You cleared your cookies, opened an incognito window, and switched on a VPN for good measure. Then, a website you had never visited served you an ad for the exact product you looked at last Tuesday. No cookie survived that cleanup, and something recognised you anyway.
That something is a browser fingerprint, and it is one of the quietest tracking methods on the modern web. It stores no file on your device, so there is nothing to delete. It reads what your browser already announces to every site you open (screen resolution, time zone, installed fonts, graphics hardware, language settings) and stitches those details into an identifier specific enough to follow you across the internet. According to the Electronic Frontier Foundation, roughly 83.6% of browsers carry a fingerprint unique enough to single their owner out. This article covers how the technique works, how identifiable you actually are, who is using it, and what genuinely reduces your exposure.
Browser fingerprinting by the numbers
83.6% of browsers have a fingerprint unique enough to be tracked across the web. (EFF)
Fingerprinting is deployed on more than a third of the top 500 US websites. (Peer-reviewed study, 2025)
81% of users say they worry about online tracking, but fewer than 6% understand what fingerprinting is.
One study of 566,704 real fingerprints found that 74% of desktop devices could be identified uniquely from their fingerprint alone.
What a Browser Fingerprint Actually Is
No single detail your browser shares is revealing on its own. The tracking power comes entirely from the combination.
Every time your browser loads a page, it hands over technical details so the site can render correctly on your specific setup. That exchange is normal and necessary. The problem is how much of it there is. A tracking script can read your operating system, browser version, screen and window dimensions, installed fonts, language and time zone, the emoji set your device draws, and the exact model of your graphics chip. Individually, these are common. Combined, they form a pattern that very few other devices share, and a fingerprinting script reads all of it without a permission prompt or any visible sign that it happened.
The signals a script collects
The value of a fingerprint scales with how many independent details it captures. A short study of half a million devices found that three basic signals alone (date format, the user-agent string, and available screen size after menu bars are subtracted) were enough to give a browser roughly a one-in-19,000 identity. Add a handful of harder-to-fake signals, and that figure climbs into the tens of thousands. The script does not need every attribute. It needs enough uncommon ones to narrow the crowd down to you.
Why canvas and audio make it precise
The most identifying signals are the ones you never think about. Canvas fingerprinting asks your browser to draw a hidden image or line of text, then reads the result back as a hash. Because your GPU, graphics drivers, and font rendering produce microscopic differences, that hash is close to unique to your machine. Audio fingerprinting does the same trick with a silent sound wave processed through your device. Neither requires access to your files, your camera, or your microphone. They measure how your hardware behaves, which is far harder to disguise than any setting you can toggle.
Why Fingerprinting Outlives Cookies
Cookies are files sitting on your device. A fingerprint is calculated fresh on every visit, which is exactly why the usual privacy habits miss it.
A cookie is something a site places on your machine, which means you can find it, block it, or wipe it. A fingerprint is never stored on your side at all. It is computed the moment a page loads, from data your browser was going to send regardless. Clearing your history does nothing to it. Private browsing does nothing to it either, because incognito mode changes what your own device remembers, not what your browser broadcasts to the site.
This matters more now that the cookie era is fading. Safari and Firefox already block third-party cookies by default, and while Google reversed its plan to remove them from Chrome, the trend across the industry keeps moving away from cookie-based tracking. Fingerprinting is the persistent fallback the ad-tech ecosystem reaches for when cookies stop being reliable. It works without consent, without a login, and without a single element the average user knows to look for.
The uncomfortable part
Most of the privacy steps people take (clearing cookies, going incognito, deleting history) target the storage layer. Fingerprinting operates below all of it. You can do everything on the standard privacy checklist and still be identified on the next site you open.
How Identifiable Are You, Really?
The headline numbers are alarming, but the full picture has some genuine good news buried in it.
The EFF puts unique, trackable fingerprints on 83.6% of browsers, and the large device study cited earlier found 74% of desktops identifiable from their fingerprint alone. Desktops are the easy target because their configurations vary so widely. If you spend most of your time on a laptop with a stack of extensions and a customised setup, you are almost certainly in that trackable majority.
The nuance that works in your favour
A fingerprint is not permanent. The same research found that these identifiers drift on their own: a browser update, a resized window, a newly installed font, or a daylight-saving adjustment can all change the pattern. The author’s own fingerprint shifted six times in sixty days without any deliberate effort. Phones help too, because millions of identical iPhones running the same OS version produce near-identical fingerprints, which makes any single one harder to isolate. So while you can be pinned down at a moment in time, tracking you consistently over months is harder than the raw uniqueness figure suggests.
Why the measurements understate it
The counterweight is that most surveys of fingerprinting probably undercount it. A 2025 study that watched real people browse found that automated crawlers miss around 45% of the sites actually running fingerprinting scripts, because a lot of that code only fires after login or during checkout, where crawlers never reach. Pair that with the awareness gap (81% of people worried about tracking, under 6% who could explain fingerprinting), and you get a technique that is both more common and less understood than the public numbers imply.
Who Uses Fingerprinting, and Why
Fingerprinting is not automatically sinister. The same technique underpins some defences you probably want.
Banks and fraud teams use device fingerprints to spot suspicious logins. If your credentials suddenly appear from a browser that looks nothing like the one you normally use, the fingerprint mismatch can trigger a verification step and stop an account takeover before it happens. Bot detection and anti-fraud systems lean on the same signals to tell a real visitor from an automated one. In these cases, accuracy that borders on paranoia is a feature.
The dominant use, though, is advertising. Research from Texas A&M and Johns Hopkins in 2025 provided the first hard evidence that websites are actively using fingerprints to track people across sessions and sites, not merely collecting them in theory. More pointedly, the researchers found that users who opted out under privacy laws such as GDPR and CCPA could still be tracked by fingerprint, because the technique sidesteps the consent mechanisms those laws rely on. The permission you decline and the identity you carry are, in practice, two separate things.
Opting out is not the same as being invisible
A cookie consent banner governs cookies. It says nothing about fingerprinting, which runs whether or not you click “reject all.” Declining tracking in a pop-up and being untracked are, unfortunately, not the same outcome.
What Actually Reduces Your Exposure
You cannot make yourself invisible without breaking half the sites you use. The realistic goal is to look less distinctive and cut the number of signals you emit.
The counterintuitive rule of fingerprinting is that standing out is the danger, so heavy customisation often backfires. A browser loaded with unusual extensions and non-default settings is easier to isolate, not harder, because that specific combination is rare. Blending into a large crowd of identical setups protects you more than any single tweak.
A few measures do move the needle. Privacy-focused browsers such as Brave and Tor, and Firefox with its resist-fingerprinting setting enabled, deliberately normalise or block the signals scripts read, so your browser resembles thousands of others. Keeping your browser close to its default configuration and trimming extensions you do not need reduces the distinctive attributes on offer. Dedicated anti-fingerprinting extensions can feed scripts randomised canvas and audio values, though results vary. None of these makes you untraceable, but together they shrink how sharply any one site can pick you out.
Where a VPN Fits, and Where It Does Not
A VPN is not a fingerprint eraser, and any provider that claims otherwise is overselling. It closes a different channel that feeds the same profiling machinery.
Fingerprinting happens inside your browser, so a VPN does not rewrite the fonts, canvas hash, or hardware details that a script reads. What it controls is the network layer underneath. Your IP address is one of the inputs trackers cross-reference to tie a fingerprint to a location and a household, and a VPN replaces your real IP and approximate location with those of its server. It also encrypts your DNS queries, which otherwise reveal every domain you visit to your internet provider and, on public Wi-Fi, to whoever runs the network and any advertising partners they sell traffic data to.
ZoogVPN routes your traffic through an encrypted tunnel and resolves DNS inside it, so your provider and the network operator see a single connection to a VPN server and none of the domains behind it. Its no-logs policy means there is no stored record of your activity to breach or sell, and one account covers your phone, laptop, and tablet on the networks you do not control. It will not stop a canvas script from reading your GPU, but it removes your real IP and DNS trail from the pool of data that gets stitched together with that fingerprint. Paired with a privacy-conscious browser, it closes the channel that browser settings alone leave wide open.
Browser fingerprinting is not going anywhere, and the honest takeaway is not to panic. It is that “cleared my cookies” and “private” stopped meaning the same thing a while ago, and the gap between them is exactly where a fingerprint lives.
Close the channel you can control
Take your IP and DNS trail out of the tracking pool
ZoogVPN encrypts your traffic, resolves DNS inside a secure tunnel, and blocks ads and trackers before they load, with no logs kept, across every device you own. It strips out the network-level data and tracking scripts that make it so much easier to pin to you.
- Diana BestaievaContent Writer at ZoogVPN. Diana deeply explores the newest technologies and shares valuable insights engagingly and comprehensively. Keeping up with the tech news, she makes in-depth content, explaining complex concepts with ease.
