Recognition without storage
Most people have heard that clearing cookies makes a site forget you. Browser fingerprinting is a way of recognising a browser that does not depend on anything being saved on it. Instead of leaving a label on your device, a site examines what your browser reveals about itself and notices that the same combination keeps coming back.
The comparison with a human fingerprint is loose. A browser fingerprint is not a single unique mark. It is a collection of ordinary details that, taken together, may be distinctive enough to tell one browser from many others.
What goes into a fingerprint
Every browser answers questions from the sites it visits, because pages need the information to display correctly. Typical details include:
- the browser name and version, and the operating system
- language and time zone settings
- screen size, colour depth and pixel density
- which fonts are installed
- the number of processor cores and an approximate amount of memory the browser reports
- supported media formats and other features
- the list of plug-ins or capabilities available
Individually, these are not very revealing. Millions of people share the same browser and language. The distinguishing power comes from combining many traits, since each extra trait narrows the group of browsers that could match.
Hardware-level quirks
Some of the more distinctive signals come from how a device draws and processes things. A page can ask the browser to render a hidden image or a piece of text, or to produce a short sound, and then read back the result. Tiny differences in graphics hardware, drivers, font rendering and software can lead to slightly different output on different machines. These are often called canvas, WebGL or audio fingerprinting.
Because the output depends on the combination of hardware and software, two devices of the same model with identical settings may produce identical results, while devices that look similar on paper may differ. That is why the technique does not identify people directly. It identifies a configuration.
Turning traits into an identifier
A tracking script collects the traits, combines them and typically passes them through a mathematical function that produces a short code, called a hash. The code is sent to a server. If the same code arrives later, the server can treat the visits as probably coming from the same browser and add them to the same profile.
This is probabilistic. Fingerprints change when you update the browser, install a font, change a setting or connect an external monitor. Systems often cope by comparing many signals and accepting a partial match, so a fingerprint is better thought of as a strong hint than a certain identification.
Why sites use it
Fingerprinting has legitimate and less welcome uses.
- Fraud prevention. A bank or shop may notice that a login attempt comes from a browser configuration it has never seen before and ask for extra verification.
- Bot detection. Automated traffic often has unusual or inconsistent traits.
- Advertising and analytics. Companies may use it to recognise visitors who block or delete cookies, which is the concern from a privacy point of view.
The same technique can serve security and surveillance, and what matters is usually the purpose and whether the person was told. Fingerprinting is one of several techniques within online tracking, and it stands out because, unlike browser cookies, it leaves nothing on the device for you to delete.
Limits and countermeasures
Fingerprinting is not magic, and defences exist, but each has trade-offs.
- Looking the same as everyone else. Some browsers aim to make many users report identical values, so no one stands out. This works best when many people use the same settings, and it may mean some features are limited.
- Adding randomness. Other approaches alter or add noise to certain readings so that the fingerprint changes between visits. Results vary, and unusual values can themselves be distinctive.
- Limiting access. Browsers can restrict which details scripts may read or require permission for some of them.
A private browser with built-in protections typically makes tracking harder than a default setup, but there is no guarantee it prevents every method. Customising a browser heavily can backfire: a rare combination of settings or browser extensions may make you easier to single out, not harder. Keeping software updates current is generally sensible because browser makers add protections over time, though exact behaviour differs between products.
A virtual private network hides your network address from the sites you visit, but it does not change your browser’s reported traits, so it does not by itself defeat fingerprinting.
A realistic takeaway
Fingerprinting shows that avoiding cookies is not the same as avoiding tracking. It is hard for an ordinary user to see or control, and no single setting removes it. Choosing a browser that publishes how it handles fingerprinting, keeping it updated and avoiding unnecessary customisation are reasonable steps. They reduce the effect without promising that you cannot be recognised.