Browser Fingerprinting Is the New Cookie, and You Cannot Opt Out
Remember when Google promised to kill third-party cookies? It was 2020, Safari and Firefox had already blocked them, and Google pledged a "privacy-first" replacement. Five years later, cookies are still here, the Privacy Sandbox replacements raised antitrust concerns, and Google quietly walked back the whole plan. But they did introduce something new: device fingerprinting in their ad products.
What Is Fingerprinting?
When you visit a website, your browser sends information to the server: browser version, operating system, language, screen resolution. That alone is not unique enough to identify you. But once JavaScript runs on your device, it can measure hardware characteristics that are remarkably stable: GPU vendor and behavior, CPU thread count, memory size, display pixel ratio and refresh rate, audio processing quirks, installed fonts, and browser extensions.
Individually, none of these are unique. Millions of people use Chrome on a Mac with an M4 chip. But combine them all, and the intersection gets very small, very fast. Your GPU model plus your screen resolution plus your audio context plus your installed fonts produces a fingerprint that is consistent across sessions, incognito mode, VPNs, and cookie clears.
Why It Is Worse Than Cookies
Cookies have a fundamental weakness for trackers: you can delete them. You can clear your browser data, block third-party cookies, use incognito mode, and the tracking identifier is gone. Fingerprinting does not have this property. Your hardware is your hardware. Short of buying a new computer, your fingerprint stays the same.
The article walks through a live demo: you visit the page, it assigns you a nickname, and that nickname persists across refreshes, cookie clears, incognito mode, and VPN connections. The only thing that changes it is switching to a different device.
The Browser Landscape
Not all browsers are equally vulnerable. The article categorizes them by their approach to privacy:
Chrome and Edge: Stop at isolation. A website's code cannot see data from other websites, but fingerprinting is fair game. Google now actively uses fingerprinting in its ad products.
Safari and Firefox: Extend protections to privacy, including some anti-fingerprinting measures, but do not fully protect against hardware-based fingerprinting.
Brave: Uses "farbling," injecting noise into hardware readings to make your fingerprint inconsistent between visits.
Tor and Mullvad Browser: Make every user look identical. If everyone has the same fingerprint, it cannot be used to identify anyone.
The Five-Year Distraction
The article frames Google's cookie saga as a three-act play. Act I: pressure, in 2019, when cookies became bad PR. Act II: distraction, the Privacy Sandbox, which took five years and raised antitrust concerns. Act III: acceleration, where Google introduces device fingerprinting in ad products while everyone was still watching the cookie saga. The EU rolled out consent banners. Google pledged privacy. And while everyone was looking at cookies, fingerprinting walked in through the front door.
What You Can Do
If you are on Chrome or Edge, you are fully exposed. Switching to Firefox or Safari helps partially. Brave's farbling approach is better. For maximum protection, Tor and Mullvad Browser are the only options that make fingerprinting useless by making everyone look the same. The tradeoff is performance and convenience: Tor is slow, and Mullvad requires a VPN subscription.
The uncomfortable truth is that the web's privacy model was built around cookies, and cookies are a solved problem for trackers. Fingerprinting is the next generation, and unlike cookies, it does not leave a file on your computer that you can delete.