What Is Browser Fingerprinting and Can You Actually Stop It?

You cleared your cookies. You opened an incognito tab. You might even be using a VPN. And you're still being tracked.

Browser fingerprinting is the reason why. It's a tracking technique that doesn't store anything on your device and doesn't need your permission. It just reads what your browser can't help revealing, and builds a profile from that. Quietly. Every time you visit a site.

This isn't a theoretical privacy risk. Research published at the 2025 ACM Web Conference by teams from Johns Hopkins and Texas A&M universities confirmed that websites are actively using browser fingerprinting to follow users across sessions and sites, even after those users cleared their cookies or opted out of tracking under laws like GDPR and the California Consumer Privacy Act.

The scale of the problem is worth pausing on. Fingerprinting scripts are embedded in thousands of websites, including many you'd consider reputable, and they run automatically, without any visible indication that data collection is happening. Most users have no idea it's occurring, and the privacy tools they rely on offer little to no protection against it.

So what exactly is a browser fingerprint, who's collecting it, and can you do anything meaningful about it? Here's what you need to know.

What is browser fingerprinting?

Every time your browser loads a page, it shares a surprising amount of information with that site: your screen resolution, your time zone, the fonts installed on your device, your graphics hardware, your audio processing characteristics, your language settings, your browser version, your installed plugins, and more.

None of those details sounds like much on its own. But put them together, and you get something remarkably specific. Research by Laperdrix et al. found that approximately 33.6% of desktop browser fingerprints are completely unique, meaning one browser in three can be identified among millions of users based on its fingerprint alone. On mobile devices the uniqueness rate is lower, because phones tend to have more uniform hardware configurations, but fingerprinting is still effective enough to be widely used.

Think of it the way Johns Hopkins researcher Zengrui Liu put it: "You may look anonymous, but your device or browser gives you away."

The analogy is apt. Just as a person might be recognizable from their gait, their handwriting, or the combination of small physical features, even without knowing their name, your browser is recognizable from the combination of signals it emits, even without a cookie or login to tie it to an identity.

The data points that make up your fingerprint come from several sources, often running silently in the background:

• Canvas fingerprinting: Your browser draws invisible text and shapes on an HTML5 canvas element. The rendering differs slightly depending on your GPU, fonts, and display drivers. Those pixel-level differences get hashed into a unique value. This technique is one of the most widely deployed because it's fast, reliable, and hard to block without breaking legitimate website functionality.
• WebGL fingerprinting: Similar to canvas, but uses your graphics card to render a 3D scene. This can identify your exact GPU model with over 98% accuracy, according to Privacy Terminal. Because GPU models vary significantly between manufacturers, generations, and device types, this is one of the most discriminating signals available to trackers.
• AudioContext fingerprinting: Websites generate an audio signal and measure how your hardware processes it. Different sound cards produce different results, even when everything else matches. The differences are inaudible to humans but measurable by scripts, and stable enough to serve as a reliable identifier.
• Font fingerprinting: Scripts check which fonts are installed on your system. The combination reveals a lot, design tools like Adobe Creative Suite install their own font libraries, language packs add region-specific fonts, and different operating systems ship with different defaults. A user with a standard Windows install looks very different from a designer running macOS with a full Adobe suite.
• Navigator and screen properties: Your browser also exposes your operating system, browser version, screen dimensions, color depth, and device pixel ratio. These are less unique on their own but contribute meaningfully to the overall fingerprint when combined with other signals.

Together, these signals produce a fingerprint that's often stable across days or weeks, regardless of what you do to reset it. Unlike a cookie, which disappears when you clear your browser data, your GPU model and installed fonts don't change between sessions.

How is this different from cookies?

Cookies are stored on your device. You can see them, delete them, and block them. When you clear cookies or open a private window, cookie-based tracking resets. That's why cookie clearing became standard privacy advice, for a long time, it actually worked.

Fingerprinting reads your device. Nothing is stored. There's nothing to delete. Private mode doesn't change it because your screen resolution, installed fonts, and GPU model are exactly the same in a private window as they are anywhere else. Opening an incognito tab doesn't change your hardware. It doesn't change your fonts. It doesn't change your time zone or your graphics card. All of those signals are still there, still readable, still unique.

That's the core problem. The privacy tools most people rely on (incognito mode, cookie clearing, even some ad blockers) were built for a different kind of tracking. They were built to address a threat model that existed in the early 2000s, when cookies were the primary mechanism for following users across the web. Fingerprinting is a fundamentally different approach, and it requires fundamentally different defenses.

The gap between what people think protects them and what actually protects them is significant. Someone who diligently clears their cookies after every session, uses private browsing for sensitive searches, and has installed a basic ad blocker may feel well-protected, and may still be fingerprinted on every site they visit.

As Privacy Terminal explains it: "Fingerprinting works silently, leaves no trace on your device, and cannot be defeated by the privacy tools most people know about."

This is also why fingerprinting has become more attractive to the ad industry as cookie-based tracking has come under pressure. When regulators and browser vendors started restricting third-party cookies, advertisers didn't abandon cross-site tracking, they shifted to methods that are harder to block and harder to regulate.

Who's doing this, and why?

Browser fingerprinting isn't new, researchers were documenting it as early as 2010, but its use has grown significantly as third-party cookies have become less reliable. Google Chrome announced in July 2024 that it would keep third-party cookies for now, reversing an earlier plan to phase them out, a position it reaffirmed in April 2025 when it dropped plans for a new cookie-choice prompt. But advertisers spent years developing fingerprinting as a fallback during the uncertainty, and those investments didn't disappear when Google changed course. Fingerprinting is now woven deeply into the ad ecosystem, running alongside cookie-based tracking rather than replacing it.

The three main groups using fingerprinting are:

Advertisers and ad networks. They use fingerprinting to track whether you clicked an ad on one site and then made a purchase on another, a practice called conversion tracking. They also use it to build behavioral profiles that inform which ads you're shown across different sites and sessions. The Johns Hopkins and Texas A&M research showed a direct link between browser fingerprints and real-time ad bidding, meaning your fingerprint actively influences which ads you're shown and how much advertisers pay to reach you. In practical terms, your browser's unique characteristics are being auctioned off in milliseconds every time a page loads.

Anti-fraud and security vendors. Fingerprinting also has a legitimate use: identifying bots, detecting fake accounts, and flagging fraud. Services like Cloudflare use browser signals to distinguish human traffic from automated traffic. Banks and e-commerce platforms use fingerprinting to detect when a login attempt is coming from an unfamiliar device, even if the correct password is entered. In these contexts, fingerprinting is a security tool rather than a surveillance one, though the underlying technique is identical.

Government and law enforcement. According to the Public Interest Technology Group, intelligence agencies including the NSA have used browser fingerprinting to assess targets. The UK's tax authority has also explored fingerprinting to detect tax fraud. These uses are less visible to ordinary users but illustrate how the same technique scales from commercial advertising to state-level surveillance.

The uncomfortable truth is that the same technique that stops a bot from taking over your bank account is also used to follow you around the web without your consent. The technology is neutral; the application determines whether it's protective or invasive. And right now, both uses are happening simultaneously, often on the same websites.

Can you actually stop it?

Not completely. But you can make your fingerprint harder to use, and for most people, that's enough to meaningfully reduce your exposure. The goal isn't invisibility, it's making the tracking less reliable and less profitable.

Here's what actually helps:

Use a browser built to fight fingerprinting. Brave browser adds random noise to canvas, WebGL, and audio fingerprinting results, making your fingerprint inconsistent across sessions without breaking websites. Instead of blocking the fingerprinting scripts outright, which can cause sites to malfunction, Brave feeds them slightly different data each time, so the resulting fingerprint changes. This approach, called fingerprint randomization, is more effective than simple blocking because it degrades the quality of the data rather than triggering detection. Firefox offers built-in fingerprinting protection too: most people should turn on Fingerprinting Protection under Settings > Privacy & Security > Enhanced Tracking Protection, which blocks known fingerprinting scripts with minimal site breakage. Advanced users can go further with the privacy.resistFingerprinting setting in about:config, though Mozilla itself warns this stronger option causes more website compatibility issues.

Tor Browser offers the strongest protection, but it's the most friction-heavy option. It standardizes the browser environment across all users, so everyone looks the same, the same screen size, the same fonts, the same reported hardware. The goal is to make every Tor user indistinguishable from every other Tor user, which defeats fingerprinting by eliminating uniqueness entirely. The tradeoff is that many sites block Tor exit nodes, and browsing speed is significantly slower due to traffic being routed through multiple relays.

Keep your browser updated. Browser vendors actively patch fingerprinting vulnerabilities. Staying on an older version leaves known gaps open and can itself make your fingerprint more distinctive, an outdated browser version is an unusual signal that narrows the field of possible users.

Be selective about extensions. Every browser extension you install adds something unique to your fingerprint. Extensions can expose themselves through the APIs they access, the permissions they request, and the modifications they make to page behavior. A handful of unusual extensions can make you more identifiable, not less. Stick to what you actually use, and prefer widely-used extensions over niche ones.

Avoid heavy customization. The more you tweak your browser (custom fonts, niche plugins, unusual theme settings, non-default zoom levels) the more distinctive your fingerprint becomes. This is counterintuitive but real. The user who has carefully personalized their browser environment is often easier to identify than the user running a stock configuration.

Use a security tool that monitors what your browser is doing. A browser-level protection layer can flag sites running known fingerprinting scripts and alert you when tracking behavior is detected, even when you can't see it happening. This kind of visibility matters because fingerprinting is, by design, invisible to the user, you won't notice it from the page itself.

What about privacy laws?

In theory, fingerprinting without consent should be covered by GDPR in Europe and CCPA in California. Both laws require informed consent before collecting data that can be used to identify or track individuals, and a browser fingerprint clearly qualifies as identifying data under those definitions. In practice, enforcement hasn't kept pace with the technology.

The Johns Hopkins research found that users who explicitly opted out of tracking were still being fingerprinted. The opt-out mechanisms that websites provide, typically a cookie banner with a "Reject All" button, address cookie-based tracking. They don't address fingerprinting, because fingerprinting doesn't use cookies. Clicking "Reject All" on a cookie consent banner and then being fingerprinted anyway is technically legal under current enforcement interpretations in many jurisdictions, even though it violates the spirit of the law.

The researchers called for stronger browser defenses and new regulatory attention specifically on fingerprinting. Some European data protection authorities have begun examining the issue more closely, and there have been enforcement actions in France and Germany related to fingerprinting-adjacent practices. But the gap between the law and actual enforcement remains wide, and companies operating across jurisdictions can often exploit inconsistencies between national implementations of GDPR.

For users, the practical implication is that you cannot rely on legal protections to stop fingerprinting. Opting out of tracking in a cookie banner doesn't stop fingerprinting. It just means a box gets checked somewhere in a compliance database while the fingerprinting continues in the background. Until regulators develop enforcement mechanisms specifically targeting fingerprinting, and until those mechanisms have real teeth, technical defenses are more reliable than legal ones.

The bottom line

Most privacy advice you've been given still assumes tracking lives in a cookie you can delete. Fingerprinting doesn't play by that rule, it reads what your hardware and software can't help revealing, and that doesn't change between sessions.

That's not a reason to give up on browser privacy. It's a reason to focus on defenses that actually address this specific technique: a fingerprint-resistant browser, a plain and unmodified setup, and something watching for tracking scripts you can't see running.

Get a free security scan with Guardio today and stay protected from browser-based threats.

Conclusion

Browser fingerprinting is real, it's widespread, and it survives most of the privacy habits people think protect them. Clearing cookies helps with some tracking. It does nothing for fingerprinting.

The practical path forward is to use a browser that actively fights fingerprinting (Brave and Firefox are both solid options), keep your setup reasonably standard, and pair that with a tool that gives you visibility into what's happening at the browser level.

The broader issue is that fingerprinting has outpaced both public awareness and regulatory enforcement. Most people don't know it exists. Most privacy laws haven't caught up to it. And most of the tools marketed as privacy solutions (private browsing, cookie managers, basic ad blockers) were designed for a different era of tracking.

That doesn't mean you're powerless. It means the defenses that actually work are different from the ones most people are using. Switching to a fingerprint-resistant browser, keeping your setup simple, and using a browser-level security tool that can detect tracking scripts in real time are all concrete, achievable steps.

You can't make your browser invisible. But you can make it much harder to follow.