Browser Fingerprinting: Why Incognito and VPNs Don't Hide You

Browser fingerprinting is how websites recognize your exact device without cookies: they combine dozens of small traits — your screen size, fonts, graphics card, time zone, even how your browser draws an invisible image — into an ID that survives incognito mode, cookie clearing, and a VPN. You cannot delete a fingerprint; you can only make it less unique. The two moves that genuinely help: use Brave, or open Firefox's settings and set Enhanced Tracking Protection to Strict. Then test yourself at EFF's Cover Your Tracks. Everything else on this page explains why those two moves work and why most popular advice does not.

And here is the part almost nobody noticed: on February 16, 2025, Google started allowing companies using its advertising products to track people by fingerprinting — the same Google that in 2019 banned the technique and called it wrong because it "subverts user choice." The UK's data-protection regulator publicly called the reversal "irresponsible." Fingerprinting is not a fringe trick anymore. It is now inside the mainstream ad economy, which is exactly why this page exists.

Jake called on a Tuesday, annoyed. He runs a small phone shop, and he had priced a bulk order of tempered-glass screen protectors on a wholesale site: $52 for forty units. He slept on it. Wednesday morning, same site, same forty units — $61. "I even opened it in incognito," he said. "It still showed the higher price. How does it know it's me?"

Ethan: "I can't promise that specific price move was tracking — wholesale prices bounce around for boring reasons too, stock, currency, supplier mood. But the part that bothers you, the it still knew it was me in incognito part? That's real, it has a name, and it's worth the next twenty minutes of your life. It's called browser fingerprinting."

Jake: "I thought tracking meant cookies. I clear cookies. There's a banner on every site making me click about cookies."

Ethan: "Cookies are a name tag a site sticks on you. You can peel a name tag off. A fingerprint is different — it's the way you walk into the room. You don't carry it. You are it."

What a browser fingerprint actually is

When your browser loads a page, it answers questions. Some it answers because the web cannot work otherwise — your screen size, so the layout fits; your language, so you get the right text; your time zone, so times display correctly. Each answer is harmless alone. Almost everyone has one of a few common screen sizes. Millions of people share your time zone.

The trick is combination. Screen size narrows you to one in five. Add the exact list of fonts installed on your machine: one in a few thousand. Add your graphics card model, your operating system build, your language list, whether you have touch support, how many CPU cores your machine reports — and the crowd you are hiding in shrinks from billions to, very often, exactly one.

Ethan's version for Jake: "Your shop has regulars you recognize without asking their names. Tall guy, red helmet, always pays cash, always asks for the matte protector. No single trait identifies him — plenty of tall guys, plenty of red helmets. Together? You greet him before he reaches the counter. A fingerprinting script is that recognition, automated, across millions of visitors, with about thirty traits instead of four."

This is not theoretical. The study that started the whole field — the Electronic Frontier Foundation's Panopticlick project, back in 2010 — tested roughly half a million browsers and found that 83.6 percent of them had a completely unique fingerprint. Among browsers with Flash or Java installed, it was 94.2 percent. Flash and Java are dead now, but the signals that replaced them are richer, not poorer.

Two properties make fingerprints nastier than cookies. First, there is nothing to delete. A cookie is a file on your machine; a fingerprint is a description of your machine. Clearing your browser data clears the name tag, not the walk. Second, you cannot see it happening. Cookie banners exist because cookies are visible and regulated in ways that force disclosure. A fingerprinting script just reads properties any page can read, silently, in milliseconds.

How sites build the fingerprint

You do not need to read a line of code to understand the three big signal families. Knowing them is what makes the myths later on obvious.

Canvas: the invisible drawing test

Every modern browser can draw graphics on a page — that's the HTML canvas, the thing browser games and chart tools use. A fingerprinting script asks your browser to draw a short sentence and some colored shapes on a canvas you never see, then reads the result back pixel by pixel and boils it down to a short code called a hash.

Here's the beautiful, horrible part: different machines draw the same picture differently. Your graphics card, its driver version, your operating system's font smoothing and sub-pixel rendering all nudge individual pixels by amounts no human eye would catch. The hash catches them perfectly. Same script, same sentence — a different code on your laptop than on the identical model one shelf over at Jake's shop, because the driver version differs. That code alone typically narrows you to a small group, and it costs the tracker one invisible drawing.

Jake: "So the website hands my browser a coloring book, and the way my computer colors inside the lines gives me away?"

Ethan: "That is genuinely the best one-line summary of canvas fingerprinting I've heard."

The same idea extends to WebGL — the 3D graphics system — which additionally reveals your GPU model and renderer string, and to the audio system, where a script generates a sound it never plays and measures tiny device-specific differences in how your machine processes it.

Fonts: the library card

Your installed font list is a biography. Windows, macOS, and Linux ship different base sets, so fonts reveal your OS immediately. Then every application you've installed over the years has quietly added its own — office suites, design tools, that label-printing program Jake installed in 2022. A script measures how wide a test sentence renders in hundreds of font names; if the width changes when asking for a font, you have it installed. The result is a list nearly as personal as your app history, readable by any page.

Hardware and environment signals

The long tail is where uniqueness compounds. Pages can read your reported CPU core count, approximate device memory, screen resolution and pixel density, color depth, touch capability, battery presence on some platforms, language preference list, time zone, and which media formats and DRM systems your browser supports. Your browser also announces its exact version in every request. None of these is secret or exotic — they exist so sites can adapt to your device. Fingerprinting is the act of reading all of them at once and treating the combination as your name.

Cookies vs. fingerprints: why one has a banner and the other doesn't

Most privacy advice you've read was written for cookies, which is exactly why it fails against fingerprinting. The two techniques answer the same question — "is this the same visitor as yesterday?" — from opposite directions, and every defense that works on one is useless against the other. Seeing them side by side explains ten years of confusing advice in one glance:

That fourth row is the answer to a question Jake asked with genuine irritation: "Why does every site nag me about cookies but nobody ever asked permission to fingerprint me?" Because cookie consent became law when regulators could point at a visible, stored thing. A fingerprint stores nothing, shows nothing, and asks nothing — which is precisely why the ad industry moved toward it when cookie blocking got good.

Five things everyone believes about it — four are wrong

Belief 1: "Incognito mode hides me" — wrong

Incognito (Chrome), InPrivate (Edge), and Private Browsing (Firefox, Safari) do one job well: they throw away cookies and history when the window closes, so the next person on the computer can't see where you went. They are a privacy tool against your family, not against the internet.

Your fingerprint in incognito is nearly identical to your normal one — same screen, same fonts, same GPU, same canvas hash. A site running a fingerprinting script recognizes the returning device instantly, which is exactly what Jake experienced with his $61 quote. The purple mask icon does not change how your machine draws a picture.

Belief 2: "I block cookies, so I can't be tracked" — wrong

Blocking third-party cookies was worth doing, and browsers now do much of it for you — Safari and Firefox have blocked them by default for years. But the ad-tech industry did not shrug and go home. Fingerprinting grew because cookie blocking worked: when the name tags stopped sticking, recognizing the walk became the growth business. A fingerprint needs no storage on your device at all, which is why no amount of clearing, blocking, or consent-banner declining touches it.

Belief 3: "My VPN stops tracking" — wrong, and worth saying plainly

A VPN changes exactly one signal: your IP address, and with it your apparent location. That is genuinely useful — your internet provider can't see which sites you visit, and sites can't log your real IP or rough location. If that is what you bought it for, it is doing its job.

But your IP address is one signal among the roughly thirty in a fingerprint. Switch on the VPN and your canvas hash, font list, GPU string, screen metrics, and time zone sail through unchanged. To a fingerprinting script you are the same device phoning in from a different street — arguably more recognizable, because now you're the same rare fingerprint that hops countries. Back on Safer Internet Day 2020 we recommended VPNs and Tor in our protect-yourself-online guide, and for IP privacy that advice stands. Against fingerprinting, a VPN alone does nothing. Any VPN ad implying otherwise is selling past the truth.

Belief 4: "More privacy extensions and tweaks = more private" — wrong, sometimes backwards

This one hurts, because it punishes effort. Remember that uniqueness is the enemy: you are safest when your browser looks like a million other browsers. Every unusual extension that changes how pages load, every exotic user-agent switcher, every hand-tuned setting that alters what your browser reports makes your configuration rarer. A heavily customized browser can stand out like the one customer who pays entirely in two-dollar bills.

A good content blocker is still worth having — it stops many fingerprinting scripts from ever loading, which beats disguising yourself from them. The mistake is stacking five overlapping privacy extensions and assuming protection adds up. Often it multiplies distinctiveness instead. Fewer, better-chosen defenses win.

Belief 5: "Surely the big platforms ban this stuff" — this was true-ish, and it flipped

The one belief with a real expiry date. In 2019, Google's public position was that fingerprinting "subverts user choice and is wrong," and its ad platforms prohibited it. On February 16, 2025, that prohibition ended: Google's updated platform policies began permitting advertisers using its products to employ fingerprinting techniques, with compliance responsibility shifted onto the advertisers themselves. The UK Information Commissioner's Office responded in writing that "we think this change is irresponsible." Whatever your reading of the motives, the practical takeaway for you is simple: the largest ad ecosystem on Earth no longer treats fingerprinting as off-limits, so the volume of it will grow, not shrink. Defending against it is now a permanent part of normal browser hygiene, like updates and a password manager.

See your own fingerprint in two minutes

Do not take this page's word for any of it. The EFF — the same organization behind that 2010 study — runs a free test at coveryourtracks.eff.org. Open it, click Test your browser, and wait about thirty seconds while it runs the same measurements a real tracker would.

Read the results like this:

• "Your browser has a unique fingerprint" — among the browsers tested recently, nothing else looked like yours. A tracker could follow you with no cookies at all. This is the normal result for a default Chrome or Edge install, which surprises almost everyone the first time.
• "Your browser has a randomized fingerprint" — the tool detected that your browser feeds scripts slightly different answers each time. This is Brave's approach working as designed.
• "Nearly unique" or a bits-of-information score — the tool reports how many bits of identifying information each trait leaks. Rough guide: about 33 bits is enough to single out one person on the whole internet. Individual rows like your font list or canvas hash often carry 10 to 20 bits on their own.
• The blocking section shows whether tracking ads and invisible trackers got through — that part reflects your content blocker, which is a separate defense from fingerprint resistance.

Run it once in your everyday browser and once in a private window. Watching the "unique" verdict appear in both is the fastest cure for incognito faith available anywhere.

What actually reduces fingerprinting

There are only two strategies that work, and every serious tool uses one of them. Randomize — feed scripts slightly different answers every time, so yesterday's fingerprint doesn't match today's. Standardize — make everyone give the same answers, so the crowd you hide in gets huge. Brave randomizes. Tor standardizes. Firefox and Safari mostly standardize and block. Chrome does neither.

Brave: randomization by default

Brave's engineers call it farbling: every site, every session, the answers to canvas readbacks, WebGL parameters, audio processing, and font measurements come back with tiny random changes — small enough that pages render normally, large enough that the hashes never match across sites or days. Cover Your Tracks recognizes it and reports a randomized fingerprint. For a non-technical person who wants real protection with zero configuration, this is the strongest default on the market.

Honesty requires the footnote: research published in 2025 showed that a determined tracker collecting many samples can statistically average out noise-based canvas defenses. Randomization raises the cost of tracking you from trivial to expensive; it does not make you invisible. Against the everyday ad-tech scripts that make up nearly all real-world fingerprinting, it holds up well.

Firefox: one setting, honestly good

Open Settings, go to Privacy and Security, and under Enhanced Tracking Protection choose Strict. That single click blocks scripts on Mozilla's known-fingerprinters list outright and restricts what suspected fingerprinting scripts can read from your browser. Mozilla's own published estimate is that its recent fingerprinting protections roughly halve the number of Firefox users a fingerprinter can track. Firefox also isolates cookies per website by default (Total Cookie Protection), which quietly killed most cross-site cookie tracking back in 2022 without anyone needing to touch a setting.

There is a stronger, rougher mode: privacy.resistFingerprinting in Firefox's hidden about:config page — type that address in the URL bar to reach it. It standardizes your reported time zone to UTC, spoofs your window size, and blanks the canvas. It is genuinely powerful and genuinely annoying: sites show times hours off, some logins loop, video calls misbehave. Our 2021 version of this post recommended it, and of the fifty-plus settings that post listed, it is the one that aged well — but today the Strict setting gets most of the benefit with none of the breakage, which is why it is the recommendation and resistFingerprinting is the footnote.

Safari: quiet and built in

Safari's approach since 2018 has been to volunteer less: it presents a simplified profile of your system so Macs of the same model look alike. Since Safari 17 in 2023 there is also Advanced Tracking and Fingerprinting Protection, which trims fingerprint-friendly web features — on by default in Private Browsing, and you can extend it to all browsing under Safari's Advanced settings on Mac, or Settings → Apps → Safari → Advanced on iPhone. If you live on Apple devices, switching that to all browsing is the one change worth making today.

Tor Browser: the ceiling

Tor Browser attacks the arithmetic itself: if uniqueness is the problem, make everyone identical. Every Tor Browser reports the same fonts, the same standardized values, and a letterboxed window rounded to standard sizes — resize it and gray bars appear rather than reveal your true resolution. Combined with routing that hides your IP, it is the strongest anti-fingerprinting tool available to the public, and it is what "maximum" actually looks like. The cost is speed and friction, which is why it is the special-occasions tool, not the daily driver, for most people.

The exact clicks: set up your defense in five minutes

Everything above is the why. Here is the do — pick the path that matches the browser you want to live in.

Path A: you want to keep Firefox

1. Open Firefox and click the menu button (three lines, top right), then Settings.
2. Select Privacy & Security in the left column.
3. Under Enhanced Tracking Protection, choose Strict. Firefox reloads your tabs with the stronger rules.
4. Open coveryourtracks.eff.org and click Test your browser to see the before-and-after for yourself.
5. If a site misbehaves later — a login loops, an embed won't load — click the shield icon in the address bar and switch protection off for that one site only. Your guard stays up everywhere else.

Path B: you're willing to switch to Brave

1. Download Brave from brave.com only — not from an ad or a "download portal" — and install it.
2. Let it import your bookmarks and passwords when it offers; that's the five-minute part people dread and it's automatic.
3. Do nothing else. The fingerprint randomization (Shields) is on by default — there is no setting to find.
4. Run Cover Your Tracks once: it should report a randomized fingerprint. That word is the proof it's working.

On your phone, the same two paths exist — Brave and Firefox both ship mobile versions with the same defenses — and on iPhone, Safari users should open Settings → Apps → Safari → Advanced and extend Advanced Tracking and Fingerprinting Protection to All Browsing. One toggle, done.

What our 2021 version of this post got wrong

This page first went up on September 5, 2021, as a Firefox "hardening" checklist: fifty-plus about:config switches to flip. Reading it in 2026 is humbling, and you deserve the honest accounting.

• It told you to turn off Safe Browsing. Flipping browser.safebrowsing.malware.enabled and browser.safebrowsing.phishing.enabled to false disabled Firefox's warnings before known phishing and malware pages. That was wrong — the privacy benefit was near zero and the added risk was real. Leave both on.
• It broke streaming for no privacy gain. Disabling media.eme.enabled and Widevine simply stopped Netflix and Prime Video from playing. Nobody was fingerprinting you through your ability to watch a show you paid for.
• Much of the list no longer exists. The battery-status setting refers to an API Firefox removed years ago; the cookie lifetime policy is gone; first-party isolation was superseded when Total Cookie Protection became the default for everyone.
• The whole approach fought the arithmetic. Fifty hand-flipped switches produce a configuration almost nobody else on Earth runs — which is to say, a rarer fingerprint. The post made readers more distinctive while trying to make them safer.

What survived: the instinct that fingerprinting matters (it matters more now than in 2021), and one setting — privacy.resistFingerprinting — that remains the real thing for people willing to accept breakage. Everything else in this rewrite replaces the checklist with the two defenses that held up: blocking the scripts, and randomizing or standardizing what they read.

Phones are fingerprinted too — Jake's side of the counter

Jake sells phones, so he asked the obvious follow-up: does any of this apply to the devices in his display case? More than on desktop, in some ways. A phone browser reports model-specific screen metrics and GPU strings, and researchers have shown that even a phone's motion sensors can betray it — a 2019 IEEE paper demonstrated a calibration fingerprinting attack that identified individual handsets from tiny factory-calibration quirks in their sensor data, which we covered in our write-up of the sensor fingerprinting paper. Apple and Google patched the worst of it, which is the recurring lesson: on phones, your update habit is your privacy habit. It is the same reason the BlueFrag Bluetooth flaw mattered — unpatched Androids were the ones exposed — and why Google built Project Mainline to push security fixes through the Play Store without waiting on phone makers.

Two practical notes for the phone in your hand. First, what you share leaks identity as surely as how you browse — photos carry metadata, though as we found when we tested whether WhatsApp sends photo metadata, major messengers strip most of it on send. Second, remember what all this profiling is for: the interest profile built from your fingerprint decides which ads follow you and which feeds hold your attention. The platforms themselves have started acknowledging the attention half — YouTube now offers a daily scrolling limit for the Shorts feed. Reducing your fingerprint shrinks the profile; the profile is the product.

Jake: "So the honest summary for my customers is: use Brave or strict Firefox, keep the phone updated, and stop expecting incognito to do things it never promised."

Ethan: "And check yourself on Cover Your Tracks once, so it's knowledge instead of belief. That's the whole sermon. And Jake — order the protectors from whichever tab shows $52."

Browser fingerprinting FAQ

What is browser fingerprinting in simple terms?

It is a way for websites to recognize your specific device by combining dozens of ordinary traits — screen size, fonts, graphics hardware, time zone, how your browser draws images — into a combination so rare it works like an ID. No file is stored on your device, so there is nothing to delete.

Does incognito or private mode stop fingerprinting?

No. Private modes delete cookies and history when the window closes, protecting you from other people who use your device. Your device traits — the fingerprint — are unchanged, so websites running fingerprinting scripts can still recognize you. Firefox and Safari do enable some extra tracking protections in private windows, which helps, but the core fingerprint remains.

Does a VPN stop browser fingerprinting?

No. A VPN changes your IP address and hides your traffic from your internet provider — real benefits — but the IP is only one of roughly thirty fingerprint signals. Everything else passes through unchanged. Pair a VPN with Brave, strict Firefox, or Tor Browser if fingerprinting is what you are defending against.

Does clearing cookies change my fingerprint?

No. Cookies are data stored on your machine; a fingerprint is a description of your machine. Clearing cookies removes stored identifiers but leaves every fingerprint signal exactly as it was, and a fingerprinting script can re-recognize you on your next visit — and even quietly re-associate your old profile.

What is canvas fingerprinting?

A script asks your browser to draw a hidden image, reads the result pixel by pixel, and condenses it into a short code. Different graphics cards, drivers, and font-rendering settings produce slightly different pixels, so the code identifies your machine with high accuracy. You never see the drawing happen.

Is browser fingerprinting legal?

Mostly yes, with regional strings attached. European and UK privacy rules require consent or a lawful basis for tracking, and the UK regulator publicly criticized Google's February 2025 decision to permit fingerprinting in its ad products. In practice enforcement is thin, and in most of the world fingerprinting operates freely — which is why browser-side defenses matter.

Which browser is best against fingerprinting?

Tor Browser is the strongest, because every user looks nearly identical. For daily use, Brave randomizes fingerprint signals by default, and Firefox with Enhanced Tracking Protection set to Strict blocks known fingerprinting scripts and limits suspected ones. Safari is solid on Apple devices, especially with advanced protection extended to all browsing. Chrome and Edge offer no real fingerprint defense.

Can I delete my browser fingerprint?

No, because nothing is stored to delete. You can only change what your browser reports — by using a browser that randomizes signals (Brave), blocks the scripts (Firefox Strict), or standardizes everyone's answers (Tor Browser). Changing hardware, updating your OS, or installing fonts shifts your fingerprint as a side effect, but a tracker simply records the new one.

Do ad blockers stop fingerprinting?

Partly, and usefully. A good content blocker prevents many fingerprinting scripts from loading at all, which is the cleanest possible defense. It cannot stop scripts served from the site's own domain, though, so pair one blocker with a browser that has built-in fingerprint protection. Avoid stacking many privacy extensions — an unusual combination makes you more distinctive, not less.

Does Tor Browser really make everyone look the same?

Close to it. Tor Browser standardizes reported fonts, values, and window sizes — resizing adds gray letterbox bars instead of revealing your true resolution — so millions of users share near-identical fingerprints. It is the practical maximum for the public. The trade-off is slower browsing and occasional site friction, which is why it suits high-stakes moments more than daily use.

Can phones be fingerprinted too?

Yes. Mobile browsers expose model-specific screen, GPU, and font signals, and researchers have even identified handsets from factory-calibration quirks in motion-sensor data. Keeping the OS updated closes the worst of these holes, and using Brave or Firefox on mobile applies the same script-blocking defenses you get on desktop.

How do I test my browser fingerprint?

Open coveryourtracks.eff.org and click Test your browser. In about thirty seconds it reports whether your fingerprint is unique or randomized, how many bits of identifying information each trait leaks, and whether tracking scripts were blocked. Test your everyday browser first, then any changes you make, so you can see the difference rather than hope for it.

Does Google really allow fingerprinting now?

Yes. Since February 16, 2025, Google's advertising platform policies permit companies using its ad products to employ fingerprinting techniques — reversing its 2019 position that the practice "subverts user choice." The UK's data-protection regulator called the change irresponsible. It means fingerprinting now operates inside the mainstream ad economy, not on its fringes.

Is my fingerprint the same in every browser on my computer?

No. Chrome, Firefox, and Brave on the same machine share hardware signals like the GPU and screen, but differ in reported version, fonts handling, and how they draw the canvas test — so each browser carries its own fingerprint. That's why switching to a defended browser genuinely helps: you leave the old fingerprint behind with the old browser.

Do cookie consent banners cover fingerprinting?

Almost never in practice. The banner you click governs cookies and similar stored identifiers; a fingerprinting script stores nothing, so it slips past the mental model the banner teaches. European rules do technically require a lawful basis for fingerprint-based tracking, but there is no equivalent of the visible banner, and enforcement is thin — browser-side defense is the realistic protection.

If I buy a new computer, does tracking start from zero?

Briefly. A new machine presents a new fingerprint, but the first time you sign in to an account — email, shopping, social — the site can link the new device to the old profile, and ad networks share those links. Hardware changes reset the fingerprint, not the profile behind it. A defended browser on the new machine is what keeps the fresh start fresh.

Revision note. Originally published September 5, 2021, in the strange quiet of the pandemic years, as a fifty-switch Firefox hardening checklist. Fully rewritten August 25, 2026. Reversed from the original: the advice to disable Safe Browsing (leave it on — always), the streaming-breaking DRM tweaks, and the checklist approach itself, which made readers' browsers rarer and therefore easier to recognize. If reading this made your stomach drop a little, take the good news with it: unlike most privacy problems, this one bends to a single afternoon decision. Install one better browser, flip one setting, run one test — and you have moved yourself from "unique" to "one face in a very large crowd." That is not paranoia. That is just closing the shop door at night.