Browser Fingerprinting: How Sites Track You

Browser fingerprinting is a method websites use to identify your device and track your online activity by collecting a unique set of data points from your browser. Unlike cookies, which are small files stored on your device, a fingerprint is built from information your browser reveals about itself — such as screen resolution, installed fonts, time zone, and even the way your graphics card renders an image. This article explains what browser fingerprinting is, how it works, and what you can do to protect your privacy.

What Is Browser Fingerprinting?

Browser fingerprinting is a tracking technique that assembles a distinctive identifier (a “fingerprint”) from the configuration and behavior of your web browser. Each data point alone is not unique, but the combination of dozens of them often creates a string of information that can be used to recognize you on subsequent visits, even if you clear cookies or use private browsing mode.

The term “fingerprint” is standard in digital privacy literature. It draws an analogy to human fingerprints, which are unique to each person and can be used to identify them. In this context, the browser’s configuration acts as the unique mark. The word has been used in this sense since the early 2010s, when researchers at the Electronic Frontier Foundation (EFF) and other institutions began studying how websites could identify users without cookies.

Websites use fingerprints for several purposes: advertising targeting, fraud prevention, account security, and analytics. For example, a bank might use fingerprinting to flag a login attempt from an unfamiliar device, while an ad network might use it to show you the same ad across different websites. The practice is largely invisible to users, which is why it has raised significant privacy concerns.

How Browser Fingerprinting Works

When you visit a website, your browser sends a request to the server. Along with the page content, the server can request specific information from your browser using JavaScript. The browser responds with data that is available through standard web APIs. The website then combines these data points into a fingerprint.

The main categories of data used in fingerprinting include:

HTTP headers: Information like the User-Agent string (browser type and version), Accept-Language (preferred languages), and Accept-Encoding (compression methods) are sent with every request.
Screen and window properties: Screen resolution, color depth, and the size of the browser window reveal the device type and display settings.
Time zone and language: The browser’s time zone and language settings are often unique to a geographic region.
Installed fonts: JavaScript can detect which fonts are installed on your system by measuring the width of text rendered with different font families.
Plugins and extensions: The list of installed browser plugins (like Adobe Flash or PDF viewers) can be enumerated, though modern browsers have limited this.
Hardware and platform: The device’s CPU class, available memory, and operating system are often exposed through APIs like navigator.hardwareConcurrency and navigator.platform.
Canvas and WebGL: Websites can draw a hidden image on an HTML5 canvas or WebGL context and read the pixel data. The rendering differs slightly across graphics cards and drivers, creating a near-unique identifier.
Audio context: The way the browser processes audio signals also varies by hardware and software, producing a small but useful fingerprint.

These data points are collected on the server side or via JavaScript, then hashed into a single identifier. The hash is stored in the website’s database and associated with your future visits. Because the fingerprint is based on your browser’s configuration, it remains relatively stable over time, even if you clear cookies.

Why Fingerprinting Is Hard to Detect

Unlike cookies, which are stored on your device and can be deleted, a fingerprint is not stored anywhere on your computer. It is derived from data that your browser exposes automatically. You cannot “see” a fingerprint in your browser settings, and there is no standard way to clear it. This makes fingerprinting particularly invasive because users have no direct control over it.

Another reason fingerprinting is hard to detect is that the data collection happens silently. A website can run a JavaScript script that gathers dozens of attributes in a fraction of a second, without any visible effect. The user sees only the page content, not the background data collection.

Furthermore, fingerprinting works across browsers and devices to some extent. If you use the same browser on your phone and desktop, the fingerprint may be similar enough to link the two. Even if you switch to a different browser, some data points like your time zone and screen resolution remain the same, making cross-browser tracking possible.

Common Misconceptions About Fingerprinting

One common misconception is that using a VPN or private browsing mode prevents fingerprinting. While a VPN hides your IP address and private mode stops storing cookies, neither changes the underlying browser configuration. Your screen resolution, installed fonts, and canvas rendering remain the same, so your fingerprint stays intact. A VPN can hide your location, but it does not make you anonymous.

Another misconception is that fingerprinting is always malicious. While it is often used for advertising, it also has legitimate security uses. For example, online services use fingerprinting to detect account takeover attempts or to block automated bots. The issue is not the technology itself, but the lack of transparency and user consent.

People also believe that using a common browser like Chrome makes them less trackable. In reality, Chrome is one of the most fingerprintable browsers because it exposes a large number of APIs and has a large user base, but that does not make individual fingerprints less unique. The combination of settings still creates a distinct identifier for most users.

How to Protect Yourself from Fingerprinting

While you cannot completely prevent fingerprinting, you can reduce its accuracy and make it harder for trackers to link your visits. Here are practical steps:

Use a privacy-focused browser: Browsers like Brave and Firefox (with strict privacy settings) have built-in fingerprinting protection. They can block fingerprinting scripts or add noise to the data they report.
Disable JavaScript: Since most fingerprinting relies on JavaScript, disabling it stops the collection. However, this breaks many modern websites, so it is not a practical solution for everyday browsing.
Use browser extensions: Extensions like Canvas Blocker or Privacy Badger can block or spoof fingerprinting attempts. They are not perfect, but they add a layer of resistance.
Keep your browser updated: Newer browser versions often reduce the amount of information exposed. For example, modern browsers have limited plugin detection and have made the User-Agent string less specific.
Use a consistent browser and settings: The more uniform your browser configuration, the less unique your fingerprint. This is a trade-off, as it reduces functionality but increases anonymity.
Consider a fingerprint randomization tool: Some tools randomize your browser’s fingerprint on each visit, making it impossible to link sessions. This is more advanced and may cause issues with website functionality.

It is important to note that no method is foolproof. Sophisticated trackers can combine fingerprinting with other techniques, such as IP tracking and behavioral analysis, to identify you even if your fingerprint changes.

Fingerprinting vs. Cookies

Cookies are small text files stored on your device that contain a unique identifier. When you revisit a website, the cookie is sent back to the server, allowing the site to recognize you. Cookies are easy to manage: you can view, delete, or block them in your browser settings, and they expire after a set period.

Fingerprinting, in contrast, does not store anything on your device. It is a “stateless” tracking method, meaning the website does not need to leave a file to identify you. This makes it harder to detect and block. Cookies can be cleared with a single click, but a fingerprint is rebuilt every time you visit a site.

Another difference is consent. Many websites now require user consent for cookies under privacy laws like the GDPR in Europe. Fingerprinting, however, often happens without explicit consent, and some sites have used it to circumvent cookie consent requirements. This has led to legal challenges and stricter regulations in some regions.

Frequently Asked Questions

Can browser fingerprinting track me across different websites?

Yes. If multiple websites use the same fingerprinting service (like a common ad network), they can share your fingerprint and build a profile of your activity across all of them. This is similar to how third-party cookies work, but it is harder to block because there is no cookie to delete.

Does clearing cookies stop fingerprinting?

No. Clearing cookies removes the cookie file, but your browser’s configuration remains the same. The next time you visit a site, it can generate the same fingerprint and recognize you. Some trackers use both cookies and fingerprints to create a more robust identifier.

Is browser fingerprinting illegal?

It is not inherently illegal, but it may violate privacy laws if done without consent. The EU’s GDPR and the California Consumer Privacy Act (CCPA) require websites to disclose tracking and obtain user consent. However, enforcement varies, and many sites still use fingerprinting without clear disclosure.

Can I change my browser fingerprint?

Yes, you can change it by altering your browser’s settings, such as changing your screen resolution, installing different fonts, or using a different browser. However, changing it does not make you anonymous; it just creates a new fingerprint that can still be tracked.

Does using incognito mode prevent fingerprinting?

No. Incognito mode (or private browsing) stops your browser from storing cookies and history, but it does not change the data your browser exposes. Websites can still fingerprint you during an incognito session, and they may even use fingerprinting to detect that you are in private mode.

What is a canvas fingerprint?

A canvas fingerprint is a type of fingerprinting that uses the HTML5 canvas element. The website draws an image or text and then reads the pixel data. Because each graphics card and driver renders the image slightly differently, the resulting pixel data is often unique to your device.

Conclusion

Browser fingerprinting is a powerful and largely invisible tracking method that uses your browser’s configuration to create a unique identifier. It is not malicious by default, but it poses significant privacy risks because it is difficult to detect and control. By understanding how it works and taking steps to limit the data your browser exposes, you can reduce your digital footprint. While no solution is perfect, a combination of privacy-focused tools and mindful browsing habits can help protect your online identity.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →