What Your Browser Tells Every Site You Visit

You know about cookies. There’s a banner about them on every site, and you can clear them whenever you like.

Fingerprinting is the other one. There’s no banner, nothing is stored on your device, and there’s nothing to clear.

How it works

Your browser broadcasts information in order to function. Screen size, so pages lay out correctly. Language, so you get the right translation. Installed fonts, so text renders. Timezone, so dates display properly. Hardware details, so demanding pages can adapt.

None of it identifies you on its own. Millions of people have a 1920×1080 screen. Millions are in Europe/London.

But take thirty such values together and the combination is frequently unique. That combination is a fingerprint, and it persists through cookie clearing, through private browsing windows, and across sites, because it isn’t stored anywhere. It’s recalculated from what your browser is.

The counter-intuitive bit

Hardening your browser usually makes you easier to track.

This is the part that surprises people, and it’s why so much well-meaning privacy advice backfires.

Install twelve extensions, add an unusual font pack, spoof your user agent to something no one else reports, disable a handful of APIs. And you have become the only person on the internet with that exact profile. You haven’t hidden. You’ve built a permanent, unique identifier and volunteered it to everyone.

The effective strategy is the opposite: look like everyone else.

Tor Browser is built on this principle. Every Tor user reports the same window size, the same fonts, the same timezone, the same everything. The fingerprint identifies the crowd, not the person. That’s the only genuinely robust defence, and it comes at the cost of a deliberately constrained browsing experience.

What’s actually readable

Load the browser privacy check and you’ll see your own values. Everything on that page is read locally and shown only to you. Nothing is transmitted, which is the point.

The signals that carry the most weight:

Signal	What it gives away
Screen resolution	Device class; unusual sizes are highly identifying
Window size	Changes as you resize, but common combinations cluster
Timezone	Roughly where you are, and contradicts a VPN in another country
Languages	Where you’re from, sometimes more precisely than your IP
GPU renderer	Your exact graphics chip. One of the most distinctive single values
Canvas rendering	How your device draws text and colour, down to driver-level differences
Installed fonts	A large or unusual collection stands out sharply
CPU cores, memory	Device class and rough age

The GPU string and the canvas signature do a lot of the work. Both are byproducts of hardware and drivers rather than settings, which is why they’re hard to change and stable over time.

Your VPN doesn’t fix this

Worth stating plainly, because it’s a common assumption.

A VPN hides your IP address, which is worth doing. It does nothing about your fingerprint. Your screen, fonts, GPU and canvas rendering are identical whether the VPN is on or off.

Worse, a VPN can increase what you leak. If your IP says Amsterdam and your timezone says Europe/London and your language is en-GB, that mismatch is itself a signal. And it says you’re a UK user on a VPN, which is more specific than either fact alone.

Where it’s used

Advertising, overwhelmingly. As third-party cookies are phased out, fingerprinting is the fallback for tracking people across sites. This is the bulk of it.

Fraud prevention, which is a genuinely defensible use. Your bank recognising an unfamiliar device is why aggressive anti-fingerprinting sometimes triggers extra verification steps, you’ve made yourself look like a new machine.

Bot detection. Automated traffic often has an implausible fingerprint: no fonts, headless browser, hardware that doesn’t exist.

Paywall enforcement. Recognising the returning visitor who cleared their cookies.

What actually helps

In rough order of effectiveness:

1. Tor Browser, for anything where anonymity genuinely matters. Nothing else comes close.
2. A content blocker. Stopping fingerprinting scripts from loading beats trying to defeat them once they run, and it’s the highest-value change for most people.
3. Firefox with privacy.resistFingerprinting. Normalises timezone, screen and several APIs. Breaks some sites, that’s the trade.
4. Safari or Brave. Both ship meaningful protections by default; Brave randomises certain values per session.
5. Keep your window at a common size. Don’t maximise on an unusual monitor if it matters to you.

What doesn’t help much: private browsing alone, spoofing your user agent, or installing a pile of privacy extensions in the hope that more is better.

How worried to be

For most people this is an annoyance with real substance behind it: an entire industry follows you across the web without consent, and there is no opt-out mechanism because there’s nothing to opt out of.

For people whose safety depends on not being identified, journalists protecting sources, activists, people leaving abusive relationships, it’s a serious risk, and the answer is Tor Browser rather than incremental hardening of a normal browser.

Either way, the reason to look is that it’s invisible by design. You can see a cookie banner. You cannot see this happening, which is precisely why it’s worth spending two minutes finding out what your own browser is handing over.