How Websites Identify You Even Without Cookies

You clear your cookies religiously. You’ve got a strict browser-privacy setup. And yet, somehow, that pair of shoes you looked at once follows you across three different websites, and a login form somehow “knows” it’s you before you’ve typed a single character. If you’ve ever wondered how that’s possible when you supposedly “deleted everything,” the answer is that cookies were never the only trick in the book. They were just the easiest one to explain, and the easiest one to delete. In this guide, we’ll walk through the other ways websites actually recognize you, in plain language, and what genuinely helps versus what’s mostly theater.

If cookies aren’t the whole story, what’s actually happening?

Cookies are a small, deletable file your browser stores. Fingerprinting is a technique that identifies you using dozens of undeletable technical characteristics your device reveals just by existing. Here’s the useful mental shift: a cookie is something a website hands to you and stores on you, like a sticker placed on your jacket. You can peel it off any time. Clear your cookies, and that tracking thread snaps. Fingerprinting works differently. Instead of handing you something to carry around, a website simply observes you: your screen resolution, the fonts installed on your machine, the exact model of your graphics card, how your browser handles a tiny drawing task, your timezone, your language settings, your battery status, and a long list of other small technical facts your browser provides automatically when a page loads. Individually, almost none of these signals mean much. Plenty of people share your screen resolution. Plenty of people run the same operating system version. But websites don’t rely on one signal at a time. They combine twenty or thirty of them into a single snapshot, and the combination of ordinary details is often unique enough to single you out, like a detailed physical description narrowing a crowd down to one person even when no single trait would. That’s why clearing cookies, using private/incognito mode, or switching networks doesn’t always stop the tracking you’re worried about. The “sticker” is gone, but the description of you walks right back in on the next page load, because your device keeps describing itself the same way.

What is browser fingerprinting, and how does it actually work?

Browser fingerprinting works by running small pieces of code as soon as a page loads. The script quietly asks your browser dozens of routine questions, then hashes the combined answers into a single, highly specific identifier. Every browser is, by design, a chatty piece of software. To render a webpage correctly, it needs to tell the website things like: what screen size am I working with, what fonts are available so text renders properly, what plugins or extensions are installed, what language should content appear in, and what timezone should dates be formatted for. This isn’t sinister by itself, these are legitimate compatibility questions a browser answers so websites can display correctly on your setup. A fingerprinting script simply asks all of these questions in one go, using standard web APIs that exist for compatibility reasons, not because browsers were “built for tracking.” After collecting the answers, the script typically runs them through a hashing function, a math step that turns a long list of details into a short fixed-length string. That string becomes your fingerprint for that session. Next time you visit, even after clearing cookies, even in a new private window, even after restarting your computer, if your device still answers those questions the same way (and it usually does, because your hardware and software configuration doesn’t change overnight), the script generates the same hash. The website recognizes you instantly, no cookie required. The part that makes this hard to fully defend against is that fingerprinting scripts don’t have to break any rules. They’re using ordinary browser features exactly as designed. That’s very different from a virus exploiting a security flaw. Fingerprinting exploits the fact that browsers are helpful, not that they’re broken.

What specific signals make up a fingerprint?

A typical fingerprint combines dozens of small signals, screen and window dimensions, installed fonts, GPU and rendering details, timezone, language, battery status, installed browser plugins, and hardware capabilities, into one composite identifier. It helps to see the list, because once you see what’s being measured, the topic stops feeling abstract and starts feeling personal. A modern fingerprinting script commonly checks: • Screen and viewport dimensions, your exact screen resolution, color depth, and the current size of your browser window, which narrows things down more than most people expect once combined with everything else. • Operating system and browser version, the specific build number of your OS and browser. It changes often enough to be useful, but not so often that it prevents recognition between visits. • Installed fonts, the specific list of fonts present on your system, which varies widely depending on what software you’ve installed over the years. • Time zone and language settings, your system clock’s timezone offset and your browser’s configured language and locale. Both are easy to read and meaningfully narrowing. • Hardware concurrency and device memory, how many processor cores your device reports and, in some browsers, an approximation of installed RAM. These are exposed for legitimate performance-tuning reasons. • Battery status, some browsers historically exposed battery charge level and charging state through a dedicated API. That turned out to be specific enough to help identify individual devices, especially around plug-in/unplug moments. • Installed plugins and MIME types, a list of plugins and file types your browser can handle natively, a holdover from an era when plugins were more common and varied. • Touch support and input capabilities, whether your device reports touch input, a stylus, or a mouse, which subtly distinguishes phones, laptops, and hybrid devices. • Canvas, WebGL, and audio rendering quirks, how your specific combination of graphics hardware, drivers, and audio stack renders invisible test content. This is covered in detail in the next two sections because it’s especially effective. None of these signals were created for tracking. Every one exists because a browser needs to answer a legitimate technical question to render a page properly. In that sense, fingerprinting is less like a hidden camera and more like reading a long, specific questionnaire your browser was already going to answer, whether you wanted it to or not.

How does canvas and WebGL fingerprinting actually pull this off?

Canvas fingerprinting works by asking your browser to silently draw a tiny, invisible image and then reading back the exact pixels produced. Tiny rendering differences between graphics hardware and drivers can make that image subtly, consistently unique to your machine. This is the technique that surprises people most, because it doesn’t rely on a setting you can see or a preference you consciously chose. It exploits something fundamental: how your graphics hardware draws. Here’s how it plays out. A script uses the HTML5 canvas element, a standard feature in modern browsers, and instructs it to render a short piece of text or a simple shape, often with specific fonts, colors, and sometimes even a smiley face or emoji. Crucially, the canvas isn’t displayed on the page. It’s drawn invisibly in memory so the script can inspect the result. The key is that the exact pixels produced depend on your device’s stack: your graphics card, your graphics driver version, your operating system’s font-rendering engine, anti-aliasing settings, and subtle differences in how your browser implements the canvas specification. Two people running what looks like the same browser on the same operating system can still produce slightly different pixel output because their graphics hardware or drivers differ underneath. The script reads the resulting image data, hashes it, and gets a value that’s remarkably consistent for you across visits, and remarkably likely to differ from someone else’s machine. WebGL fingerprinting uses the same idea but goes deeper into your graphics stack. Instead of flat 2D drawing, it uses 3D rendering commands and can query your GPU vendor and renderer strings directly. Those details are exposed for legitimate reasons (so websites can adjust 3D quality to match your hardware), but they’re also a goldmine for distinguishing devices. The unsettling part is how invisible it all is. There’s no permission prompt, no visible canvas on your screen, and no sign in the address bar that anything unusual happened. The test can run and finish in a fraction of a second, often before the page has fully loaded the images you can actually see.

What is audio fingerprinting, and why does it work at all?

Audio fingerprinting works almost the same way as canvas fingerprinting, except it uses your device’s audio-processing hardware to generate and analyze a silent sound wave instead of a silent image. This one sound far-fetched until you see the mechanism. A script uses the Web Audio API, a legitimate browser feature that lets websites generate and process sound for things like games, music apps, and audio tools. A fingerprinting script asks the browser to generate a specific audio signal, often at a frequency you wouldn’t realistically hear, and then measures exactly how that signal comes out after passing through your device’s audio pipeline. As with canvas rendering, the exact output depends on your hardware and software: your sound card or audio chip, your operating system’s audio stack, and subtle mathematical rounding differences introduced by your specific combination of drivers and components. None of the sound is actually played through your speakers. The test happens silently in memory and takes a fraction of a second. The resulting waveform data gets hashed into another consistent, device-specific value that a script can compare across future visits. Combined with canvas and WebGL fingerprinting, audio fingerprinting adds another layer of specificity. Because all three techniques run silently and quickly, most people go their entire browsing lives without realizing it happened.

What role does your IP address play in identifying you?

Your IP address is a separate identifier from cookies and fingerprinting. It reveals your rough location and, on many home connections, stays consistent enough over weeks or months to link activity across sessions. It’s worth separating this from fingerprinting, because it’s easy to treat “fingerprinting” as the whole story and forget that your IP address has been doing identifying work long before these browser techniques became mainstream. It keeps doing that work in the background regardless of what your browser settings look like. Every device connected to the internet needs an IP address to send and receive data. That’s just how internet routing works. On home broadband, your IP address is typically assigned by your internet provider and can remain the same for days, weeks, or even months. That means a website, or more commonly an advertising network embedded across many unrelated sites, can see the same IP address show up again and again. Over time, it can reasonably infer those repeated visits from that address, especially when paired with a matching fingerprint, are coming from the same person or household. An IP address alone also reveals a fair amount: your rough geographic location (often down to a city or region), your internet service provider, and sometimes whether you’re on residential, business, or mobile infrastructure. None of that requires a cookie. It’s visible to any server your device connects to. Where it becomes especially powerful is in combination. A fingerprint alone gets you far. An IP address alone gets you far. But a fingerprint plus a consistent IP address plus the timing pattern of when you’re online creates a composite picture that’s extremely hard to shake off using cookie deletion alone, because cookie deletion was never the thing protecting you from these signals in the first place.

How do ETags, cache tricks, and “supercookies” sneak past cookie deletion?

Beyond fingerprinting, some tracking techniques abuse legitimate browser storage and caching features, like ETags, favicon caches, and HTTP Strict Transport Security flags, to rebuild an identifier even after cookies are wiped. This category is sometimes nicknamed “supercookies” or “zombie cookies.” These techniques sit in a middle ground. Unlike fingerprinting, they do store something on your device. That makes them more like traditional cookies. But unlike traditional cookies, they hide inside browser features most people, and until recently, many privacy tools, don’t think to clear. ETags are a standard web-caching feature. When your browser downloads a file, the server can tag it with an identifier so that next time your browser can ask, “Has this file changed since I last got this tag?” instead of downloading everything again. It’s a legitimate performance feature. But a server can generate a unique ETag for each visitor and then re-issue that same unique tag whenever your browser checks in. That turns an efficiency feature into a tracking mechanism that survives ordinary cookie deletion, because most people don’t clear their cache with the same discipline they clear cookies. Favicon caching works similarly. The small icon in your browser tab is cached separately from cookies. Some tracking schemes have exploited that separate cache to store a unique identifier disguised as icon data. HSTS supercookies are the most invasive. They exploit HTTP Strict Transport Security (a security feature designed to force secure connections) by encoding a unique identifier into a pattern of “this domain requires HTTPS” flags across a set of decoy subdomains. That pattern persists in your browser’s security settings, separate from anything a cookie-clearing button touches. The good news is that browser makers have spent real engineering effort closing many of these holes. Modern browsers increasingly clear caches and related storage more thoroughly, and some of the most aggressive supercookie techniques have been patched out. The bad news is that the cat-and-mouse game keeps producing new variants. That’s exactly why “just clear your cookies” was never a complete privacy strategy, even before fingerprinting became the dominant conversation.

How unique is a typical fingerprint, really?

Independent research has repeatedly found that a large majority of tested browsers produce a fingerprint unique enough to distinguish them from every other browser in the same test set, even among people using mainstream setups. This is the number that hits hardest when people hear about fingerprinting for the first time, because the instinctive assumption is: “Surely my setup looks like everyone else’s.” The Electronic Frontier Foundation’s long-running fingerprinting research project, one of the most-cited studies in this space, found that the overwhelming majority of browsers tested produced a fingerprint unique among the sample. In other words, no other tested browser shared the same combination of signals. Follow-up research over the years, including studies focused on mobile browsers (which people often assume are harder to fingerprint because they’re more standardized), has continued to find high uniqueness rates. Even as browser makers work to reduce identifying information exposed by default. The mechanism behind this is combinatorics. Imagine ten separate signals, and imagine each one only has five to twenty common values across the population. Individually, those values don’t stand out. But multiply that variability across ten, twenty, or thirty signals at once, and the number of possible combinations explodes far faster than most people expect, quickly outstripping the number of people actually using the internet. It’s the same underlying math behind the “birthday paradox,” just applied to browser configuration details instead of birthdays. It’s also fair to add nuance: fingerprint uniqueness isn’t fixed forever. Software updates can change fingerprints. Switching networks can shift some signals. Browser makers periodically ship changes intended to make fingerprints less unique or less stable over time, specifically because this research keeps drawing attention to the problem. But at any given snapshot in time, for most people on most days, the honest answer to “how identifiable is my browser” is: more identifiable than feels comfortable, and considerably more identifiable than clearing cookies alone suggests.

What are the common myths about cookie-less tracking?

The biggest myths are that incognito mode stops fingerprinting, that fingerprinting requires something to be installed on your device, and that clearing cookies plus using a VPN is a complete privacy solution. Myth one: “incognito or private browsing mode stops this.” Private browsing modes were built to solve a narrower problem. They stop your own device from saving a local record of history, cookies, and form data after you close the window. That’s genuinely useful if you share a computer or don’t want your browser remembering things. But private browsing doesn’t meaningfully change what your browser tells websites in real time. Your screen size is still your screen size. Your fonts are still your fonts. Your graphics card still renders the same invisible canvas test the same way. Fingerprinting scripts run the same in a private window as they do in a normal one, because the signals they rely on weren’t stored locally in the first place. Myth two: “this requires malware or something installed on my computer.” It doesn’t. And this is arguably the most important myth to dispel, because it changes how people think about defending against it. Fingerprinting scripts are ordinary JavaScript running inside the normal, sandboxed environment where every website’s code runs. They use standard browser APIs that exist for legitimate reasons. No installation. No permission dialog. No malware. No unusual access. It’s closer to a website asking a long series of allowed questions than it is to a website breaking into an unlocked door. Myth three: “a VPN alone solves this.” A VPN is genuinely useful here, and we’ll get into why in a moment. But it solves the IP-address half of the problem, not the fingerprinting half. Your IP address changes when you connect to a VPN. Your screen resolution, installed fonts, and canvas-rendering quirks do not. So, if a VPN is marketed as a complete anti-fingerprinting solution, that’s overselling what the technology can actually do. It’s better to be clear-eyed than to let a VPN subscription create a false sense of total invisibility.

How can you test your own fingerprint right now?

You can see your own browser fingerprint using free, well-established testing tools that show which signals are exposed and how unique your combination is compared to other visitors. Instead of taking any of this on faith, the most convincing approach is to measure it directly. The EFF’s Cover Your Tracks tool (successor to the long-running Panopticlick project) shows which signals your browser exposes and explains, clearly, how unique your combination is. It also breaks down which specific tests (canvas, fonts, plugins, and more) contribute most to your uniqueness. It’s free, takes under a minute, and is often the most persuasive five minutes you can spend on this topic, because seeing your own score is different from reading about the concept in the abstract. Beyond that, it’s worth checking the basic signals that don’t require a dedicated fingerprinting test: Your own what-is-my-IP tool shows what your IP address reveals about your location and provider. Our DNS lookup tool and WebRTC leak test help you see whether your browsing habits or real IP address are leaking through channels a quick glance at your address bar won’t reveal. Individually, these don’t test canvas or audio fingerprinting. But together with a dedicated fingerprinting test, they give a more complete picture of what different parts of the internet can currently see about you.

What actually reduces your fingerprint, and what’s mostly theater?

Switching to a browser designed to resist fingerprinting, and using extensions that standardize or randomize the signals fingerprinting scripts rely on, can genuinely help. But simply adjusting individual settings one at a time can sometimes make your fingerprint more unique rather than less. This is worth saying plainly: if you change one obscure browser setting “for privacy,” but almost nobody else who visits that same site changes that same setting, you become the unusual visitor. Your setup stops blending in, and your fingerprint can become more distinctive. Fingerprinting resistance often works best by blending into a large crowd of similar-looking browsers, not by making your configuration as customized and locked down as possible. With that caveat in mind, here’s what genuinely moves the needle: • Privacy-focused browsers built for this problem. Some browsers are engineered so huge numbers of users present an intentionally identical, standardized fingerprint by default. They suppress or randomize the small variations that make fingerprinting effective, so you blend into a large, indistinguishable crowd of users. • Tracker-blocking browser extensions that detect and block known fingerprinting scripts before they run, not just blocking ads or known tracking cookies. Many mainstream tracker blockers have added fingerprinting-script detection over the past few years as this threat has grown. • Keeping your browser and OS updated. Counterintuitively, updates can help at the population level. Browser makers periodically reduce the granularity of certain signals (like rounding hardware-concurrency numbers or standardizing rendering outputs) to shrink fingerprinting power across their user base. You only benefit if you’re actually running the current version. • A VPN, specifically for the IP-address half of the equation. A VPN doesn’t touch your fingerprint, but it removes a second independent identifying signal that often gets combined with fingerprinting. What’s mostly theatre is manually disabling obscure features one at a time in the hope of becoming “invisible.” Uniqueness often comes from being different from the crowd. A browser configured with fifteen manually tweaked settings can be one of the most recognizable browsers on the internet, precisely because almost nobody else bothers to tweak all fifteen.

How does a VPN fit into this picture?

A VPN removes your real IP address from the equation. It hides your location and breaks the “same IP shows up again and again” pattern that trackers rely on. But it does not, by itself, change your browser’s fingerprint. It’s important to be straightforward here. A VPN solves one real piece of the puzzle, and pretending it solves everything would undermine the honest explanation this guide has been building toward. When you connect to a VPN, your traffic appears to originate from the VPN server’s IP address instead of your own. That breaks the tracking pattern where an ad network watches the same IP address return over and over across weeks or months. If you connect to different VPN server locations at different times, that signal stops being consistent. It also stops your internet provider from building its own location and browsing-pattern profile of you, which matters for a separate but related set of reasons covered in our guide on what logs a VPN actually keeps. What a VPN does not do is touch your screen resolution, installed fonts, canvas-rendering quirks, or any of the other fingerprint signals covered earlier. Your device is still the same device, running the same browser and answering the same technical questions the same way, just routed through a different server. That’s why fingerprinting and IP-based tracking should be treated as two separate problems requiring two separate defenses, not as one problem a single tool can fully solve. Where a VPN becomes genuinely important is in closing off other leaks that can quietly undo the privacy you think you have, even while you’re focused on fingerprinting. A VPN that doesn’t properly route DNS lookups through its encrypted tunnel can leak the list of every site you visit to your internet provider, separately from fingerprinting or cookies. That’s covered in detail in our DNS leak guide. And a VPN without a reliable kill switch can briefly expose your real IP address when a connection drops, undoing the protection you expected, right when you least expect it.

What does OllaVPN specifically do to help here?

OllaVPN hides your real IP address behind its own servers, resolves all DNS requests inside the encrypted tunnel so your browsing habits don’t leak separately, and runs a kill switch by default so a dropped connection never briefly exposes your real address. That covers the identifiable-network-signal half of this problem thoroughly on both the free and paid plans. We built OllaVPN around a simple idea: the parts of your privacy that a VPN can control should be handled as completely and as honestly as possible, without pretending it solves problems that live inside your browser. Here’s what that means in the context of everything covered above. Every connection to OllaVPN replaces your real IP address with one of ours, immediately breaking the “same IP keeps showing up” pattern that makes long-term IP-based tracking possible. Our in-tunnel DNS handling means the list of sites you visit never leaks to your internet provider through an unencrypted DNS request running alongside your protected traffic. This is a surprisingly common gap in cheaper or poorly engineered VPN services, and it can let your ISP rebuild a browsing profile even while your IP address looks protected. Our kill switch is on by default and can’t be casually switched off, so a dropped connection doesn’t create a brief window where your real IP address slips out unprotected mid-session. We also don’t log anything that could identify you or tie your activity back to you, covered in full detail in our dedicated logging guide. Even a perfectly hidden IP address doesn’t help much if the company hiding it is quietly keeping its own record of what you did with that protection. What we won’t claim is that any of this changes your browser’s fingerprint. Your screen resolution, installed fonts, and canvas-rendering signature are outside what a VPN is designed to change. For that half of the picture, you need a fingerprinting-resistant browser and a tracker-blocking extension, the combination covered earlier in this guide. Whether you’re on our free 10 Mbps plan or OllaVPN Plus at 10 Gbps for five devices, the privacy architecture underneath is the same. We don’t hold back protection for free users, because the point of building this was to make the network-level half of your privacy accessible to everyone, not just paying customers.

Why this topic matters beyond the immediate question

This guide sits at the intersection of several broader concerns worth understanding, even if your immediate question has already been answered. The tracking industry adapted the moment cookies became a target. Regulators, browser makers, and privacy advocates spent years pushing back against third-party cookies. The advertising and analytics industry didn’t disappear, it shifted investment toward fingerprinting and other cookie-independent techniques, because those methods survive the defenses people learned to use against cookies. Understanding this shift matters because “I clear my cookies” is advice from an earlier chapter of the story, not a complete defense against the current one. The signals involved are dual-use by design, which makes this genuinely hard to fully fix. Almost every fingerprinting signal exists because it serves a legitimate rendering or compatibility purpose. Browser makers can’t simply remove screen-size reporting, font enumeration, or canvas rendering without breaking huge parts of the web. This is fundamentally different from patching a security bug. There’s no single flaw to fix, just trade-offs between compatibility and privacy that browser makers keep negotiating, one version at a time. Your exposure compounds across layers of the internet you touch. A fingerprint identifies your browser. An IP address identifies your network connection. Account logins identify you by name the moment you sign in. None of these layers automatically protects the others. That’s why privacy in 2026 is best thought of as a stack of independent defenses, not a single switch.

What to actually do about it

If this guide makes you feel like you should take action, here are practical next steps in priority order: Test your current fingerprint before changing anything. Run the EFF’s Cover Your Tracks tool once, note your uniqueness score, and treat it as your baseline. You can’t improve what you haven’t measured, and the result is often the single most convincing five minutes you’ll spend on this topic. Switch to a browser designed to resist fingerprinting, or add a dedicated tracker-blocking extension. This is the layer that addresses canvas, WebGL, audio, and font-based signals. Nothing else on this list fixes that half of the problem. Pick a trustworthy VPN and use it by default, even on the free tier. This closes the IP-address half of the problem. If the VPN routes DNS properly, it also helps stop your browsing habits from leaking to your ISP separately. Our best free VPN 2026 guide compares trustworthy options across platforms. Run a leak check on your current setup, VPN or not. Our DNS lookup, WebRTC leak test, and what-is-my-IP tools show you clearly whether your network-level protections are delivering what they claim. Combine layers rather than expecting one tool to solve everything. A fingerprint-resistant browser + tracker blocker + VPN with in-tunnel DNS and a real kill switch + careful account hygiene (not staying logged into services you don’t need) is materially better than any single tool alone. Each layer is also inexpensive or free.