We tend to think of online tracking in fairly simple terms. A website places a cookie in our browser, the cookie remembers something about us, and advertisers use it to follow us around the internet. If we do not like it, we delete the cookies, open an incognito window, or turn on a VPN and assume we have disappeared.
Unfortunately, the modern web is a little more complicated than that.
A website does not necessarily need to store anything on your computer to recognize you. Your browser already reveals a surprising amount of information simply by doing its job. Your operating system, screen resolution, language, timezone, browser capabilities, installed fonts and other characteristics can all become pieces of a larger picture. When enough of these pieces are combined, they can create something remarkably similar to a digital fingerprint.
This is known as browser fingerprinting.
The idea is simple. Imagine walking into a crowded room and trying to identify someone without asking their name. You might notice that they are wearing glasses, are unusually tall, speak with a particular accent and carry a certain type of phone. None of those details identifies them on its own. Put them together, however, and you may have a pretty good way of recognizing the same person the next time you see them.
Browser fingerprinting works in much the same way.
A website can collect characteristics from your browser and device and combine them into a fingerprint. The resulting identifier does not necessarily contain your name, email address or physical location. It can simply tell a website that the browser visiting it now looks like the browser that visited it yesterday.
That fingerprint can become much more useful once it is associated with an account, purchase or other identifiable information. What initially looked like an anonymous collection of technical details can eventually become connected to a real person.
What makes fingerprinting particularly interesting is that many of the characteristics being collected seem harmless. Your screen resolution does not appear particularly revealing. Neither does your timezone or the list of features your browser supports. But when dozens of these small details are combined, they can become surprisingly distinctive.
And the browser can reveal more than information about itself. It can also reveal information about the machine underneath it.
Modern websites can access powerful graphics capabilities through technologies such as WebGL and WebGPU. These allow browsers to run games, render 3D graphics and perform increasingly sophisticated visual computations.
The problem is that these capabilities can also expose information about the hardware being used. Details about a computer's GPU, graphics capabilities and other characteristics can help distinguish one machine from another.
A website can also ask your browser to draw something using technologies such as Canvas or WebGL and then examine the result. Small differences in the way graphics are rendered can come from combinations of hardware, drivers, operating systems and software. The image may look completely normal to you, while the underlying data contains subtle differences useful for distinguishing one machine from another.
Your computer does not necessarily have to announce exactly what hardware it has. Sometimes the way it behaves can be enough.
This is where the technology becomes both useful and uncomfortable.
From a business perspective, recognizing a device is not necessarily a bad thing. Banks, payment providers and online services can use device characteristics as one signal when detecting fraud. The same techniques can help identify automated bots, suspicious account creation, payment fraud and other forms of abuse.
In those situations, device fingerprinting can be a security tool rather than an advertising tool.
The problem is that the same technology can also be used to track people.
Imagine visiting several unrelated websites. Each website can potentially observe characteristics of your browser. If the same tracking company operates across those websites, those characteristics can become a common thread. The tracker may not initially know your name, but it can recognize that the same browser keeps appearing.
This creates an uncomfortable possibility: your activity can be connected without relying on a traditional cookie.
That matters because cookies are at least relatively visible. We have become accustomed to cookie banners and privacy settings. Fingerprinting is considerably less obvious. There is no little file sitting in your browser that you can simply delete. The information used to recognize you can instead be reconstructed from the characteristics your browser naturally exposes.
You can delete every cookie from your browser, but that does not change the size of your screen, your graphics hardware, your operating system or many of the other characteristics that contribute to a fingerprint.
Private browsing has similar limitations. Incognito mode can prevent your browser from retaining certain information locally, but it should not be confused with becoming anonymous to websites. A website can still observe the characteristics your browser exposes.
Even a VPN solves a different problem. A VPN can hide your normal IP address, but it does not automatically change the characteristics of your browser or hardware.
This is why fingerprinting represents a different layer of online tracking.
The challenge for browsers is that many of the things that make fingerprinting possible are also necessary for the modern web to function.
Websites need to know which features your browser supports. Games need access to graphics capabilities. Applications need to understand the environment in which they are running. A browser that hides absolutely everything would be very private, but it would also be a frustrating browser to use.
This creates a balancing act. Browsers need to give websites enough information to function without giving trackers enough information to create a highly distinctive and persistent identity.
One approach is to reduce or obscure hardware-related information and make certain signals less stable. Another is to make large numbers of browsers look more alike, so that it becomes difficult to distinguish one user from another.
The broader idea is simple: if your browser cannot be distinguished easily from thousands of other browsers, fingerprinting becomes much less useful.
And that is perhaps the most important thing to understand about browser fingerprinting. Privacy protection does not necessarily have to make every user completely invisible. It can instead prevent one user's browser from becoming uniquely recognizable.
The web is becoming increasingly powerful. A browser that was once little more than a document viewer can now run games, video editors, 3D applications and sophisticated computing workloads. But every new capability can potentially expose another piece of information about the machine behind the browser.
For businesses, those pieces of information can help prevent fraud and abuse. For ordinary users, the same information can become another mechanism for tracking behaviour across the internet.
Your computer does not have to give a website your name for it to become recognizable. Sometimes, all it has to do is behave like itself. And the more distinctive that behaviour becomes, the easier it is for the internet to remember you, even when you thought you had forgotten it.
