Browser Fingerprinting in 2026: How Websites Recognise You Without a Single Cookie, Why Clearing Your History No Longer Hides You, and What Browsers Are Doing to Blur the Picture
- Internet Pros Team
- September 24, 2026
- Networking & Security
Most people know that websites track them with cookies, and that clearing cookies or opening a private window is supposed to wipe the slate clean. But a growing share of tracking stores nothing on your device at all. Instead, the site measures your browser: its screen size, installed fonts, graphics card, time zone, language and dozens of other small details. Put together, those details are often unique enough to recognise you on your next visit, whatever you clear. This is browser fingerprinting, and in 2026 it matters to anyone who runs a website as well as anyone who visits one.
What a Fingerprint Is Made Of
A cookie is a name tag the site hands you and asks you to wear. A fingerprint is a description the site writes down about you: no single detail identifies anyone, but the combination narrows the crowd very quickly. Each attribute carries a few bits of identifying information, and the bits add up.
| Signal | How it is read | Why it varies |
|---|---|---|
| Canvas | Script draws hidden text and shapes, then reads back the pixels | Graphics hardware, drivers and font smoothing render tiny differences |
| WebGL | Queries the graphics renderer and draws a 3D test scene | GPU model, driver version and supported extensions |
| Audio | Processes a silent test tone and hashes the output | Floating point behaviour of the audio stack differs by device |
| Fonts | Measures the width of text in many font names | Office suites, design tools and languages install different fonts |
| Environment | Screen size, time zone, languages, CPU cores, memory, touch support | Each is common alone, rare in combination |
| Network | IP address, TLS and HTTP handshake details, seen by the server | Operating system, browser build and connection type |
None of this needs permission prompts, and most of it is available to any script on the page, including third-party scripts you embed. Academic studies and tools such as the EFF’s Cover Your Tracks and AmIUnique have shown for years that a large share of desktop browsers are unique or nearly unique within their test populations.
Clearing cookies changes the name tag. It does not change your face. Fingerprinting is tracking by description, and a description survives a private window.
Why It Is Growing Now
Three pressures have pushed fingerprinting from a niche technique into the mainstream.
- Cookies became harder to rely on. Safari and Firefox block third-party cookies by default, consent banners reduce the share of visitors who accept tracking, and ad blockers strip many tags. Advertisers looked for signals that survive.
- Google changed its advertising rules. From February 2025, Google’s ad platform policies stopped prohibiting fingerprinting by advertisers using its products. The UK Information Commissioner’s Office publicly called the change irresponsible and reminded businesses that the law still applies.
- Fraud and bots got better. Banks, ticket sellers and login systems use device fingerprints to spot account takeover, card testing and automated sign-ups. The same vendors’ techniques are also available for marketing.
The result is that the same visitor can be recognised across sessions, and sometimes across unrelated sites that share a vendor, without anything stored on the device to find or delete.
What Browsers Are Doing About It
Browsers cannot hide every attribute, because websites genuinely need screen size, language and time zone to work. Their defences fall into three strategies: reduce what is exposed, make everyone look the same, or add noise so that measurements change between sites and sessions.
Four Approaches, Four Trade-offs
- Tor Browser: make everyone identical. Standard window sizes, a fixed font set and uniform settings so that all users share one fingerprint. The strongest protection, at the cost of convenience and some broken sites.
- Brave: randomise per site. Canvas, audio and other readings get small random changes, called farbling, that differ by site and session, so a fingerprint collected on one site does not match another.
- Firefox and Safari: block known fingerprinters and blur high-entropy APIs. Firefox blocks scripts on known fingerprinting lists and has steadily widened its built-in protections for all users. Apple added noise to canvas and other APIs in private browsing and has been extending that protection beyond it.
- Chrome: reduce passive signals. The User-Agent string was frozen and trimmed, with detail moved to Client Hints that sites must request. It narrows what is sent by default, but active script-based fingerprinting still works in a standard Chrome window.
No approach is perfect: randomisation can be detectable, uniformity only works if many people share a configuration, and blocklists lag behind new vendors.
What the Law Says
A common misunderstanding is that cookie rules only cover cookies. In the UK and EU they do not. The ePrivacy rules apply to storing or accessing information on a user’s device, and reading canvas output or hardware details is access. Regulators, including the ICO in its guidance on storage and access technologies, have said fingerprinting for advertising or analytics needs the same prior consent as a tracking cookie. Where a fingerprint identifies a person, GDPR applies too: a lawful basis, transparency and data minimisation.
Fraud prevention and security are treated differently, and a strictly necessary purpose may not need consent. But a fingerprint collected “for security” and then reused for marketing loses that protection. In the United States, state privacy laws in California and elsewhere treat persistent device identifiers as personal information, which brings access, deletion and opt-out rights into play.
What This Means for a Business Website
Most small business owners have never written a line of fingerprinting code, yet their sites may still run it. It arrives inside ad tags, analytics add-ons, chat widgets, affiliate scripts and “visitor identification” tools that promise to name anonymous leads.
- Inventory your third-party scripts. List every tag on the site and ask each vendor, in writing, whether it fingerprints devices and for what purpose.
- Make your consent banner honest. If a script fingerprints for marketing, it must wait for consent just like a cookie,.
- Keep security and marketing separate. If you use device signals for fraud checks on logins or checkouts, keep that data out of your advertising pipeline.
- Prefer first-party, consented measurement. It is more durable than covert identification and far less likely to end in a complaint.
- Test your own site. Load it with a privacy extension or in Firefox and Brave, and watch which scripts get blocked. Blocked scripts are often a sign of fingerprinting, and they may also be breaking pages for privacy-conscious customers.
What You Can Do as a User
You cannot become invisible, but you can become much harder to single out. Use a browser with fingerprinting protection switched on, keep it updated, and resist the urge to pile on unusual extensions and custom settings, since every tweak can make you more distinctive, not less. Run a test at Cover Your Tracks to see how your browser looks from the outside.
Fingerprinting is not going away. It powers useful security as well as invasive advertising, and the line between them is purpose and consent. The businesses that do well here are the ones that know exactly what their websites collect and can explain it in a sentence.
Not sure what the scripts on your website are collecting? Talk to Internet Pros. We audit third-party tags, set up consent that actually works, and build analytics that respect your visitors while still telling you what you need to know.
