Last updated: October 2026. Written by Morgan Logan.
Clearing your cookies does nothing to stop it. Incognito mode does nothing either. Browser fingerprinting identifies you from the way your device is configured, and there is no stored file to delete.
Most guides on this subject are published by VPN companies, and a lot of them imply that a VPN helps. It does not. At Privaroo we run independent VPN testing, and we have tested enough browsers to say plainly that this is one of the few tracking problems a VPN leaves completely untouched.
There is a second problem with the standard advice. Almost every article tells you that your fingerprint is unique and that you should install privacy tools. The research says the picture is more complicated, and that some of those tools make you easier to track, not harder.
What Is Browser Fingerprinting?
Browser fingerprinting is a tracking method that identifies a device by collecting its configuration rather than by storing data on it. A site gathers dozens of small details screen resolution, installed fonts, graphics hardware, timezone, language, browser version and combines them into a single identifier. Some of these details arrive automatically in the HTTP headers your browser sends with every request. Others are queried actively by JavaScript running on the page. Nothing is written to your device, which is the critical difference from cookies. There is no file to delete, no setting that clears it, and no visible indicator that it is happening. Because the identifier comes from your hardware and software configuration, clearing your browsing data leaves it entirely intact. A fresh browser install on the same machine produces a very similar fingerprint.
That last point is what makes fingerprinting durable. Cookie-based tracking breaks the moment a user clears their data. Fingerprint-based tracking survives it.
What Your Browser Actually Gives Away
Not every signal carries the same weight. A few are nearly universal and tell a tracker almost nothing. A handful are rare enough to narrow you down to a small group on their own.
| Signal | What it reveals | Identifying power |
|---|---|---|
| Canvas rendering | How your GPU and drivers draw a hidden image | High |
| WebGL renderer string | Your exact graphics hardware model | High |
| Installed fonts | Software you have installed over time | High |
| AudioContext | How your audio stack processes a test tone | Medium to high |
| Screen resolution and color depth | Display configuration | Medium |
| Hardware concurrency | CPU core count | Medium |
| Timezone and language | Rough location and locale | Low to medium |
| User agent string | Browser and OS version | Low |
The hardwar derived signals are the stubborn ones. Your user agent changes with every browser update. Your WebGL renderer string does not change until you replace the machine.
Canvas fingerprinting deserves a specific mention because it is the most widely deployed technique. The site asks your browser to draw an image you never see, then reads the pixels back. Tiny differences in your GPU, drivers and font rendering produce a result that is consistent on your machine and different on most others.
One related signal sits outside the browser configuration entirely. WebRTC can expose your real IP address even behind a VPN, which is a separate failure class worth checking on its own our VPN leak test guide covers how to test for it.
Uniqueness Is Not the Same as Being Tracked
This is where most coverage of browser fingerprinting goes wrong, and it changes what you should actually do about it.
A unique browser fingerprint does not automatically mean you can be tracked. Tracking requires linkability: the ability to recognize the same device across separate visits over time. Uniqueness and linkability are different properties, and a fingerprint can have one without the other. The widely quoted figure that 83 to 90 percent of browsers are unique comes from studies by Eckersley and Laperdrix, whose data was collected from people who visited fingerprinting test sites on purpose. That is a self-selected sample of privacy-interested users with unusual configurations, which pushes the number up. When researchers measured the same thing on an ordinary French publisher's website, only 33.6 percent of devices had a unique fingerprint. Your real-world exposure is likely lower than the headline statistic suggests, but lower is not the same as safe.
The reason lower is not safe is stability. Eckersley found that 37 percent of returning visitors showed more than one fingerprint over time, which sounds like good news. It was not: roughly 65 percent of those devices were still re-identified by a simple linking heuristic that tolerated small changes.
Later work by Vastel and colleagues measured the drift directly. Half of the repeat visitors to AmIUnique changed their fingerprint within 5 days. Their linking technique still followed those visitors for an average of 74 days.
Here is what that means in practice: trackers do not need an exact match. They use fuzzy matching, treating a fingerprint that differs in one or two attributes as probably the same person. Changing a setting resets nothing if the rest of your configuration stays recognizable.
How to Test Your Own Fingerprint
Three tools cover the ground. Run at least two, because they weight signals differently and a single result can mislead you.
Cover Your Tracks (EFF)
Cover Your Tracks is the best starting point. It reports your fingerprint in bits of entropy and sorts you into a verdict: uniquely identifiable, nearly unique, or common. Higher entropy means fewer people share your configuration.
It also checks whether your browser blocks trackers, which is a separate question from how identifiable you are.
BrowserLeaks
BrowserLeaks is not one score but a set of individual tests canvas, WebGL, audio, fonts and more. Use it after Cover Your Tracks tells you that you stand out, to find which specific signal is responsible.
AmIUnique
AmIUnique tracks how your fingerprint changes across visits. Given that stability is the property that actually enables tracking, this is the most useful of the three for the question that matters.
Two things to get right. Keep JavaScript enabled during the test, or the tools cannot query the signals and your result will be incomplete and falsely reassuring. And screenshot each report before you change a setting, so you can tell whether the change helped.
One honest caveat. All three tools measure uniqueness. As the section above explains, uniqueness is the weaker half of the problem. These tools will tell you that you are highly identifiable, and they will not tell you whether you are actually being linked across sessions. Treat a bad score as a reason to look closer, not as proof you are being followed.
Why Privacy Extensions Can Make You Easier to Track
The intuitive fix is to install something that hides or randomizes your signals. For most people this backfires.
Spoofing creates inconsistencies, and inconsistency is itself a signal. A user agent spoofer that reports Windows while your WebGL string reports Apple silicon has not hidden you. It has flagged you as someone running a spoofer, which is far rarer than either configuration on its own.
Research by Rudametkin makes this explicit: most fingerprinting countermeasures are identifiable through exactly the inconsistencies they introduce. The tool meant to blend you in marks you out.
The same logic applies to your browser choice and your extension list. A rare browser running 6 privacy add-ons produces a rarer fingerprint than a stock install of a common one. You have made yourself more interesting, not less visible.
The strategy that works is the opposite of the intuition. The goal is not to look like nobody. It is to look like everybody. Anything that moves you toward a large crowd of identical configurations helps. Anything that makes your setup distinctive hurts, even when it is marketed as a privacy feature.
This is why the browsers that perform best here do not randomize per user. They standardize, so that every user of that browser presents the same fingerprint.
What Actually Reduces Your Fingerprint
Ranked by how much difference each one makes, not by how often it gets recommended.
1. Use a browser that standardizes. Tor Browser and Mullvad Browser make all of their users look alike. This is the only approach that attacks linkability rather than uniqueness, which is why it sits at the top. For which browser fits which situation, see our breakdown of the browsers that actually resist fingerprinting.
2. Accept randomization as the usable compromise. Brave randomizes signals per session instead of standardizing them. Weaker in theory, considerably easier to live with day to day.
3. Cut your extensions and site permissions. This is the biggest practical gain for most people, and it costs nothing. Every extension that modifies a page is a potential signal. Every granted permission is another attribute.
4. Separate your profiles. Use one browser profile for sensitive browsing and another for everything else. This does not reduce your fingerprint, but it breaks the link between contexts, which is the property that matters.
5. Disabling JavaScript works and breaks the web. It is genuinely effective, since most active signals require it. It also makes a large share of modern sites unusable. Worth knowing, hard to recommend broadly.
Tor's approach is the strongest of these, and it comes with real costs in speed and site compatibility. We compare that tradeoff against the network layer alternative in our VPN versus Tor guide.
Does a VPN Stop Browser Fingerprinting?
No. A VPN does not stop browser fingerprinting and does not change your fingerprint at all. A VPN operates at the network layer: it replaces the IP address a site sees and encrypts traffic between your device and the VPN server. Browser fingerprinting operates inside the browser, using signals that are generated on your device and sent in the page request itself. Those signals are identical whether the VPN is connected or not. Researchers have documented sites correctly identifying three separate visits plain Firefox, Firefox in private browsing mode, and Firefox in private browsing mode behind a VPN as the same user. The two tools solve different problems and do not overlap. A VPN hides where you are connecting from. A fingerprint-resistant browser changes what your device reveals once it has connected. Running both covers more ground than either one alone.
That is not an argument against VPNs. Hiding your IP address from every site you visit, and hiding your destinations from your internet service provider, are real protections that a browser cannot provide. They are simply a different layer. If you want both, our tested VPN comparison covers the network side.
What Changed in 2026
Browser vendors shifted tactics this year. Rather than blocking the high entropy APIs outright, which breaks sites, they now add small amounts of noise to canvas, WebGL and audio output so that the same hardware does not return an identical value every time.
Chrome has been testing a stricter measure: blocking canvas readbacks entirely in Incognito mode. There is also early experimentation with randomized TLS handshake signatures, which would address a fingerprinting surface that sits below the browser entirely.
Trackers are adapting in step. The current counter-technique is sorted signatures and fuzzy matching, which absorb small amounts of injected noise and still resolve to the same identity.
The honest assessment: the arms race currently favors the trackers. Noise injection raises the cost of fingerprinting without ending it, and standardization remains the only defense that changes the maths rather than the margins.
Key Takeaways
- Browser fingerprinting identifies your device by configuration, not stored data. Clearing cookies has no effect on it.
- Uniqueness is not the same as trackability. Linkability over time is what actually enables tracking.
- The 90 percent uniqueness figure comes from self-selected test-site visitors. A real-world publisher sample measured 33.6 percent.
- Spoofing and randomizing tools frequently backfire by creating detectable inconsistencies.
- Standardization beats randomization, because it moves you into a crowd instead of making you distinctive.
- A VPN does not change your fingerprint. It solves a different problem at a different layer.
If this is the first item on a longer list, our starting setup for privacy tools covers what to put in place first and in what order.
Frequently Asked Questions
Can you completely stop browser fingerprinting?
No, and anyone promising otherwise is overselling. Complete prevention would require blocking every signal your browser exposes, which breaks most of the modern web. The realistic goal is reduction: use a browser that standardizes its users, keep your extension list short, and accept that you are lowering your exposure rather than eliminating it.
Does incognito mode prevent fingerprinting?
No. Incognito mode stops your browser from saving history and cookies locally after the session ends. It does not change a single one of the signals used to build your fingerprint. Your screen resolution, fonts, graphics hardware and timezone are identical in a private window. Incognito protects you from other people using your device, not from the sites you visit.
Does clearing cookies change my fingerprint?
No. Cookies are files stored on your device, while your fingerprint is derived from how your device is configured. Clearing cookies removes one tracking method and leaves the other completely intact. This is precisely why advertisers invested in fingerprinting: it survives the cleanup that defeats cookies.
Is browser fingerprinting legal?
It is contested, and the answer depends on where you are and why it is being done. European data protection authorities have taken the position that fingerprinting for tracking purposes requires user consent under the GDPR. Fingerprinting used for fraud prevention faces fewer restrictions. In the United States the position is less settled. This is not legal advice.
Does a VPN stop browser fingerprinting?
No. A VPN changes your IP address and encrypts your traffic, but your browser sends exactly the same identifying signals with the VPN on or off. Use a VPN for the network layer and a fingerprint resistant browser for the in-page layer. Neither substitutes for the other.
