Fingerprints Are the New Cookies: How Your Browser Gives You Away

The piece opens with a parlour trick: visit the author's page and it assigns you a "nickname." Refresh the tab, clear your cookies, switch on a VPN — the nickname stays the same. Change devices and it changes, but stays just as consistent. Behind the trick is the device fingerprint: your browser answers questions about itself, no permission asked.

What's in it for the advertiser

Most sites earn from ads and quietly run third-party scripts. A fingerprint lets a tracker not only pick which ads you see but, if you have an account, buy your data from the platform — your name, activity, even your conversations with AI. The author notes with dry humour that none of this is about you personally anymore. In the data he sees not people but patterns — a "crystal ball of the 21^st century, made of silicon." The product goes to the highest bidder, advertiser or government alike.

A play in three acts

The history of third-party cookies is staged as a Google drama. Act I, pressure: it's 2019, Safari and Firefox already block cookies, and Google pledges to kill them in the name of "privacy above all." Act II, distraction: five years on, the Privacy Sandbox tools are clunky and draw antitrust concerns — so cookies stay, with a promise to mask IPs (which, in the end, wasn't delivered either). Act III, acceleration: device fingerprinting is officially allowed in ad products. If the EU ships consent banners faster than the world's biggest ad company, which holds two-thirds of the browser market, the company was simply sitting on its hands.

How it works

The browser's request already reveals OS, language, version and IP. Far more stable, though, is the data gathered when code runs: GPU and CPU behaviour, thread count, memory size, display parameters, audio processing, installed fonts. Millions run the latest Chrome; millions own M4 chips; millions browse in French. But at the intersection the count collapses toward one. A fingerprint needn't be globally unique — only unique enough to tell people apart within a sample.

The author explains this through the game Akinator and information theory: a rare answer carries more bits. A trait shared by 1 in 128 is worth 7 bits; singling out one person in a million city takes about 20 bits. In practice traits correlate, so the bits don't simply add up.

What to do

Test yourself at coveryourtracks.eff.org. In Chrome you walk around "with an ID on your forehead"; Safari and Firefox offer partial cover; only Brave (which injects noise, called "farbling"), Tor and Mullvad Browser seriously resist fingerprinting (by making everyone look alike). The paradox: privacy extensions make you more unique, since few people run them, and a smart tracker will notice. Nothing beats protection built into the browser engine — so if you want out, you have to commit.

Source: Hacker News