Browser fingerprinting is a way of recognising your browser by combining many small details about it (browser version, language, time zone, screen, fonts, graphics card and more) into an identifier that stays the same across visits. Unlike a cookie, nothing is stored on your device, so clearing cookies or using a private window usually doesn't change it. Reducing it means using a browser that hides or randomises those details, not just deleting site data.
The topic is trending again. An essay called "Fingerprints are the new cookies" reached the Hacker News front page on 11 October 2026 with nearly 600 points, arguing that fingerprinting has quietly replaced third-party cookies for ad tracking. This guide explains how fingerprinting works, with a small demo you can run, what UK regulators say, and what you can actually do about it.
MDN's glossary entry defines it as "a practice in which websites identify a particular browser (and by extension, a particular user) by collecting and combining distinguishing features of the browser and underlying operating system". MDN's examples of those features include:
None of these is unique on its own. Millions of people use the latest Chrome, and millions use English. The trick is the combination.
There are two sources of data, as the "Fingerprints are the new cookies" essay explains.
1. The network request. Before any code runs, your browser sends headers such as User-Agent and Accept-Language, plus your IP address. These reveal your browser, operating system, language and often your rough location. The IP address is fragile, though: it changes on mobile networks, is shared on Wi-Fi and is hidden by VPNs.
2. Code running in the page. JavaScript can read or measure many properties without any permission prompt. The essay lists the GPU, CPU behaviour and number of threads, memory size, screen resolution, pixel ratio and refresh rate, audio processing, installed fonts and more. Hardware measurements are surprisingly stable, which is what makes fingerprints last.
Two well-known techniques are:
Here's the core idea in a few lines of JavaScript: collect some signals and hash them into a short ID. I ran it on Node.js 26, which supports the same navigator, Intl and Web Crypto APIs as browsers:
const signals = {
userAgent: navigator.userAgent,
language: navigator.language,
cores: navigator.hardwareConcurrency,
timeZone: Intl.DateTimeFormat().resolvedOptions().timeZone,
};
const text = JSON.stringify(signals);
const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
const id = [...new Uint8Array(digest)].slice(0, 8).map(b => b.toString(16).padStart(2, "0")).join("");
console.log(signals);
console.log("fingerprint id:", id);
Output (run twice, saved as an .mjs file so top-level await works):
{
userAgent: 'Node.js/26',
language: 'en-US',
cores: 8,
timeZone: 'Europe/London'
}
fingerprint id: db8825b6083fe975
fingerprint id: db8825b6083fe975
The ID is identical on every run, and nothing was stored. A real fingerprinting script collects dozens of signals, including canvas and audio measurements, so its ID is far more distinctive than this four-signal toy.
Cookies and local storage still have honest uses, like remembering a theme choice, as in my dark mode toggle with localStorage tutorial. The difference is that you can see and delete them.
Fingerprinting researchers measure identifying information in bits. A trait shared by 1 in N people gives log₂(N) bits. Each bit halves the number of people you could be. I calculated a few values in Python:
from math import log2
for n in (2, 8, 128, 4096):
print(f"1 in {n}: {log2(n):.2f} bits")
print("bits to single out 1 in 8e9:", round(log2(8e9), 2), "; 1 in 1e6:", round(log2(1e6), 2))
1 in 2: 1.00 bits
1 in 8: 3.00 bits
1 in 128: 7.00 bits
1 in 4096: 12.00 bits
bits to single out 1 in 8e9: 32.9 ; 1 in 1e6: 19.93
So about 33 bits is enough to pick out one person among 8 billion, and about 20 bits picks out one in a million. A fingerprint doesn't need to be globally unique; it only needs to be unique among a site's visitors. Traits aren't fully independent, so in practice the bits don't simply add up, but combining a dozen ordinary details gets close very quickly.
The essay's argument rests on a real policy change. In December 2024, the UK Information Commissioner's Office published its response to Google's policy change on fingerprinting. It explained that from 16 February 2025, organisations using Google's advertising technology would be able to use fingerprinting without breaching Google's own policies.
The ICO called the change "irresponsible" and quoted Google's own 2019 position on fingerprinting: "We think this subverts user choice and is wrong." It warned that fingerprinting "could now replace the functions of third-party cookies".
The essay's point is that this happened with little public attention, while discussion focused on Google's plans for third-party cookies in Chrome.
Fingerprinting isn't banned outright, but it's covered by data protection law. The ICO is clear that "businesses do not have free rein to use fingerprinting as they please". It says:
Fingerprinting has legitimate uses too, mainly fraud prevention and bot detection, such as spotting a stolen card used from an unfamiliar device. Whether a use needs consent depends on the purpose, so businesses should read the ICO's guidance on storage and access technologies.
Not by itself. A private window starts with no cookies and discards them afterwards, but your hardware, screen, fonts, time zone and language are the same as in a normal window. The essay suggests a simple test: if a fingerprinting demo gives you the same identifier in normal and private windows, private browsing isn't protecting you from it.
Only partly. A VPN hides your real IP address, which removes one signal and your location. It doesn't change anything that JavaScript measures on your device, so the rest of the fingerprint stays the same. A VPN is still useful for privacy on public Wi-Fi; it just isn't an anti-fingerprinting tool.
According to the essay, browsers fall into a few groups:
Both approaches work in different ways. Randomising makes your fingerprint change; uniformity makes you blend into a crowd.
Practical steps, roughly from easiest to strongest:
You can test your browser with tools such as the EFF's Cover Your Tracks, which reports how unique your fingerprint looks among recent visitors.
If you build websites, check what your third-party scripts do. Analytics, ad and "anti-fraud" scripts can include fingerprinting. Under UK law, you're responsible for the tracking on your site, so:
It's recognising your browser by the unique combination of its details, such as version, language, time zone, screen, fonts and graphics hardware, instead of storing a cookie on your device.
It's harder to control. You can see and delete cookies, but a fingerprint is recalculated on every visit, so clearing site data or using private browsing usually doesn't remove it.
Not completely, but you can reduce it a lot with browsers built to resist it, such as Tor Browser, Mullvad Browser or Brave, plus fewer extensions, default settings and a tracker blocker.
No. Private browsing removes cookies when you close the window, but your device and browser details are the same, so a fingerprint usually matches your normal window.
A VPN hides your IP address, which is one signal, but not the device details JavaScript can measure. It reduces fingerprinting only slightly.
It isn't banned, but the ICO says UK GDPR and PECR apply, so organisations must be transparent and get consent where needed. The ICO describes the bar for advertising use as high.
According to the ICO, Google changed its advertising policies so that from 16 February 2025, organisations using its ad technology can use fingerprinting without breaching Google's own rules. The ICO criticised the change as irresponsible.
A technique where a page draws hidden graphics and reads the resulting pixels. Small rendering differences between devices make the result a useful identifier.
// note
This is a learning note from studying the web. It is one small topic, written so I can remember it. It is not a course and not a claim that I have finished the subject.
If a sentence is wrong, say so from the contact page and name this title. Drafts never appear here. Related notes, when they exist, are other published posts, and the same sample rule applies to each of them.
The UK government plans to stop under-16s using platforms such as TikTok, Instagram, Snapchat, YouTube, Facebook and X from spring 2027. Here is what the official fact sheet says, how age checks might work, whether adults will need to show ID, and what it means for developers and parents.
On 6 October 2026 ASOS app users received a push notification reading 'ASOS HACKED'. ASOS later confirmed attackers took customer profiles including names, addresses, phone numbers and emails, but not payment details or passwords. Here is a factual timeline and eight practical steps to stay safe.
A viral "Passkeys are a trap" post hit the top of Hacker News this week. Here is a balanced explanation of how passkeys work, why they stop phishing better than passwords, the genuine lock-in and attestation concerns, and how to use them without getting locked out.
A new GhostAction wave is using hijacked maintainer accounts to commit a fake "Security Audit" workflow that steals Actions secrets and every credential in your git history. Here is how the attack works, how to check your repositories (with a tested script), and what to rotate.