You log out, delete every cookie, clear your history, open a private window and come back in. And the site still recognises you. There is nothing supernatural about it: most modern tracking does not rely on an identifier you can delete, but on a set of traits your browser announces without permission and that barely change from one visit to the next. It is called browser fingerprinting, and its power lies not in any single data point but in the sum of many.
A cookie is a name; a fingerprint is a face
A cookie is an explicit identifier: the server hands you a unique value, stores it in its database and reads it back on every request. It is convenient and also fragile. It lives on your disk, it expires, it is tied to one domain and for years browsers have been trimming it on purpose: Safari limits script-writable storage to seven days, and Firefox and Chrome isolate storage per site through state partitioning. Deleting a cookie is trivial, and that is precisely its weakness.
Fingerprinting works the other way round: it does not give you anything, it deduces you. Every time you load a page, the browser runs JavaScript and answers a technical questionnaire whose answers depend on your hardware, your operating system, the fonts you have installed and even the driver of your graphics card. None of those answers identifies you on its own. The whole set does.
The arithmetic of being unique
The unit of measurement here is the bit of entropy, the same one used for password strength: a trait with two possible values contributes one bit; an attribute with a thousand possible combinations contributes about ten bits, because log2(1000) is 9.97. The key point is that when traits are more or less independent, the bits add up. And roughly 33 bits are enough to single out one person among the eight billion of us on the planet.
In 2010 the EFF’s Panopticlick project measured, using real visitor data, that the combination of the browser identification string (the User-Agent), installed plugins, system fonts and screen contributed at least 18.1 bits of entropy: in practice, only one in 286,777 browsers shared a fingerprint with another. Eighteen bits are not enough to give you a full name, but they are more than enough to group all your visits as though they did.
How the portrait is built, layer by layer
The inventory of signals falls into two families: what the browser tells you about itself when you ask, and what it reveals without being asked at all.
The browser’s greeting. The User-Agent string is the best known and the most degraded: Chromium froze it so it no longer leaks versions and replaced it with Client Hints, a set of structured headers (Sec-CH-UA, Sec-CH-UA-Platform) reachable from JavaScript through navigator.userAgentData. The juiciest details, such as the exact platform version, the architecture or the device model, are the so-called high-entropy hints, and a site must request them explicitly with the Accept-CH header and wait for your consent. They are less useful for tracking, but they remain a first-class identifier for device marketing.
Installed fonts. No API returns the list of system fonts, yet it can be reconstructed almost completely: simply ask document.fonts.check(’16px "Cambria"’) or draw text on a canvas and measure its width. Which typefaces you have installed is one of the most discriminating traits there is, because it depends on your language, your software and the habits of whoever set the machine up.
The canvas. The classic trick is to draw text with a gradient and a background on a canvas and hash the resulting PNG. The drawing depends on the rasteriser, on edge smoothing (antialiasing), on how the font is snapped to the pixel grid (hinting) and on the GPU driver, so two machines that look identical produce different images. It contributes between eight and sixteen bits.
The graphics card, unmasked. The WEBGL_debug_renderer_info extension returns strings such as “ANGLE (NVIDIA, NVIDIA GeForce RTX 4060 Direct3D11 vs_5_0 ps_5_0)”: brand, model and rendering path. Together with the catalogue of WebGL parameters —maximum texture size, shader precision— it forms an almost unique per-machine identifier.
Sound. An OfflineAudioContext can render a synthetic signal in memory —an oscillator run through a dynamics compressor, for instance— and compare the resulting waveform. The differences do not come from your sound card but from the JIT compiler, the signal-processing libraries and floating-point rounding. It is the same family of imprecisions that makes 0.1 + 0.2 not exactly 0.3; here they double as an identifier.
The rest of the inventory: core count (hardwareConcurrency), estimated memory (deviceMemory), screen resolution and pixel density, colour depth, time zone, the languages declared in Accept-Language, preferred date format, whether you like light or dark themes, how many simultaneous touch points your screen accepts. Each one contributes a bit or two. Added together, they are a name.
What is visible without running a single line of JavaScript
There is an even less comfortable layer, because it does not depend on the browser but on the way your machine talks over the network. Before receiving a single line of HTML, the client has already said hello, and that greeting has a shape.
The TLS ClientHello carries supported versions, the ordered list of cipher suites, the extensions, the elliptic curves and the protocol to be negotiated afterwards (ALPN). A hash is computed from that text: that was JA3 in 2017 and, since September 2023, JA4 from FoxIO, which orders the elements stably, includes counts and also works with QUIC. HTTP/2 has an equivalent: the parameters of the initial SETTINGS frame, the flow-control window size and the order of the pseudo-headers, the so-called Akamai fingerprint. And lower down, in TCP/IP, what remains are the initial TTL, the window size, the MSS, timestamps and protocol options, which tools such as p0f have used for years to guess the operating system.
None of this can be deleted with a click, and it is the reason a scraper posing as Chrome while sending requests from a Python library is caught within seconds: it claims to be something it is not, but it greets the wire as what it is.
Why it survives deletion
With a handful of stable traits, tracking becomes patient. First a first-party identifier is stored in localStorage or IndexedDB, which you can delete too. Then the uncomfortable part kicks in: probabilistic matching. If two visits share 95% of their traits, arrive from the same network and happen at compatible times, the system links them even when the identifier is gone. It does not need certainty, only enough plausibility. On top of that come the pipes between companies: cookie syncing, which pairs identifiers across different domains, and server-side tagging, which moves measurement onto the advertiser’s server to sidestep browser blockers.
Defences: from invisible to indistinguishable
The technical answer is not to become unique and camouflaged, but to stop being unique. The Tor Browser is the purest example: every instance declares itself the same, with the same User-Agent and a standardised window, and applies letterboxing, which rounds the drawing area to multiples so as not to betray the real screen size. Firefox ships a resistFingerprinting mode that does the same with fonts, time zone and resolution. Brave adds an elegant trick, farbling: it perturbs canvas and audio results slightly and deterministically, so the value stays stable within one site —nothing breaks— but is useless for linking you across sites.
Chrome has taken another route, the Privacy Sandbox: instead of banning the data, it moves it inside the browser with APIs such as Topics or Attribution Reporting, which deliver aggregated signals rather than a cross-site identifier. The result is less leakage between sites, but the browser still recognises you locally, and the network fingerprint —the ClientHello and TCP layers— is not fixed by any of these measures.
There is a counterintuitive consequence worth internalising: using an exotic browser, with twenty odd extensions and a strange resolution, makes you easier to identify, not harder. Modern anonymity does not look like an invisibility cloak; it looks like getting lost in a crowd of people identical to you. And with today’s web that is hard: your machine has to reveal things about itself just to know which font to use and which codec to play.
So yes, keep deleting your cookies. But it is worth knowing that while you do it, the window is still open. The internet does not know you by name: it recognises the way you walk.
