The tracker that survives a VPN and Incognito
Imagine this: a small JavaScript page opens in your browser, then in Incognito mode mode, then with your VPN active. Each time, it returns the exact same unique identifier. This simple demonstration reveals a tracking method that bypasses common privacy tools.
Many think Incognito mode mode makes you invisible online. Not quite! It primarily limits local data, like browsing history and cookie persistence, on your device. A VPN, meanwhile, reroutes your internet traffic and changes your visible IP address, obscuring your physical location. Neither fundamentally alters the characteristics of your browser itself.
Here’s the key distinction: traditional tracking often relies on cookies, small files websites store on your computer to "remember" you. Browser fingerprinting is different. It infers identity by collecting information your browser voluntarily provides to every website you visit, without storing anything locally. This means no cookies are set, and no local state needs to be cleared.
A handful of harmless details becomes a signature
Imagine a game of 20 Questions, but for your computer. Browser fingerprinting starts by asking your browser for seemingly harmless details: screen dimensions, preferred language, time zone, browser version, and even processor core count. Individually, these details are common, but when combined, they quickly narrow down the pool of possible devices, eliminating many contenders with each new data point.
This elimination principle is about entropy—the amount of information needed to distinguish one item from a set. Around 33 bits of entropy can theoretically identify one item out of 8.6 billion. While your browser's initial details might not reach that level of uniqueness, they often generate enough entropy to make your device highly distinguishable within a given population of users.
Trackers don't stop there; they use active probes to gather even more specific details. Canvas rendering, for example, can draw hidden graphics and text. Subtle differences in your graphics hardware, installed fonts, and how your browser renders pixels create a unique image, which can then be converted into a distinct identifier.
Another technique is Web Audio API fingerprinting. A script can generate a sound, process it through various audio effects, and then analyze the output. Tiny variations in how your specific hardware and software process these audio signals result in a unique "audio fingerprint." These fingerprints are probabilistic and can change slightly after software updates, but they still offer a powerful way to recognize your browser without cookies.
Why the same trick helps security—and surveillance
Browser fingerprinting presents a fascinating dual-use dilemma: it can be a powerful tool for security, but also a stealthy method for surveillance. Fraud prevention teams, for instance, leverage these unique browser "signatures" to spot suspicious activity. Imagine a bot attempting hundreds of login attempts or creating multiple fake accounts; a consistent fingerprint across these actions raises a red flag for automated systems.
These signals are not definitive proof of wrongdoing, but they provide crucial context for security analysts. They help identify automated attacks, credential stuffing, and other malicious behaviors that might otherwise go unnoticed. The same underlying techniques that help secure your online banking also aid in detecting sophisticated bots.
Contrast this with the ad-tech industry, where fingerprinting can attempt to track users even when they block or clear cookies. While not every fingerprint is unique for every user, and not every website employs this, the intent is often to re-identify users across sites for targeted advertising, bypassing traditional consent mechanisms.
This brings us to a significant privacy concern. Regulators in various jurisdictions may treat browser fingerprinting as accessing or storing information on a user's device, similar to cookies. Therefore, simply avoiding cookies does not automatically mean a site is free from consent requirements. You can test your own browser's uniqueness at Cover Your Tracks - Electronic Frontier Foundation.
Enjoying this? Get one like it in your inbox each morning.
one email a day · unsubscribe in two clicks · no third-party tracking
How to check your fingerprint—and blend in
Curious about your browser’s distinctiveness? Head over to the EFF’s Cover Your Tracks or AmIUnique to run a quick diagnostic. These sites will show you which of your browser’s attributes—like screen size or installed fonts—contribute to a unique signature. Remember, these tests are snapshots; browser versions and settings change, so your fingerprint can evolve.
Rather than stacking privacy extensions, which can sometimes make you stand out more, look for browsers with built-in protections. Tor Browser and Mullvad Browser aim to make all users look nearly identical, making it harder to single anyone out. Other browsers, like Brave, Firefox, and Safari, offer varying degrees of fingerprinting defense. For example, a Firefox update reduced the number of unique users in Incognito mode mode by almost half.
To blend in better, keep your browser updated and avoid unnecessary add-ons that might expose unique details. After making changes, retest your browser’s fingerprint. No browser setting or VPN guarantees complete anonymity, and stronger protection often requires accepting trade-offs in compatibility or convenience.
Frequently Asked Questions
What is browser fingerprinting?
It combines details about your browser, device, and settings to recognize a browser without storing a cookie.
Can a VPN stop browser fingerprinting?
No. A VPN can mask your IP address, but it does not change most browser and device traits that contribute to a fingerprint.
Does Incognito mode prevent fingerprinting?
No. Incognito mode limits what is saved locally between sessions, but websites can still read browser characteristics.
How can I test my browser fingerprint?
Use the EFF’s Cover Your Tracks or AmIUnique. These tools show how distinctive your browser appears among tested browsers.