Fingerprints Are The New Cookies

TL;DR

Buying for a business?Offer from Amazon

Get business pricing on your home office setup

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

A report on royfish.dev argues that browser fingerprinting can identify and track users through a combination of network details and device measurements, even when cookies are cleared or a VPN is used. It raises concerns about advertising uses, but the supplied material does not establish how widely fingerprinting is deployed in Google’s ad products or verify the report’s account of that policy.

A report published on royfish.dev warns that browser fingerprinting can help websites recognize a browser without relying on cookies, using a combination of network information and measurements of the device running the page. The report frames the technique as a growing advertising and privacy concern, but the material provided does not independently confirm how widely it is used or substantiate its claim that Google has enabled it in advertising products.

Fingerprinting differs from cookie tracking because it does not depend on saving a conventional identifier in a browser. According to the report, a website can combine information available in a network request—such as the browser, operating system, language settings and IP address—with readings gathered by code running in the browser. The report lists measurements related to graphics hardware, processor behavior, memory, display settings, audio processing, fonts and other software characteristics.

Any one detail may be shared by many people, the report says. But combining several attributes can narrow the pool of similar devices enough to distinguish a browser within a particular site or service’s audience. That does not require a fingerprint to be unique across every device in the world. It needs to be consistent and distinctive enough for the party collecting it to recognize a browser in its own sample.

The article says clearing cookies, using a VPN or opening a private-browsing window may not, by themselves, prevent fingerprinting. Those steps can change or limit some information, but they do not necessarily make a device’s software and hardware characteristics indistinguishable. The report also argues that tracking could support targeted advertising and the linking of browsing activity to account information. Those are described as risks and possible practices; the supplied material does not document a particular data sale or show that every site using fingerprinting links the readings to a named person.

Why Cookie-Free Tracking Matters

Fingerprinting matters because it can weaken the assumption that deleting cookies or choosing private browsing stops sites from recognizing a browser. A persistent identifier assembled from device characteristics may remain useful when conventional storage is cleared. That can make privacy protections harder for people to assess: unlike a cookie, a fingerprint may not appear as a visible file that a user can delete.

The advertising stakes depend on how the technique is used. If a company can connect a device pattern to an account or combine it with other records, it may be able to infer repeated visits or associate activity with a known user. The report warns that profiles could be used beyond choosing ads, but it supplies no evidence of a specific government request, transaction or individual-level profile. Those possibilities should not be confused with confirmed events.

For readers, the immediate issue is the gap between privacy expectations and what websites can measure through ordinary browser code. A VPN mainly changes the apparent network address; it does not make a computer’s graphics, fonts or display identical to other devices. Protection depends on browser design and settings as well as network tools, and no single measure described in the report guarantees anonymity.

From Cookie Debate to Fingerprints

The report places fingerprinting within the long-running debate over third-party cookies, which advertisers have used to recognize browsers across sites. It recounts that Safari and Firefox began blocking such cookies, while Google announced plans in 2020 to phase them out and later developed its Privacy Sandbox proposals. The author says those proposals faced criticism and limited uptake, and characterizes Google’s later approach as a retreat from cookie removal.

These points are the report author’s account, not a full record of regulatory decisions or browser policy changes. The source material does not include links to company statements, adoption figures or regulatory findings that would verify each step. Its central technical distinction is clearer: cookies are stored identifiers, while fingerprinting derives an identifying pattern from characteristics exposed by a browser and device.

Browser protections vary, according to the report. It describes Brave as adding variation, or “farbling,” to some readings, while Tor Browser and Mullvad Browser aim to make users’ browser configurations more alike. These are presented as defenses against fingerprinting, not a guarantee that all tracking is blocked. The report also says mainstream browser security generally isolates websites from other sites’ data, but that isolation does not necessarily stop a page from collecting permitted device measurements.

““The fingerprint doesn’t need to be truly, globally unique – it just needs to be unique enough to tell people apart in your sample size.””

— Royfish.dev report

Adoption and Google Policy Details

The source material does not establish how many websites use fingerprinting, which companies collect which device signals, or how often those signals are linked to account data. It also does not provide technical tests showing how reliably a particular fingerprint persists across browser updates, device changes, VPN use or private-browsing sessions.

The report’s assertion that device fingerprinting is now available in Google advertising products is not supported here with a dated Google announcement or product documentation. The material also does not establish the present status of third-party cookies or Privacy Sandbox across regions and browsers. Those details can vary by product and time, so the report’s narrative should not be treated as a verified account of current company policy.

Nor does the article demonstrate that fingerprinting gives an advertiser a person’s name or reveals private conversations. Such identification would depend on additional data and the relevant site’s practices. The report raises a plausible privacy risk, but its strongest claims about data markets and government access are rhetoric rather than documented examples in the supplied source.

Evidence Needed on Tracking Use

The next useful developments would be dated product documentation from advertising platforms, browser makers and regulators that explains whether fingerprinting is permitted, restricted or detected, and which signals are involved. Independent measurement of tracking practices could clarify how widespread the technique is and whether browser defenses reduce recognition in real-world browsing.

Readers can review the privacy and fingerprinting protections offered by their browser, while recognizing that settings and tools have limits. The supplied report does not identify a specific enforcement action, company response or forthcoming policy deadline. Until more evidence is available, the confirmed point is narrower: websites can collect a range of browser and device characteristics, and researchers and privacy advocates warn that combining them can support recognition without conventional cookies.

Key Questions

What is browser fingerprinting?

It is a way to distinguish a browser using a combination of information about its network connection, software and device characteristics, rather than relying only on a stored cookie.

Does clearing cookies stop fingerprinting?

Not necessarily. Clearing cookies removes stored cookie data, but a site may still be able to measure browser or device characteristics. The report does not claim that every fingerprint remains stable in every circumstance.

Will a VPN prevent a device fingerprint?

A VPN can change the IP address a site sees, but it does not by itself alter all browser and hardware characteristics. It may affect one part of a fingerprint, not necessarily the full combination.

Does fingerprinting prove that a site knows my identity?

No. A fingerprint may distinguish a browser without revealing a person’s name. Linking it to an identified account would require additional information, and the supplied report does not document a specific case.

Which browsers does the report describe as offering protections?

The report identifies Brave’s “farbling” approach and the efforts of Tor Browser and Mullvad Browser to make users’ configurations more alike. It describes these as ways to reduce fingerprinting, not as guarantees against tracking.

Source: hn