The privacy debate of 2014 was about cookies. The privacy debate of 2026 is about a thing most people have never heard of, and the marketers have been quietly using it for years.
Browser fingerprinting runs as the technique of identifying a user by combining dozens of small, hard to change signals about their browser and device into a stable, unique identifier. The signals include things like screen size, installed fonts, the version of the operating system, the graphics card, the time zone, the language, the way the browser renders a specific canvas, the audio context signature, the WebGL capabilities, the list of supported codecs, the battery level if the API is exposed, and a dozen other small things that, taken together, add up to a fingerprint that is effectively unique across the entire population of users on the internet.
The advertising industry has been using this for at least a decade. The privacy debate has not caught up.
What a browser fingerprint actually is
Your browser, when it loads a page, exposes a surprising amount of information about itself, not through any malicious act, just through the normal operation of the web platform. The user agent string announces your browser and version. The screen object reveals your resolution and color depth. The navigator object tells the page your platform, language, and how many CPU cores you have. The canvas API, when asked to draw a specific image, produces a result that depends on your graphics card, your driver version, and your font stack, in a way that is deterministic but unique.
None of those signals is identifying on its own. Billions of people have a 1920×1080 screen. Tens of millions use a Mac with the same Safari version. The combination, however, narrows quickly. After 10 to 15 signals, the probability of two users having the same combination drops to one in millions. After 20, it is one in billions. The fingerprint, in other words, is a unique identifier, and it does not require cookies, does not require consent, does not require any storage on the user’s device, and survives every privacy setting the user knows how to turn on.
Why fingerprints beat cookies on every metric that matters
Cookies are stored state. They can be deleted, blocked, scoped, expired. The user can see them in the developer tools. Privacy regulations require consent for them. Browser vendors are shipping with cookie blocking on by default. The cookie, as a tracking mechanism, is dying the slow regulatory death it deserved.
Fingerprints are not stored state. They are computed state, derived from the device at the moment of the request. There is nothing to delete. There is nothing to block at the network level. There is no consent prompt because there is no storage operation. Privacy regulations, which were written for cookies, do not technically apply. Browser vendors have tried to add fingerprinting protection, but the protection is partial, inconsistent, and easily bypassed.
For an advertiser, the trade is unambiguous. Fingerprints are more reliable than cookies, harder for users to block, unregulated in most jurisdictions, and free.
The signals that make a fingerprint stable
The most stable signals are hardware. The graphics card model, the audio context, the list of installed system fonts, the WebGL renderer string, the way the canvas hashes. These rarely change unless the user changes hardware. The OS version and browser version change more often, but the combination of all of them, plus the user’s installed extensions, plus their time zone, plus their preferred language, is stable across most of the user’s sessions.
Less stable signals include the screen resolution (changes when a user plugs in a new monitor), the user agent (changes on browser updates), the list of plugins (changes on browser updates). More stable signals include the canvas fingerprint (changes when a user updates their graphics driver), the audio context (changes when a user installs a new audio device), the list of system fonts (changes when a user installs a new application that ships a font).
The combination is what matters. Even if 30% of the signals change between sessions, the remaining 70% is enough to re identify the user with high probability. The fingerprinting industry has been doing this long enough that the methods are highly tuned.
Why clearing your cookies no longer protects you
The advice “clear your cookies” was the right advice in 2008. It counts as the wrong advice in 2026. The cookies that most advertising networks use are first party cookies that get rewritten as you browse, third party cookies blocked by default, or stored in obscure places like ETags, IndexedDB, the cache API, the service worker cache, and the local storage partition. Clearing cookies does not clear those. None of those mechanisms are involved in fingerprinting at all, which means clearing them is irrelevant to the fingerprinting problem.
The user who clears their cookies every day and expects to be untrackable is a user who has not yet been told that the tracking has moved.
What fingerprinting looks like in 2026
There are at least a dozen commercial fingerprinting services operating at scale, including well known names and several that operate in the grey area between fraud detection and tracking. The services sell a stable, persistent identifier that survives cookie clearing, private browsing mode, and most privacy tools. The pricing is per impression, typically fractions of a cent. The accuracy is over 90% in most cases. The data is shared across the service’s customer base, which is most of the major ad networks, most of the major analytics platforms, and a long list of buyer intent and identity resolution vendors.
The legitimate use cases include fraud detection and bot mitigation. The actual usage, as far as anyone can tell from outside, counts as the same kind of cross site tracking that cookies used to enable, without the consent, without the visibility, and without the regulatory framework.
The regulatory gap
GDPR was written for cookies. CCPA was written for cookies. The ePrivacy Directive, the UK PECR, the Brazilian LGPD, the Canadian PIPEDA, all written for cookies. None of them have a clean definition of fingerprinting, none of them have a clear consent regime for it, and none of them have a tested enforcement action against it. The European Data Protection Board has issued guidance suggesting fingerprinting requires consent, but the guidance is not binding and the enforcement actions are rare.
In the United States, the state level privacy laws that have passed since 2023 vary widely. Some cover fingerprinting explicitly. Most do not. The patchwork is a fingerprinting vendor’s best friend. As long as the law is unclear in most jurisdictions, the practice is profitable in all of them.
What actually protects you (and what does not)
Private browsing mode does not protect against fingerprinting. It only isolates cookies and storage within a session. A VPN does not protect against fingerprinting. The fingerprint counts as the same regardless of the IP address. Disabling JavaScript does protect against most fingerprinting techniques, but it also breaks most of the web. The Tor Browser amounts to the only mainstream browser that ships with serious anti fingerprinting protections, and it does so by making every Tor user look identical, at the cost of breaking a lot of sites and degrading the user experience.
For most users, the realistic answer is: accept that you are being fingerprinted, use a browser that randomises some of the more identifying signals (Firefox with privacy.resistFingerprinting, Brave with default protections), and treat any device that is logged into your real identity as a known tracked endpoint.
What to do this week
- Visit
amiunique.orgorcoveryourtracks.eff.organd see what your own fingerprint looks like. The result will be instructive. - If you are on a desktop, install Firefox with the Resist Fingerprinting setting enabled, or Brave with standard protections. Both reduce your fingerprint’s uniqueness significantly.
- Audit the tracking pixels on your own site. Many legacy analytics tags include fingerprinting that predates the privacy regulation of the last five years. Replace them with privacy respecting alternatives or remove them.
- For high risk users, journalists, activists, security researchers, anyone whose threat model includes targeted tracking, run sensitive browsing through Tor Browser only, and use a separate device for sensitive work.
- If you are a marketer, understand that the fingerprinting you are buying is, in most jurisdictions, not legally compliant. The risk is not the regulator finding you today. The risk runs as the regulator finding you in 2028 and asking what you were doing in 2026.
The bottom line
Cookies are dead. Fingerprints are forever. The privacy debate of the last decade solved the wrong problem, and the people who were paying attention solved it before the rest of us noticed. The marketers, the fraud detection vendors, the identity resolution platforms, they have all moved on. The regulators, the press, the public privacy conversation, have not.
The honest answer is that there is no easy fix for an individual user. The fix is structural. Privacy law needs to catch up. Browsers need to ship meaningful fingerprinting protection, not just cookie blocking. Ad tech needs to be rebuilt around consent that is actually informed. Until then, the gap between what the privacy debate says is happening and what is actually happening will keep growing.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
