How Browser Fingerprinting Identifies You Without a Cookie

What is browser fingerprinting?

Multiple technical signals reported by a visitor's browser and device, combined into a single identifier without setting a cookie, are what browser fingerprinting uses to re-identify that visitor on a later visit. Each signal on its own, such as screen resolution or installed fonts, is common to many devices, but the specific combination of dozens of signals is rare enough to re-identify one device across separate visits. A site can compute this fingerprint from information the browser already sends or exposes to any page it loads, which is what makes the technique possible without explicit tracking software.

What signals build a browser fingerprint?

A browser fingerprint is built from signals including canvas rendering output, the list of installed fonts, screen resolution and color depth, the user agent string, and the browser's reported timezone. Canvas fingerprinting works by asking the browser to draw a hidden image and reading back the resulting pixels, since small differences in graphics hardware and drivers make that output vary slightly between devices even when the drawing instructions are identical. The user agent string reports the browser name, version and operating system, while the timezone and installed font list narrow the pool of matching devices further with each signal added.

What is entropy and why does it matter for fingerprint uniqueness?

Entropy measures how many bits of identifying information a signal contributes, and a fingerprint's overall uniqueness comes from combining signals with enough total entropy to separate one device from the pool of every other device sharing similar hardware. A common signal, such as "uses Chrome," contributes very little entropy on its own since millions of devices share it, but a rare font list or an uncommon combination of screen resolution and timezone can narrow the matching pool down sharply. Combining ten or more medium-entropy signals is what turns a fingerprint from "probably matches thousands of devices" into "matches one specific device with high confidence."

Why does browser fingerprinting survive cookie deletion?

Browser fingerprinting survives a cookie deletion because the signals it reads come from the browser and operating system configuration itself, not from a file stored by a specific site. Deleting cookies removes the identifiers a site wrote to the visitor's device, but it does not change the visitor's screen resolution, installed fonts, or how their graphics hardware renders a canvas element, so recomputing the fingerprint on the next visit produces the same or a very similar result. This is the property that separates fingerprinting from cookie-based tracking: clearing storage defeats a cookie, but it does not defeat a fingerprint built from hardware and configuration signals.

What is the legal position on browser fingerprinting under GDPR?

Under GDPR, a browser fingerprint that can single out and re-identify a specific device counts as personal data, and collecting it for tracking purposes needs the same lawful basis and consent that a tracking cookie needs. The ePrivacy Directive's consent requirement applies to storing or accessing information on a device regardless of whether that information is called a cookie, so reading canvas output or font lists to build a fingerprint falls under the same rule as reading a cookie value. A site that runs fingerprinting scripts before a visitor has given tracking consent is processing personal data without the required legal basis, whether or not it ever calls the technique a cookie.

How is fingerprinting different from other forms of cross-site tracking?

Fingerprinting identifies a single device using signals collected on one site at a time, while other forms of cross-site tracking rely on a shared identifier, such as a third-party cookie or an ad network pixel, deliberately placed across multiple sites. Fingerprinting does not require the sites involved to share a common tracking partner, since each site can independently compute a similar fingerprint from the same underlying device signals. This is part of why fingerprinting is harder to block with a single setting: a third-party cookie can be disabled at the browser level, but the underlying signals fingerprinting reads are exposed to any page by default unless the browser specifically restricts them.

Frequently Asked Questions

Can I block browser fingerprinting completely?

Not completely, since some signals a fingerprint relies on, such as screen resolution, are difficult to hide without breaking how a page renders. Browser settings that restrict canvas access, randomize reported values, or block known fingerprinting scripts reduce the fingerprint's accuracy but cannot remove every signal a site can read.

Is browser fingerprinting illegal?

Browser fingerprinting is not illegal by itself, but using it to identify and track a specific device without the consent GDPR and the ePrivacy Directive require for that purpose is unlawful in the EU. The legal question is not the technique but whether it is used to single out a device without a valid legal basis.

Does clearing my browser cache stop fingerprinting?

No, clearing cache and cookies removes stored identifiers a site wrote, but it does not change your screen resolution, installed fonts, or how your hardware renders a canvas element, which are the signals fingerprinting actually reads. A recomputed fingerprint on your next visit can still match the same device.

How is browser fingerprinting different from a first-party cookie?

A first-party cookie is a value the site itself writes to your browser and reads back on a later visit, and deleting it removes the identifier entirely. A browser fingerprint is derived from your device's own configuration and hardware behavior, so there is no single stored file to delete.

Do incognito or private browsing modes prevent fingerprinting?

Private browsing modes clear cookies and history at the end of a session, but most of the signals used in fingerprinting, such as screen size, installed fonts and user agent, are unaffected by private mode and remain readable to any page loaded during that session.

Why do privacy-first analytics tools avoid fingerprinting?

Fingerprinting identifies an individual device without consent, which conflicts directly with cookie-free analytics that are built to operate under GDPR without collecting personal identifiers. Flowsery's privacy-first analytics is built cookie-free and EU-hosted specifically so a site does not need a fingerprint or a cookie banner to measure traffic.

How many signals does it take to build a unique browser fingerprint?

There's no fixed number, but combining ten or more medium-entropy signals is generally what turns a fingerprint from matching thousands of devices into matching one specific device with high confidence. Signals like canvas output, installed fonts, screen resolution, user agent and timezone are typically combined to reach that point. Fewer signals, or ones shared by many devices, leave the match spread across a larger, less certain pool.

What does a browser fingerprint actually look like?

A browser fingerprint isn't a file or an image, it's a single hash value computed by combining signals such as canvas rendering output, installed fonts, screen resolution, user agent string and timezone. The same combination of inputs produces the same hash, so a site can recompute it on a later visit and check for a match. There's nothing to open or view, only a value to compare.

Can two different devices end up with the same browser fingerprint?

Two devices can produce the same fingerprint when their combined signals don't carry enough entropy to separate them from others with similar hardware and settings. A common signal like using Chrome contributes very little on its own, since millions of devices share it, so two machines with the same browser, screen resolution and timezone can end up matching. Adding more signals, especially rare ones like an unusual font list, narrows that pool and cuts the chance of a collision.

Does a browser fingerprint count as personal data if it isn't tied to my name?

It can, since GDPR classifies a fingerprint as personal data whenever it can single out and re-identify a specific device, whether or not it's linked to a name or email address. The legal threshold is the ability to distinguish one device from others, not the presence of an identity attribute. That's why fingerprinting scripts need the same consent as a tracking cookie once they're used for that purpose.