Websites can recognize you without cookies. Here is what actually helps.

Your browser has a face, not just a name tag.

A cookie is a name tag. A website pins it on you, and you can take it off whenever you like. Clear your history, open a private window, click Reject All, and the tag is gone.

A fingerprint is your face. Nobody pins it on you. The website simply looks at your browser, notices a few dozen small details about it, and remembers the combination. There is nothing on your computer to delete, because the record lives on their server, not yours.

This article explains what those details are, why the usual privacy habits do so little about them, which popular fixes make things worse, and the handful of moves that hold up in real tests. You can also see your own browser's face at any time by running the Browser Fingerprint and Multimedia tests on this site.

What a website can see without asking

Every time you load a page, your browser volunteers a surprising amount about itself. Some of it arrives before any code runs:

• Your public IP address, which is written onto every packet by your network, not your browser.
• Your "user agent," a short text label stating your browser and operating system.
• Your preferred languages, screen size, time zone, and whether you are on a touchscreen.

Then, once the page's scripts run, they can ask for more:

• Which fonts you have installed.
• What your graphics hardware reports about itself.
• How your machine draws a short line of hidden text onto an invisible canvas. Two computers given the same drawing instructions produce slightly different pixels because fonts, operating systems, and graphics chips each round the edges a little differently. The researchers who first described this in 2012 noted that the whole test runs off-screen in a fraction of a second with no visible sign that anything happened (Mowery and Shacham, UC San Diego).

No single item identifies you. Together they often do. When the Electronic Frontier Foundation first measured this in 2010, 83.6 percent of the roughly 470,000 browsers it tested had a fingerprint shared with nobody else in the dataset (EFF, How Unique Is Your Web Browser?).

Why Reject All does not help with this

Here is the part most people have not heard. In 2021, researchers visited tens of thousands of consent banners three different ways: ignoring the banner, rejecting everything, and accepting everything. Of the sites that ran fingerprinting code, 73.5 percent ran it in all three cases, and only 2 percent waited to see what the visitor clicked. The authors concluded that sites were using fingerprinting as a fallback for when the law stopped them from setting a cookie (Papadogiannakis et al., How Websites Bypass GDPR Consent).

That is not a bug in the banner. It is the design. The banner governs what a site may store on your device. Fingerprinting stores nothing on your device, so the banner has nothing to say about it.

Why clearing everything does not help much either

If a site has your face on file, it can give you a fresh name tag every time you take the old one off.

A 2022 study of the top 30,000 websites looked for exactly this. The researchers cleared all browser storage, came back, and checked whether the same cookie reappeared with the same value. They found 1,425 of these "respawned" cookies across 1,150 sites. The clever part is which measurements were doing the work: the IP address was involved in 47 percent of cases and the user agent in 34 percent, well ahead of canvas drawing (Fouad et al., My Cookie is a Phoenix).

The same paper describes how the two methods back each other up. If you delete the cookie, the fingerprint restores it. If your fingerprint drifts because you updated your browser, the cookie bridges the gap. The tracker only loses the thread when both change at the same time. Hold on to that detail, because it is the basis for one of the practical fixes below.

Why your ad blocker mostly sits this one out

Ad blockers are worth keeping. They are just the wrong tool for this job.

In May 2025, a team from UC San Diego and Mozilla crawled roughly 40,000 sites three times: once plain, once with Adblock Plus, and once with uBlock Origin. Both blockers reduced the number of sites collecting a canvas fingerprint by about 5 percent. Nearly half of the fingerprinting sites served the fingerprinting code from their own domain, and vendors openly encourage customers to bundle the library into the site's own files so there is no separate address to block (Luo et al., Canvassing the Fingerprinters).

A blocker works from lists of known tracking addresses. When the tracking code arrives inside the same file that makes the shopping cart work, blocking it means breaking the site, and no blocker wants to be the one that broke your bank.

Not all fingerprinting is advertising

This matters for deciding how hard to fight. In that same 2025 crawl, the single largest fingerprinting vendor on popular sites was Akamai, a security company, and several others on the list sell bot detection and payment fraud prevention rather than ads (Luo et al.). Your bank fingerprints you partly so that someone who steals your password still looks wrong when they log in from an unfamiliar machine.

So the realistic goal is not to become invisible to every site. It is to stop unrelated sites from recognizing you as the same person, and to make sure the sites you do trust cannot follow you around the rest of the web.

The fixes that make you easier to spot

This is the section that saves people the most trouble, because the instinctive moves are often the harmful ones.

User agent spoofers. These extensions tell websites you are running a different browser or operating system. In 2013, researchers studied eleven of them with more than 800,000 combined users and found the users were more identifiable than people who never tried to hide. The extensions changed the label but left everything else honest, producing impossible combinations like Internet Explorer on Linux or an iPhone with a 1920 by 1080 monitor. A tracker does not need to defeat the disguise; it just records the contradiction as one more distinguishing feature. The authors advised against using them at all (Nikiforakis et al., Cookieless Monster).

Small, clever anti-fingerprinting extensions. A 2018 study found that every countermeasure it tested could be detected, but detection only hurts when few people use the tool. Being spotted as a Brave or Firefox user puts you in a crowd of millions. Being spotted as one of 21,000 users of a canvas noise extension whose random noise never changes effectively hands the tracker a serial number (Vastel et al., FP-Scanner). The 2026 commercial test described below made this concrete: with the Font, AudioContext, and WebGL "Fingerprint Defender" extensions installed, the tracker kept recognizing the browser even after its IP address changed, which did not happen with any other setup (Luo et al., Understanding Server-side Commercial Fingerprinting).

Do Not Track. Apple removed the setting from Safari because so few people turned it on that enabling it made them stand out (WebKit Tracking Prevention).

Piling on extensions in general. Each one can leave small traces in how pages behave, and the EFF paper flagged this pattern back in 2010 under the heading "the paradox of fingerprintable privacy-enhancing technologies." All seven users of one obscure privacy browser in its dataset were unique (EFF).

The rule that falls out of all of this: a defense shared by millions beats a cleverer one shared by thousands.

What actually held up against a commercial tracker

For years, the advice above was based on theory. In 2025, the UC San Diego and Mozilla team bought a paid account with the market-leading commercial fingerprinting service and ran different browsers at it to see which ones it could recognize again. Their findings, published in 2026 (Luo et al.):

Three lessons stand out.

First, changing your IP address through a VPN defeated the product for most setups. The weakest-looking input, the one your browser does not even send, is also the one you have the most control over.

Second, the product's real staying power came from two ordinary cookies with a one-year lifespan. The researchers found that keeping those cookies overrode every other change they made, including switching browser, operating system, and IP address at once. The industry's answer to people deleting cookies turns out to rely heavily on a cookie. That is good news for you, because it means clearing site data is not pointless. It only looks pointless when you do it alone.

Third, the two defenses that held without a VPN, Tor and Firefox's Resist Fingerprinting mode, both work by making every user look identical rather than by adding random noise. The "uniform" approach beat the "costume" approach in this test. Brave's randomization is still valuable against the free, client-side version of the same library, which every tool defeated, and Brave's own engineers are candid that fingerprinting is "an extremely difficult problem to solve without breaking the Web" (Brave, Fingerprinting Defenses 2.0).

Some good news you may not expect

Fingerprinting is getting harder, not easier, for ordinary devices. A 2018 analysis of two million fingerprints collected on a major French website found that only 33.6 percent were unique, down from more than 80 percent in earlier studies, largely because browsers dropped plugins like Flash and Java. Mobile devices were even less distinctive, with only 18.5 percent unique, because phones are so similar to each other (Gomez-Boix et al., Hiding in the Crowd).

The same study has a warning attached: non-unique fingerprints are fragile. Change one attribute, such as your time zone or language setting, and the fingerprint very probably becomes unique again. In plain terms, a stock phone or a stock, up-to-date browser is already a decent uniform. Customizing it is what makes you stand out.

What to do, in order of effort

Everyone, in five minutes

1. Keep your browser updated and otherwise stock. Updates move you into the current crowd. Unusual fonts, themes, and settings move you out of it.
2. Use a mainstream browser with protection built in. Safari, Firefox, and Brave all ship fingerprinting defenses used by millions. You do not need to add anything to get the baseline.
3. Keep your ad blocker, but know its limits. It blocks ads and a great deal of conventional tracking. It does little against fingerprinting, so do not treat it as proof you are covered.
4. Remove extensions you do not actively use. Each one is a potential distinguishing mark, and the privacy-themed ones are the riskiest of all.
5. Never install a user agent spoofer. Over 800,000 people already ran that experiment.

If you want real separation between parts of your life

6. Use a VPN you trust for browsing you do not want linked to your home connection. In the commercial test, changing the IP address was the single most effective move short of Tor. Choose a large, reputable provider; a VPN with a small user base can itself become a distinguishing mark, and a free one may be selling what it sees. Our VPN and leak tests will confirm the VPN is actually carrying your traffic and not leaking your real address through DNS or WebRTC.
7. When you clear, clear everything at once. Trackers survive one change at a time. Clear site data and switch networks or VPN locations in the same sitting, then close and reopen the browser. That is the combination the research says breaks the link.
8. Give sensitive activity its own browser. Use one browser for banking and work, another for everything else. Fingerprints do not cross between separate browsers, so an advertiser on a news site cannot connect that visit to your bank's session.
9. Reach for your phone for one-off sensitive lookups. A stock phone browser blends into a much larger crowd than a customized desktop.

If you need to be genuinely hard to recognize

10. Turn on Firefox's Resist Fingerprinting mode in a dedicated profile. It held against the commercial product in testing. It also breaks some sites, reports a fixed time zone, and resizes windows, which is why it belongs in a separate profile rather than your daily browser.
11. Use Tor Browser for the handful of things that truly require anonymity. It was the only setup that held even when the IP address changed. It is slow, some sites refuse it, and it is overkill for daily use. Treat it as a tool you pick up for a task, not a place you live.

Check your own browser

A fingerprint test gives you one number out of context. The useful experiment is to run it twice.

1. Run the Browser Fingerprint and Multimedia tests and note the canvas, WebGL, and audio values.
2. Close the browser completely, reopen it, and run them again.

If the values are identical, that is your stable face, and any site can recognize it next visit. If you are on Brave or Firefox with protection enabled, the canvas value should change between sessions, which is the protection working. If you installed a noise extension and the values look scrambled but stay the same across sessions, you have found the serial number problem described above, and removing that extension is the fix.

Sources

• Papadogiannakis, Papadopoulos, Kourtellis, Markatos. How Websites Bypass GDPR Consent to Track Users. WWW 2021. arxiv.org/pdf/2102.08779
• Fouad, Santos, Legout, Bielova. My Cookie is a Phoenix: Cookie Respawning with Browser Fingerprinting. PoPETs 2022. petsymposium.org
• Eckersley. How Unique Is Your Web Browser? EFF, 2010. coveryourtracks.eff.org
• Nikiforakis, Kapravelos, Joosen, Kruegel, Piessens, Vigna. Cookieless Monster. IEEE S&P 2013. securitee.org
• Mowery, Shacham. Pixel Perfect: Fingerprinting Canvas in HTML5. W2SP 2012. hovav.net
• Acar, Eubank, Englehardt, Juarez, Narayanan, Diaz. The Web Never Forgets. CCS 2014. kuleuven.be
• Luo, Ritter, Savage, Voelker. Canvassing the Fingerprinters. IMC 2025. sysnet.ucsd.edu
• Luo, Ritter, Savage, Voelker. Understanding Server-side Commercial Fingerprinting. WWW 2026. sysnet.ucsd.edu
• Vastel, Laperdrix, Rudametkin, Rouvoy. FP-Scanner. USENIX Security 2018. usenix.org
• Gomez-Boix, Laperdrix, Baudry. Hiding in the Crowd. WWW 2018. dl.acm.org
• Brave. Fingerprinting Defenses 2.0. brave.com
• WebKit. Tracking Prevention in WebKit. webkit.org

The simple guide above is enough for almost everyone. These notes are for readers who want the mechanics behind the advice.

Advanced notes

• Passive beats active. In the respawning study, IP address and user agent, neither of which require JavaScript, rebuilt more identifiers than canvas and WebGL combined. Script blockers alone cannot address them; network-level changes can.
• Randomization is detectable. In the 2025 crawl, 45 percent of fingerprinting sites rendered the test canvas twice, which is a way to detect per-call noise. Brave avoids the simple version of this by keeping its randomized values consistent within a session per site and changing them between sessions.
• Firefox Strict versus RFP. Strict Enhanced Tracking Protection adds persistent canvas noise and standardizes fonts; it was re-identified. Resist Fingerprinting returns uniform values across many APIs and blocks canvas readback; it was not. The difference between the two outcomes was a single preference.
• Safari's cookie caps blunt the one-year cookie. Safari deletes script-written cookies after seven days without interaction and caps cookies from cloaked third parties at seven days, although the commercial vendor documents ways to route around that by proxying through a first-party CDN (WebKit; Luo et al.).
• Attribution limits. All the crawl studies measure homepages, detect specific known libraries, and can miss obfuscated code. Treat their counts as floors, not ceilings.

The sources for every figure cited here are listed at the end of the Simple version of this guide.