Browser fingerprinting is a tracking technique that identifies a web browser by combining many of its technical characteristics into a unique profile, without storing anything on the user’s device.
How browser fingerprinting works
A website’s scripts silently collect attributes that browsers reveal to every page:
- User-Agent string, operating system, language and time zone;
- screen resolution, installed fonts and hardware details such as CPU cores and memory;
- rendering differences in canvas, WebGL and audio processing, which vary by graphics card and drivers;
- IP address, HTTP headers and TLS handshake parameters.
Each value is common on its own, but together they form a fingerprint that is often unique. The EFF’s Panopticlick study in 2010 found that about 84% of browsers tested had a unique fingerprint. Unlike cookies, a fingerprint cannot simply be deleted and works in private browsing mode.
How browser fingerprinting is used
- Advertising and tracking – following users across sites as third-party cookies disappear, which adds to a person’s passive digital footprint. Google’s advertising policies began permitting fingerprinting in 2025, a move criticised by the UK data protection regulator.
- Fraud prevention – banks and online shops compare fingerprints to detect bots, account takeovers and logins from unfamiliar devices.
- Criminal evasion – attackers use antidetect browsers to imitate the fingerprints of victims. The Genesis Market, shut down by police in 2023, sold “bots” with stolen cookies and fingerprints collected by infostealers so buyers could impersonate victims’ browsers.
How to limit fingerprinting
- Use browsers with built-in protection: Tor Browser makes all users look alike, while Brave and Firefox block or randomise known fingerprinting scripts.
- Avoid unusual extensions and settings that make a browser stand out.
- Block third-party scripts with privacy extensions.
- Test your browser with the EFF’s Cover Your Tracks tool.
Synonyms:
device fingerprinting, canvas fingerprinting
