Block third-party cookies and many trackers still follow you. Their fallback is browser fingerprinting: identifying your browser by the unique combination of things it reports. This article explains the technique, why it is hard to defeat, and the honest trade-offs of each countermeasure.
What makes a fingerprint
When a page loads, your browser shares a lot of data automatically — to render correctly, not for tracking. Combine enough of it and the combination is nearly unique:
- Screen resolution, color depth, and window size
- Installed fonts (a page can enumerate fonts via CSS and canvas)
- Timezone, language, and locale
- Hardware attributes (GPU model, CPU cores, memory hints exposed by some APIs)
- Operating system and browser version (user agent)
- Canvas / WebGL rendering output — tiny differences in GPU rasterization are device-specific
- Media device IDs, battery API values, input method quirks
Research on fingerprint uniqueness (starting with the EFF's Panopticlick project) has consistently found that a modest set of these attributes uniquely identifies a large fraction of browsers. Unlike a cookie, a fingerprint is not a file you can delete — it is derived from the device itself.
How trackers use it
A script on any participating site computes a fingerprint hash and stores it server-side. Visit another site with the same script, it computes the same hash, and the two visits are linked. Because the fingerprint is stable across normal browsing, it works as a cookie replacement — and it survives private browsing, as covered in our Incognito Mode Myths article.
Why it is so hard to block completely
To build a fingerprint, a script only uses features the browser must expose to work. There is no single "off switch" because the browser cannot know which API call is legitimate. You can only reduce information or consistency:
- Reduce information: hide or spoof fewer details, revealing less.
- Break consistency: make the fingerprint change between sites, so cross-site matching fails.
Both approaches have real downsides, detailed below.
What actually helps (and what it costs)
1. Use a browser that blocks known fingerprinting scripts
Firefox Strict mode and good ad/tracker blockers maintain lists of known fingerprinters and block their scripts. Cost: some sites require you to prove you are human; a few break.
2. Disable or restrict JavaScript for unfamiliar sites
Scripting is the delivery mechanism. Extensions like NoScript, or Firefox's Temporary Containers with a JS toggle, let you run scripts only on sites you trust. Cost: many modern sites need JavaScript; you will spend time clicking to allow.
3. Block canvas/WebGL fingerprinting
Extensions like CanvasBlocker inject noise into canvas reads, so the derived hash differs from your real GPU rendering. Cost: some captchas and games misbehave; a poorly done spoof can itself be detectable.
4. Use fingerprint-resistant browsers or containers
Tor Browser is the gold standard: every session uses an identical browser profile across all users, making individual fingerprints indistinguishable. Firefox containers separate contexts so the same fingerprint cannot connect two containers. Cost: Tor is slower and some sites block it; containers do not change the fingerprint, they isolate it.
5. Reduce the obvious variables
Keep your browser updated, avoid niche font packs, and use a consistent timezone if you travel a lot. These shave off high-entropy attributes. Cost: minor; it helps but does not defeat fingerprinting.
What does not help
- Private/incognito mode — fingerprints persist across sessions.
- Deleting cookies — the fingerprint is re-derived in seconds.
- Blocking third-party cookies — already the default in most browsers; this is exactly what pushed the industry to fingerprinting.
- A "Do Not Track" flag — widely ignored, as noted in our Chrome Privacy Settings guide.
- A VPN — it changes your IP, but your browser still reports the same fonts, GPU, and timezone, so the fingerprint itself is unchanged.
The realistic baseline
For most people, the pragmatic setup is:
- Block known fingerprinting scripts (Firefox Strict, a good ad/tracker blocker).
- Block third-party cookies (default in most browsers) so the fingerprint cannot be cross-referenced with cookie data.
- Use containers or a separate browser profile for sensitive accounts so the same fingerprint cannot connect your work and personal browsing.
- Be realistic: as long as the web exposes these APIs, complete anonymity requires a tool built for it (Tor). Privacy settings reduce automated tracking; they do not make you anonymous.
For the overall setup, see the Browser Privacy Guide.
What actually limits fingerprinting
Quick answers
Can I check my own fingerprint? Yes. The EFF's Cover Your Tracks site shows what your browser reveals; run it in normal and private windows to see how little changes.
Is fingerprinting illegal? Not by itself in most jurisdictions, but it collides with GDPR consent and CCPA requirements when used for ad targeting without notice. Some browsers (Safari) actively fight it; others ship mitigations.
Does a VPN stop fingerprinting? No — it changes your IP but not your browser's reported fonts, GPU, or timezone.
Can I opt out of fingerprinting? Generally there is no per-user opt-out; the countermeasures above are the only realistic options.
Related reading
- Third-Party Cookies, Explained
- Incognito Mode Myths
- DNS Privacy Explained
- The Safe Browser Extensions Guide
Sources
- EFF: Cover Your Tracks — fingerprint test and methodology
- EFF: Surveillance Self-Defense — fingerprinting explainer
- Mozilla: Fingerprinting protection
- MDN: Fingerprinting
Written by Hassan Arshad, founder of UsefulOrbit. Last updated August 31, 2026.