuven University study: 89.6% of browsers could be uniquely identified
• Princeton University (2025): 94.2% of mobile browsers and 91.7% of desktop browsers had unique fingerprints
• Cloakify research: Even after removing the most identifying attributes, 78% of browsers remained unique

What makes fingerprints so unique

The uniqueness of fingerprints comes from the combinatorial explosion of possible attribute combinations. Even if each individual attribute is common (many people use Chrome, many people have 1920x1080 screens), the combination of 20+ attributes becomes statistically unique.

Consider this simplified example:

• Chrome browser: 65% of users
• Windows 11: 72% of users
• 1920x1080 screen: 28% of users
• English language: 25% of users
• US timezone: 18% of users

The probability of this combination is approximately 0.65 × 0.72 × 0.28 × 0.25 × 0.18 = 0.0059, or roughly 1 in 169. Add more attributes and the uniqueness increases dramatically.

---

How to Resist Browser Fingerprinting

Use Firefox with enhanced tracking protection

Firefox is the most effective mainstream browser for resisting fingerprinting. Its Enhanced Tracking Protection blocks known fingerprinting scripts, and its “Ramp” project (Resist Fingerprinting) randomizes or spoofs many fingerprinting attributes.

To enable fingerprinting protection in Firefox:

1. Go to Settings → Privacy & Security
2. Select “Strict” under Enhanced Tracking Protection
3. In about:config, set privacy.resistFingerprinting to true

Use the Tor Browser

The Tor Browser is the gold standard for fingerprinting resistance. It is designed to make all Tor users look identical, which defeats fingerprinting. Every Tor Browser user appears to have the same screen resolution, font set, browser version, and other attributes.

Tradeoffs: Tor is significantly slower than regular browsing and may not work with all websites. It is best suited for high-privacy situations rather than everyday browsing.

Browser comparison for fingerprinting resistance

Feature	Chrome	Firefox	Brave	Tor Browser	Safari
Fingerprinting resistance	Low	Moderate-High	High	Very High	Moderate
Canvas randomization	No	Yes (with RFP)	Yes	Yes	No
WebGL protection	No	Partial	Yes	Yes	Partial
Font randomization	No	Yes (with RFP)	Yes	Yes	No
User agent spoofing	No	Yes (with RFP)	Yes	Yes	No
Timezone spoofing	No	Yes (with RFP)	Yes	Yes	No
Open source	Partial	Yes	Yes	Yes	No

Additional steps to reduce fingerprint uniqueness

1. Use a common browser configuration. The more your setup matches the majority, the less unique your fingerprint. Avoid unusual screen resolutions, rare operating systems, or excessive font installations.

2. Disable JavaScript when possible. Many fingerprinting techniques require JavaScript. Using a script blocker (NoScript, uBlock Origin in hard mode) prevents most fingerprinting. However, this breaks many websites.

3. Use browser extensions that resist fingerprinting. uBlock Origin and Privacy Badger block many fingerprinting scripts. Canvas Blocker (Firefox) specifically targets canvas fingerprinting.

4. Avoid installing unnecessary fonts. The fewer fonts you have installed, the less unique your font fingerprint. Use a standard system font set.

5. Use a standard screen resolution. 1920x1080 is the most common resolution globally. Using it reduces your screen-based fingerprint uniqueness.

6. Disable WebRTC. WebRTC can leak your local IP address. Disable it in your browser settings or use an extension to control it.

---

Understanding the Privacy Tradeoffs

The practical reality

Completely eliminating your browser fingerprint is nearly impossible without making your browser unusable. Every step you take to resist fingerprinting also reduces functionality:

• Disabling JavaScript breaks most websites
• Using Tor makes browsing significantly slower
• Spoofing attributes may cause websites to malfunction
• Using a common configuration reduces personalization

A balanced approach

For most users, a practical approach is:

1. Use Firefox with strict tracking protection for everyday browsing
2. Use Tor Browser for high-privacy activities
3. Install uBlock Origin to block fingerprinting scripts
4. ResistFingerprinting mode for users willing to trade convenience for privacy
5. Accept some fingerprinting risk for everyday browsing where convenience matters

The goal is not to become invisible — it is to make fingerprinting significantly harder and less accurate, raising the cost for trackers to identify you.

---

Frequently Asked Questions

Can I clear my browser fingerprint like I clear cookies?

No. Browser fingerprints are not stored on your device — they are computed in real time by the website based on your browser and device characteristics. You cannot "delete" a fingerprint. However, you can change your fingerprint by altering your browser configuration (updating, changing settings, installing/removing extensions) or using a browser designed to resist fingerprinting (Firefox with RFP, Tor Browser).

Does clearing cookies stop fingerprinting?

No. Clearing cookies only removes stored tracking identifiers. Fingerprinting works through a completely different mechanism — it collects information about your browser and device rather than reading stored data. You need separate measures (fingerprint-resistant browsers, extensions) to address fingerprinting.

Is browser fingerprinting legal?

In most jurisdictions, browser fingerprinting is legal, though it exists in a gray area. The GDPR (EU) requires consent for tracking technologies, and some regulators have argued that fingerprinting requires consent. However, enforcement is limited and inconsistent. The California Consumer Privacy Act (CCPA) also addresses tracking technologies broadly.

Does using a VPN prevent fingerprinting?

No. A VPN hides your IP address and encrypts your traffic, but it does not affect your browser fingerprint. Fingerprinting attributes (screen resolution, fonts, graphics card, etc.) are collected from your browser, not your network connection. A VPN and fingerprint-resistant browser serve different purposes.

Which browser is best for avoiding fingerprinting?

The Tor Browser provides the strongest fingerprinting resistance by making all users appear identical. For everyday use, Firefox with the `privacy.resistFingerprinting` setting enabled offers the best balance of usability and fingerprinting resistance. Brave also provides good built-in protections. Chrome and Safari offer limited fingerprinting resistance.

---

References

1. Electronic Frontier Foundation. “Panopticlick: Browser Tracker.” https://panopticlick.eff.org/
2. Princeton University. “Web Transparency and Accountability Project.” https://webtransparency.cs.princeton.edu/
3. Leuven University. “The Privacy Paradox: Exploring the Gap Between Stated and Revealed Preferences.” https://www.esat.kuleuven.be/cosic/
4. Geng, Y. et al. “Browser Fingerprinting: A Survey.” ACM Computing Surveys, 2025.
5. Englehardt, S. and Narayanan, A. “Online Tracking: A 1-million-site Measurement and Analysis.” ACM CCS, 2016.
6. Tor Project. “Tor Browser Manual: Resist Fingerprinting.” https://tb-manual.torproject.org/

---

About the Author

The GeneratePass Editorial Team builds privacy-first security tools that run entirely in your browser. Every tool on GeneratePass processes data locally — nothing is ever sent to a server. Visit generatepass.me to try our free Password Generator, Entropy Calculator, and Breach Checker.