Blocking cookies is widely understood as the way to prevent tracking, and it addresses one mechanism completely while leaving another untouched.
The distinction is simple. A cookie is a value placed on your device and read back later. A fingerprint is a set of properties measured about your device, which requires storing nothing at all.
What a page can observe
A browser discloses a considerable amount by design, because pages need to adapt to the device rendering them.
| Signal | Why it is available | Distinguishing power |
|---|---|---|
| Browser and version | Compatibility | Low |
| Screen size and pixel ratio | Layout | Moderate |
| Time zone and language | Localisation | Moderate |
| Installed fonts | Text rendering | High |
| Canvas rendering output | Drawing graphics | High |
| Graphics hardware details | Accelerated rendering | High |
| Audio processing output | Sound handling | High |
None of these is sensitive individually, and each was exposed for a legitimate purpose. The tracking property emerges from combining them.
Why the combination identifies
Each attribute narrows the population. A common browser version might be shared by one person in ten, a screen resolution by one in twenty, a time zone by one in forty.
Multiply enough of these together and the remaining group is one person. Roughly seventeen bits of information distinguishes an individual among a hundred thousand, and a typical browser discloses considerably more than that, which is why fingerprinting works reliably rather than occasionally.
Rendering differences are the strongest signal
The most powerful attributes are not stated values but measured outputs. Instructing the browser to draw text and shapes to an off screen surface, then reading the result, produces output that differs slightly between graphics hardware, drivers, and font rendering settings.
The same instructions on the same operating system with different hardware produce visibly different values when compared byte by byte. Nothing is stored, nothing is asked, and the result is stable across sessions and across private browsing modes.
It is not only used for tracking
The same technique underpins fraud detection, and that dual use is why it is unlikely to be removed from browsers outright.
A bank recognising that a login is arriving from an unfamiliar device is performing fingerprinting, as is a service detecting that thousands of accounts share one machine. These uses are widely considered legitimate and rely on exactly the properties that make behavioural tracking possible.
The consequence is that browser makers restrict the most invasive signals rather than eliminating the capability, which is why progress here is incremental rather than decisive.
The paradox of defending against it
Blocking and modifying signals can make matters worse, which is the counterintuitive part.
Fingerprinting identifies by rarity, so an unusual configuration is easier to recognise than a common one. A browser with many extensions, uncommon settings, and spoofed values is more distinctive than a default installation, and reporting inconsistent values is itself a distinctive signal.
This is why the strategy that works is uniformity rather than concealment. Browsers designed against fingerprinting make every installation report identical values, so the population becomes one large indistinguishable group rather than many unique ones.
Signals below the browser
Some identifying information never reaches the page at all and is available to the server regardless.
The network address groups visitors by connection and location. The precise way a browser negotiates an encrypted connection differs subtly between implementations and versions, producing a signature visible to the server before any content loads. Neither is affected by anything configured within the browser.
What actually helps
Use a browser that actively resists fingerprinting by standardising what it reports, since this addresses the mechanism rather than individual signals. Partition storage and state by site, which limits linkage even where identification succeeds. And resist the temptation to accumulate extensions and unusual settings in the name of privacy, because each one contributes to the distinctiveness being defended against.
Note: the aim is not to be unrecognisable, which is not achievable. It is to be indistinguishable from a large group, which is a different objective and leads to different choices.