Browser Fingerprinting: How Sites Track You Without Cookies

You delete your cookies. You open an incognito window. You turn on a VPN. You visit a website you've never been to before — and somehow, it already knows who you are.

Not your name, necessarily. But it knows you're the same person who visited yesterday. It knows the device you're using, the software you're running, and the dozen other sites you've been to this week. All without storing a single file on your computer.

This is browser fingerprinting — a tracking technique that identifies you by the unique characteristics of your browser, device, and hardware. It's invisible, persistent, and almost impossible to opt out of. According to research by the Electronic Frontier Foundation (EFF), roughly 83.6% of browsers have a fingerprint unique enough to single out their user from the rest of the internet.

And as third-party cookies finally die — blocked by default in Safari, Firefox, Brave, and increasingly in Chrome — fingerprinting has stepped into the vacuum. It's now used by thousands of the most popular websites, from ad networks to banks, and the overwhelming majority of users have never heard of it.

This guide explains exactly what browser fingerprinting is, how each technique works under the hood, who's doing it, and what you can realistically do about it.

What Is Browser Fingerprinting?

When you visit a website, your browser voluntarily shares a surprising amount of information: what browser and operating system you're running, your screen resolution, your timezone, your preferred languages, your installed fonts, the model of your graphics card, and dozens of other details. Websites need much of this data to work properly — to render pages correctly, play video at the right resolution, or serve content in your language.

Browser fingerprinting exploits this by collecting as many of these data points as possible and combining them into a single identifier. No individual detail is unique to you. Millions of people use Chrome on Windows. Millions have a 1920×1080 screen. But the combination of your browser, OS version, screen resolution, GPU, timezone, language settings, installed fonts, and a hundred other attributes? That's almost certainly yours alone.

Here's a useful way to think about it. Imagine you're at a football stadium with 80,000 people. If someone asks "who's wearing a red shirt?" — that's thousands of people. "Who's wearing a red shirt and jeans?" — still hundreds. "Red shirt, jeans, glasses, brown hair, sitting in the upper tier, with a tattoo on their left wrist?" — that's probably just you. Browser fingerprinting works the same way: each attribute narrows the crowd until you're the only one left.

A fingerprinting script typically collects between 50 and 200 data points in under 300 milliseconds. It runs silently in the background, looks identical to any other script a website needs to function, and — unlike a cookie — leaves absolutely no trace on your device. There's no popup, no consent banner, and no entry in your browser settings to find or delete.

How Browser Fingerprinting Works

Browser fingerprinting isn't one technique — it's a family of methods that exploit different browser APIs, hardware characteristics, and network protocols to build a composite identifier. Some are simple. Others are remarkably clever. Here's how each major technique works.

User-Agent String and HTTP Headers

The most basic fingerprinting data comes free, before any code even runs on your device. When your browser connects to a website, it sends a set of HTTP headers with every request. The most revealing is the User-Agent string — a line of text that identifies your browser, its version, your operating system, and platform:

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

On its own, a User-Agent string is shared by millions of users running the same browser and OS. But it becomes far more identifying when combined with other headers: the Accept-Language value reveals your preferred languages and their priority order, Accept-Encoding reveals your browser's compression capabilities, and even the order in which headers are sent varies between browser families. Running an outdated browser version or an unusual OS immediately makes you stand out.

Modern Chromium-based browsers are also rolling out Client Hints — a newer system that sends hardware details like device memory, CPU core count, and platform architecture as separate HTTP headers. Client Hints were designed as a more structured replacement for the overloaded User-Agent string, but they also hand fingerprinters neatly labeled data points to work with.

Canvas Fingerprinting

Canvas fingerprinting is one of the most widespread and well-studied techniques. First described by researchers at the University of California, San Diego in 2012, it exploits the HTML5 <canvas> element — an API originally designed for rendering 2D graphics in the browser.

Here's how it works: a fingerprinting script instructs your browser to draw an invisible image — typically a specific combination of text, shapes, gradients, colors, and sometimes emoji. The script then reads back the raw pixel data using the toDataURL() function and computes a hash of the result.

The key insight is that the exact rendering of this image varies slightly depending on your GPU, graphics drivers, operating system, font rendering engine, sub-pixel layout, and anti-aliasing settings. These differences are invisible to the naked eye — the images look identical to a human viewer — but they produce different pixel values at the binary level, and therefore different hashes, across devices. A Windows machine with an NVIDIA GPU will render the same canvas instruction slightly differently than a MacBook with Apple Silicon, which will differ from a Linux machine with an Intel integrated GPU.

Emoji rendering is particularly effective for fingerprinting because emoji appearance varies dramatically across operating systems and browser engines. The same smiling face emoji can look completely different on Apple, Google, Microsoft, and Samsung platforms, making it an efficient signal for narrowing down the device.

Research suggests that canvas fingerprinting alone can uniquely identify roughly 60% of users. When combined with other techniques, that number climbs above 99%.

WebGL Fingerprinting

WebGL (Web Graphics Library) fingerprinting takes a similar rendering-based approach but operates in 3D rather than 2D. The WebGL API renders three-dimensional graphics in the browser by interfacing directly with the device's GPU.

A fingerprinting script renders a complex 3D scene — with specific lighting, textures, and geometry — and analyzes the output pixels. Because different GPUs, driver versions, and hardware configurations process 3D rendering differently, the result varies from device to device.

But WebGL fingerprinting goes beyond just rendering. The API also exposes hardware information directly. Through the WEBGL_debug_renderer_info extension, a script can query your exact GPU vendor and renderer model — for example, "NVIDIA Corporation" and "NVIDIA GeForce RTX 4070." It can also enumerate supported extensions, maximum texture sizes, shader precision formats, and other GPU capabilities. This is highly identifying data that's available without any user interaction.

Where canvas fingerprinting tests basic 2D rendering, WebGL reaches deeper into the hardware layer. The two techniques are usually deployed together.

Audio Fingerprinting

Audio fingerprinting uses the Web Audio API to generate a unique identifier based on how your device processes sound — and importantly, no audible sound is ever played. The entire process happens computationally, in memory.

A fingerprinting script creates an audio signal using an OscillatorNode, routes it through a processing pipeline (typically involving a DynamicsCompressorNode), and collects the resulting waveform data. The subtle variations in how different audio stacks — including the browser engine, operating system, audio drivers, and hardware — process the signal produce measurably different outputs. These differences are enough to create a stable, unique hash.

Audio fingerprinting is particularly valued for its stability over time. A user might change their screen resolution, install new fonts, or update their browser — but the audio processing pipeline of their device tends to remain consistent for months or years. Apple was among the first browser vendors to counter this technique: starting with Safari 17, the browser injects small amounts of randomness into audio processing during private browsing, so the same device produces different audio hashes across sessions.

Font Fingerprinting

The set of fonts installed on your system is a surprisingly powerful identifier. Every operating system ships with a default set of fonts, but users accumulate additional fonts over time — through software installations (Adobe Creative Suite alone adds dozens), work requirements, or personal preferences. The result is a font library that varies significantly from person to person.

Font fingerprinting works by rendering text in a long list of candidate fonts and measuring the dimensions of the resulting text boxes using invisible DOM elements. If a font is installed, the text renders at its native width and height. If it's not, the browser falls back to a default font with different dimensions. By testing hundreds of fonts, a script can rapidly map out your exact font inventory without you ever seeing anything on screen.

Research has found that roughly 57% of users can be uniquely identified by their installed font set alone. Fonts are also a strong proxy for your operating system and installed software — a machine with Helvetica Neue is almost certainly a Mac, while one with Segoe UI is running Windows.

Screen and Hardware Attributes

Your browser exposes a range of hardware and display characteristics through standard JavaScript APIs. None are unique individually, but they rapidly narrow the pool of possible devices when combined:

• Screen resolution and color depth — via screen.width, screen.height, and screen.colorDepth
• Device memory — via navigator.deviceMemory (Chromium browsers)
• CPU core count — via navigator.hardwareConcurrency
• Timezone — via Intl.DateTimeFormat().resolvedOptions().timeZone
• Platform — via navigator.platform
• Touch support — via navigator.maxTouchPoints
• Battery status — the Battery Status API (now removed from most browsers, but historically a fingerprinting vector)

A user with a 2560×1440 screen, 8 logical CPU cores, 16 GB of device memory, and the Europe/Amsterdam timezone is already in a very small group — before any of the more advanced techniques even come into play.

TLS Fingerprinting

TLS (Transport Layer Security) fingerprinting operates at the network protocol level, before any JavaScript runs or any webpage content loads. When your browser initiates an HTTPS connection, it sends a "Client Hello" message that includes a list of supported cipher suites, TLS extensions, compression methods, elliptic curves, and point formats.

The specific combination and ordering of these values varies between browser families, versions, and operating systems. Security researchers have developed tools like JA3 and its successor JA4 that hash these TLS handshake parameters into a compact fingerprint. For example, Chrome, Firefox, and Safari each produce distinctly different JA3 hashes because they support different cipher suites in different priority orders.

What makes TLS fingerprinting especially powerful is that it cannot be blocked by browser extensions or evaded by disabling JavaScript. It happens at the protocol level, outside the control of any in-page script. Some CDN providers and bot detection services use TLS fingerprints as a first-pass filter before the page even loads.

WebRTC Leaks

WebRTC (Web Real-Time Communication) is a browser API that enables peer-to-peer video calls, voice chat, and file sharing. To establish direct connections between devices, WebRTC needs to discover their real IP addresses — and it does this through requests to external STUN servers that bypass your VPN or proxy tunnel entirely.

This means a website can use WebRTC to discover your real public IP address even when you're connected to a VPN. It can also reveal your local (internal) IP address — details like 192.168.1.42 — which expose your network topology and add another data point to your fingerprint.

Firefox, Chrome, Opera, and Edge all have WebRTC enabled by default. Brave blocks WebRTC IP leaks by default. Tor Browser disables WebRTC entirely.

CSS Fingerprinting

Most fingerprinting relies on JavaScript, which has led many privacy-conscious users to disable it entirely. But recent research has shown that CSS alone — with no JavaScript whatsoever — can be used for fingerprinting.

The technique works by using CSS @media queries to test device characteristics (screen size, color depth, pointer type, color scheme preference) and @font-face rules to probe for installed fonts. For each characteristic, the CSS sets a unique background-image URL that the browser will request only if that media query matches. The server collects the pattern of incoming requests and uses it to build a fingerprint.

CSS fingerprinting can also detect browser extensions. Some extensions inject CSS stylesheets or modify DOM elements in detectable ways, and CSS container queries can be used to identify these modifications. Research presented at the 2025 NDSS Symposium demonstrated that CSS-only fingerprinting techniques work even under the Tor Browser's highest security settings, where JavaScript is completely blocked.

This matters because CSS cannot be disabled without breaking the web entirely — unlike JavaScript, there's no "NoCSS" extension. It significantly expands the attack surface for fingerprinting into environments previously considered safe, like email clients that strip JavaScript but render CSS.

Behavioral Fingerprinting

Beyond static hardware and software characteristics, some fingerprinting systems analyze how you interact with your device:

• Mouse movement patterns — speed, acceleration, curvature of movement
• Typing dynamics — keystroke timing, dwell time, rhythm
• Scroll behavior — speed, smoothness, frequency
• Touch gestures — pressure, angle, swipe patterns on mobile

These behavioral biometrics are harder to collect reliably and are more commonly used in fraud detection than in advertising. But they're extremely difficult to fake, because they're rooted in the physical characteristics of your body and habits rather than your software configuration.

How Unique Is Your Fingerprint?

The concept that makes fingerprinting work is entropy — a measure of how much identifying information a single data point carries.

Your timezone has low entropy: millions of people share America/New_York. Your screen resolution is slightly higher: there are dozens of common values, but they still group users into large buckets. Your GPU renderer string? That's much higher — it narrows you down to users with the exact same graphics card and driver version.

But entropy is additive. Each new data point multiplies the narrowing effect. Even if your timezone is shared by 10 million people, and your screen resolution by 5 million, and your GPU by 500,000 — the intersection of all three might be 50,000 people. Add your installed fonts, audio fingerprint, canvas hash, language settings, and CPU core count, and you quickly arrive at a group of one.

The EFF's Panopticlick project (now called Cover Your Tracks) found that only 1 in 286,777 browsers share the same fingerprint as any given user. More recent research puts the number even higher: when combining browser-level and device-level attributes, over 99% of users can be uniquely identified.

This creates a fundamental tension. Every data point your browser exposes exists for a legitimate reason — rendering graphics, adapting layouts, playing audio, localizing content. But the aggregate of all this functional data produces a tracking identifier more persistent and harder to evade than any cookie ever was.

Who Uses Browser Fingerprinting — and Why?

Browser fingerprinting isn't inherently malicious. The same technique serves very different purposes depending on who deploys it — and how.

Fraud prevention and security is the most widely accepted use case. When you log into your bank from your usual laptop, the bank's fraud system recognizes the device fingerprint and lets you through. If someone halfway around the world tries to log in with stolen credentials from a device the bank has never seen, the unfamiliar fingerprint triggers additional verification. Payment processors use fingerprinting to detect credit card fraud, account takeovers, and credential stuffing attacks. In this context, fingerprinting genuinely protects users.

Advertising and cross-site tracking is where the controversy begins. As cookies become less reliable, the ad industry has turned to fingerprinting to track users across websites, build behavioral profiles, and serve targeted ads. Data brokers collect fingerprint data from thousands of sites and compile detailed browsing histories that can be sold to advertisers. Unlike cookies, fingerprints persist across incognito sessions, survive browser restarts, and can even link activity across different browsers on the same device (since canvas and audio fingerprints depend on hardware, not software).

Bot detection relies heavily on fingerprinting. Automated bots typically have unusual or inconsistent fingerprints — a headless browser might lack certain APIs, report impossible hardware configurations, or show no behavioral signals like mouse movement. Fingerprinting is a core component of nearly every commercial bot detection system, from CAPTCHA alternatives to content protection services.

Analytics and content personalization round out the picture. Some websites use lightweight fingerprinting to count unique visitors without cookies or to remember preferences (language, layout, accessibility settings) without requiring an account.

Browser Fingerprinting vs. Cookies

To understand why fingerprinting is so much harder to fight than cookies, it helps to compare the two side by side.

Cookies are small text files that websites store on your device. They're visible — you can find them in your browser settings, inspect them, and delete them in a few clicks. They're subject to extensive regulation: GDPR requires consent before setting tracking cookies, which is why consent banners now appear on nearly every website. Every major browser now blocks third-party cookies by default, or is in the process of doing so. And when you switch browsers or use incognito mode, your cookies don't follow.

Browser fingerprints work in the opposite direction. Nothing is stored on your device — the identifier is computed and stored on the server side from data your browser transmits automatically. There's nothing for you to find, inspect, block, or delete. Fingerprints persist across sessions and survive cookie clearing. They work in private browsing modes. And because they're derived from hardware and system-level characteristics, they can even track you across different browsers on the same machine — something cookies could never do.

The practical implications are stark. Cookies gave users at least the illusion of control: you could clear them, block them, or use extensions to manage them. Fingerprinting removes that control entirely. The data it relies on — screen resolution, GPU model, installed fonts — is data your browser must expose for websites to function. You can't opt out without breaking the web.

It's also worth noting that cookies and fingerprinting aren't always alternatives — they're often used together. Some tracking systems use fingerprints to respawn deleted cookies, a technique called evercookies. If you clear your cookies but your fingerprint stays the same, the tracker can associate you with your previous cookie and reinstate it. This makes the combination more powerful than either technique alone.

How Browsers Are Fighting Back

Browser vendors have recognized the threat and are actively developing countermeasures. But the approaches differ fundamentally, and each involves real tradeoffs.

Two Strategies for Anti-Fingerprinting

The first strategy is uniformity: make every user's browser look identical. If every browser reports the same screen resolution, the same fonts, and the same canvas rendering, there's no fingerprint to extract. This is the approach taken by Tor Browser and Mullvad Browser. Tor achieves this through aggressive standardization — it uses letterboxing to mask window sizes, restricts available fonts, blocks or standardizes canvas and WebGL outputs, and spoofs the User-Agent string. The goal is that every Tor user presents exactly the same fingerprint. The tradeoff is that many websites break or behave unexpectedly, and the browsing experience is noticeably slower.

The second strategy is randomization: make your fingerprint look different every time. If your fingerprint changes with every session and every website, it can't be used for persistent tracking. Brave pioneered this approach with its "farbling" system, which injects small amounts of random noise into canvas rendering, WebGL output, audio processing, language reporting, and font enumeration. The noise is large enough to defeat fingerprinting scripts but small enough that websites still function normally.

Both strategies have limitations. Uniformity reduces your anonymity set to other users of the same browser (and Tor's user base is small enough that simply using Tor can be a signal). Randomization can be defeated by statistical analysis — if a fingerprinter collects enough samples, they may be able to detect the noise and correlate sessions anyway.

Browser-by-Browser Breakdown

Brave offers the most aggressive built-in fingerprint protection of any mainstream browser. Its farbling system randomizes multiple high-entropy APIs by default, including canvas, WebGL, audio, language preferences, hardware concurrency, and font enumeration. Users can toggle between Standard and Aggressive protection modes. Brave also blocks WebRTC IP leaks by default and is the only major browser that explicitly labels its fingerprinting controls in the settings interface. Independent tests consistently rank it among the top performers, though academic research suggests its randomization can be partially defeated by sophisticated statistical attacks.

Firefox includes Enhanced Tracking Protection, which blocks known third-party fingerprinting scripts in its default and Strict modes. Firefox also offers a privacy.resistFingerprinting option (accessible via about:config) that standardizes many browser characteristics to reduce uniqueness — but this feature is disabled by default and can break websites. Out of the box, Firefox's fingerprint protection is weaker than Brave's. But it can be hardened significantly through manual configuration, and its blocklist-based approach effectively prevents most common third-party fingerprinting scripts from loading.

Safari takes a platform-level approach. Apple's Intelligent Tracking Prevention limits cross-site tracking, and Safari injects statistical noise into certain fingerprinting vectors. Starting with Safari 17, audio fingerprinting is disrupted in private browsing mode, font access is restricted to system-provided fonts for the user's language, and cross-site tracking scripts are aggressively blocked. Safari's protections are less configurable than Brave's, but they're effective within the Apple ecosystem — and Apple maintains the firmest industry stance on fingerprinting, calling it "never allowed" in its developer guidelines.

Chrome provides minimal built-in fingerprint protection. While Chrome's Enhanced Tracking Protection blocks some known trackers, it does not randomize or standardize fingerprinting surfaces the way Brave or Firefox can. Chrome is also rolling out Client Hints, which provide structured hardware data that can make fingerprinting easier, not harder. In February 2025, Google reversed its longstanding anti-fingerprinting position for its ad platform, allowing certain forms of fingerprinting for advertising and analytics — a decision the UK's Information Commissioner's Office publicly called "irresponsible."

Tor Browser remains the gold standard for fingerprint resistance. By standardizing every possible browser attribute across all users, it achieves the strongest anonymity of any browser. It blocks canvas reads, disables WebRTC, restricts fonts, and uses letterboxing to normalize window dimensions. The cost is significant: many modern websites are partially or fully broken, speeds are slower due to Tor network routing, and the small user base means that using Tor is itself a distinguishing characteristic.

Mullvad Browser is a hardened Firefox fork developed by the Mullvad VPN team in collaboration with the Tor Project. It applies many of Tor's anti-fingerprinting measures — standardized fonts, letterboxing, canvas protections — without routing traffic through the Tor network. This makes it faster and more compatible with modern websites while still providing strong fingerprint resistance. It's an excellent middle ground for users who want Tor-level protection with everyday usability.

How to Test Your Fingerprint

Before changing anything, it's worth seeing how identifiable your current setup actually is. Several free tools let you test your fingerprint right now:

Cover Your Tracks (by the EFF) is the most widely trusted testing tool. It tests whether your browser is vulnerable to tracking and shows how unique your configuration is compared to their database. This is the successor to the landmark Panopticlick project.

BrowserLeaks provides granular breakdowns of individual fingerprinting vectors — canvas, WebGL, audio, fonts, WebRTC, CSS media queries, and more. It's the best tool for understanding which specific attributes are making you identifiable.

AmIUnique is a research project by INRIA that shows your complete fingerprint alongside statistics about how many other users in their dataset share each attribute.

CreepJS is the most aggressive test. It actively tries to detect spoofed or randomized attributes, making it useful for evaluating how well your anti-fingerprinting tools actually hold up under adversarial conditions.

Try visiting these tools first in Chrome or Edge (where you'll likely find your fingerprint is entirely unique), and then in Brave or Tor to see the difference firsthand. The contrast is striking — and it makes the case for switching browsers more concretely than any article can.

How to Protect Yourself

Let's be direct: complete protection against browser fingerprinting is not possible without fundamentally breaking your browsing experience. But you can make tracking significantly harder. The goal isn't to become invisible — it's to make your fingerprint common enough that you blend into the crowd, or unstable enough that it can't be used to track you over time.

The Basics

Switch to a privacy-focused browser. This is the single most impactful step you can take — more effective than any extension or setting change. Brave offers the best balance of fingerprint protection and everyday usability for most people. Firefox with Enhanced Tracking Protection set to Strict is another strong option. Both are free and available on all major platforms.

Keep your browser and OS updated. Outdated browser versions are unusually identifiable because the vast majority of users are running recent releases. Keeping current means your User-Agent string blends in with the largest possible group. The same applies to operating system updates, which affect font sets, rendering engines, and other fingerprintable characteristics.

Be cautious with extensions. This is where fingerprinting gets counterintuitive. Installing five privacy extensions might feel like you're protecting yourself, but you're actually making your fingerprint more unique. Every extension modifies browser behavior in ways that can be detected — and the specific combination of extensions you run is itself a fingerprinting signal. Stick to a small number of well-established tools like uBlock Origin and resist the urge to add more.

Intermediate Steps

Install uBlock Origin. It blocks many known fingerprinting scripts before they can execute, and it's widely regarded as the most effective content blocker available. It won't stop first-party fingerprinting (where the website you're visiting runs the script itself), but it effectively blocks third-party fingerprinting trackers embedded on other sites.

Disable JavaScript on untrusted sites. Extensions like NoScript let you control which sites can run JavaScript. Since most fingerprinting techniques depend on JavaScript, this is a powerful countermeasure — though it will break functionality on many sites, so it requires a willingness to manage a whitelist. Note that CSS-based fingerprinting can still work even with JavaScript disabled, so this isn't a complete solution.

Use a VPN — but understand its limits. A VPN masks your IP address, which is one component of your fingerprint. It won't stop canvas, audio, or font fingerprinting. But it does remove a significant identifying signal and, when combined with browser-level protections, meaningfully reduces your overall identifiability. Make sure your VPN also blocks WebRTC leaks, or your real IP may be exposed regardless.

Advanced Measures

Use Tor Browser for sensitive browsing. When anonymity genuinely matters, Tor provides the strongest available protection. Accept the tradeoffs in speed and website compatibility, and resist the urge to customize it — every modification makes you more unique within the small Tor user base.

Compartmentalize your browsing. Use different browsers for different activities — one for social media, one for shopping, one for research. This prevents fingerprinters from building a complete cross-site profile of your behavior. It's a simple strategy that's surprisingly effective.

Consider Mullvad Browser. For users who want strong fingerprint resistance without the speed and compatibility limitations of Tor, Mullvad Browser applies Tor-level protections (letterboxing, standardized fonts, canvas blocking) without routing traffic through the Tor network.

The Privacy Paradox

There's an important irony in fingerprint protection that you should understand: the more you customize your browser for privacy, the more unique you become.

Disabling WebGL, blocking canvas access, spoofing your User-Agent, and installing niche privacy extensions all make your browser behave in unusual ways — ways that most people's browsers don't. A tracker might not be able to read your canvas fingerprint, but it can see that canvas access was blocked, and that behavior itself is a signal. If only 0.1% of users block canvas, you've just narrowed yourself into a very small group.

This is why the most effective anti-fingerprinting strategies are the ones used by the most people. Brave's randomization works partly because millions of Brave users share the same protection mechanism. Tor's uniformity works because every Tor user looks the same. The worst approach is to cobble together a unique combination of obscure privacy tweaks that nobody else is using — that's a fingerprint in itself.

What Doesn't Work

It's equally important to know what doesn't protect you:

• Incognito / Private browsing — These modes clear cookies and local storage but do not change your fingerprint. Your hardware, fonts, and rendering characteristics remain identical in and out of incognito.
• Clearing cookies and browsing history — Fingerprints don't depend on any stored data, so deleting local data has zero impact.
• VPN alone — A VPN changes your IP address but leaves every other fingerprinting attribute (canvas, WebGL, audio, fonts, screen, timezone, and more) untouched.
• Ad blockers alone — Ad blockers can block some third-party tracking scripts, but fingerprinting is increasingly run as first-party code on the websites you actually visit, which ad blockers don't touch.

The Legal Landscape

Browser fingerprinting occupies a legal gray zone — more restricted in theory than most companies acknowledge, but far less enforced in practice than cookies.

Europe: GDPR and the ePrivacy Gap

Under the EU's General Data Protection Regulation (GDPR), browser fingerprints are classified as personal data whenever they can be used to identify an individual — which, given that over 99% of fingerprints are unique, is essentially always. This means that fingerprinting for advertising or analytics requires a legal basis, typically explicit user consent.

In practice, enforcement has been uneven. The GDPR was designed to be technology-neutral, and it should cover fingerprinting as clearly as it covers cookies. But most regulatory attention has been directed at cookie consent, and fingerprinting's invisible nature makes it harder to detect and harder to enforce against. The EFF has argued that fingerprinting used for tracking purposes cannot rely on "legitimate interest" as a legal basis, because the very design of the technique is to evade user awareness and control.

The proposed ePrivacy Regulation aims to close this gap by explicitly applying the same consent requirements to fingerprinting that currently govern cookies. It's been working its way through the EU legislative process for years. If adopted, it would be a significant step toward treating all persistent tracking mechanisms equally, regardless of the underlying technology.

United States: A Patchwork Approach

In the U.S., the California Consumer Privacy Act (CCPA) and its successor, the CPRA, classify fingerprint data as personal information. California regulators have explicitly stated that fingerprint-based tracking constitutes cross-context behavioral advertising and requires an opt-out mechanism. Several other states with comprehensive privacy laws are following California's approach, but there is no federal fingerprinting regulation.

Industry Positions

Google publicly banned fingerprinting on its advertising platform for years — then reversed that position in February 2025, allowing certain forms of fingerprinting for advertising and analytics. The UK's Information Commissioner's Office called the move "irresponsible" and warned it would reduce people's ability to control their data. Apple maintains the opposite stance: fingerprinting is "never allowed" in its ecosystem, and Safari continues to aggressively restrict high-entropy API access. These diverging industry positions reflect the fundamental tension between the advertising model that funds much of the web and the growing demand for meaningful user privacy.

The Future of Browser Fingerprinting

The arms race between fingerprinters and browser vendors shows no signs of slowing.

On the tracking side, new web APIs continuously create new fingerprinting surfaces. WebGPU — the successor to WebGL — provides even deeper access to GPU capabilities and will likely become a powerful new fingerprinting vector as browser adoption grows. CSS-based fingerprinting is expanding the attack surface into environments where JavaScript is blocked, including email clients. Server-side fingerprinting, which moves analysis from client-side JavaScript to network-level signals like TLS handshakes and HTTP/2 frame ordering, is harder for browsers to counter because it happens outside the browser's control. And behavioral biometrics — mouse movements, typing patterns, touch gestures — represent a category of fingerprinting that no browser setting can prevent, because the signal comes from the user's body, not their software.

On the defense side, browser vendors continue tightening their APIs. Mozilla and Apple are investing in reducing the entropy exposed by their browsers. The W3C's Privacy Interest Group is working on standards that would limit fingerprinting surfaces without breaking web functionality. And emerging concepts like privacy-preserving attestation — proving you're a real human without revealing which human — could eventually reduce the legitimate need for fingerprinting in fraud prevention.

The most likely outcome isn't that fingerprinting disappears. It's that it becomes increasingly regulated, increasingly countered by browser-level protections, and increasingly visible to the public. The users who take steps now — choosing the right browser, understanding the techniques at play, and periodically testing their exposure — will be significantly harder to track than those who don't.

And that's a meaningful difference, even if it's not a perfect one.

---

Want to see how privacy-focused browsers stack up against the mainstream options on fingerprint protection and more? Explore our browser comparisons to find the right browser for you.