Browser Fingerprinting and Ad Tracking: How You Are Followed Online

You looked at a pair of running shoes once. Now they follow you across news sites, social media, and a recipe blog for three weeks. Most people assume this is cookies, and that clearing them fixes it. It used to be. It largely is not any more.

The tracking industry adapted. When browsers started blocking third-party cookies, the money moved to techniques that do not need cookies at all — chief among them browser fingerprinting, which identifies you by the unique combination of your device's characteristics rather than by anything stored on it.

The Old Way: Cookies

A third-party cookie is a small file dropped by an advertising network embedded on a site. Because the same network is embedded on thousands of sites, it recognises the cookie each time and builds a browsing history.

This is now heavily restricted. Safari and Firefox block third-party cookies by default, and Chrome has spent years reworking its approach. Cookies still matter, but they are no longer the main mechanism.

The New Way: Fingerprinting

Instead of storing something on your device, fingerprinting measures your device. A script collects dozens of characteristics that your browser reveals in the ordinary course of loading a page:

• Screen resolution and colour depth
• Operating system and browser version
• Time zone and language settings
• Installed fonts
• Graphics hardware, measured by how it renders a hidden image (canvas and WebGL fingerprinting)
• Audio processing characteristics
• Number of CPU cores and available memory
• Battery status, touch support, and installed plugins

Individually, none of these identifies you. Combined, they are frequently unique. Research from the Electronic Frontier Foundation's Panopticlick and Cover Your Tracks projects found that the large majority of browsers carry a unique or near-unique fingerprint.

The consequence is the part that surprises people: clearing cookies does nothing, private browsing does nothing, and changing your IP with a VPN does nothing. Your fingerprint is the same in an incognito window, because it is a property of the device and browser, not of stored data.

The Other Techniques in Use

• Tracking pixels. A 1×1 invisible image in a web page or email. In email it reports when you opened the message, how many times, roughly where, and on what device — which is why "read receipts" exist in marketing tools you never consented to.
• Link decoration. Those long strings after the "?" in a URL carry an identifier from one site to the next, surviving cookie blocking.
• CNAME cloaking. A tracker disguised as a subdomain of the site you are visiting, so it looks first-party to your browser and evades blocking.
• Cross-device identity graphs. Data companies link your phone, laptop, and TV through shared IP addresses, logins, and behavioural patterns.
• Data brokers. Online behaviour is merged with offline data — purchases, property records, loyalty schemes — into a single profile that is bought and sold.
• Hashed email matching. The industry's cookie replacement. When you enter your email into any site, it can be hashed and matched against a global identity graph, tracking you across devices and browsers regardless of your cookie settings.

What They Actually Build

Not just "interested in running shoes." A modern advertising profile can include inferred age, income bracket, relationship status, health interests, political leaning, employment situation, and life events such as moving house, pregnancy, or bereavement — because those events change browsing patterns in recognisable ways.

That profile is used for pricing as well as advertising. Differential pricing based on device type and location is a documented practice in travel and retail.

Warning Signs You Are Being Tracked Heavily

• Adverts for a product you only discussed or viewed on a different device.
• Adverts reflecting a physical place you visited, not something you searched.
• The same advert following you across completely unrelated sites for weeks.
• Marketing emails from companies you never gave your address to.
• Prices that change when you revisit a travel site, or differ between your phone and your laptop.
• Testing your browser at a fingerprinting checker and being told your configuration is unique.

How to Reduce Tracking

1. Change browser — this is the biggest single step

Firefox with Enhanced Tracking Protection set to Strict blocks trackers, fingerprinters, and cryptominers, and isolates cookies per site. Brave blocks aggressively by default and randomises certain fingerprinting signals so your fingerprint changes between sessions. Safari has strong built-in Intelligent Tracking Prevention and presents a simplified system profile that makes fingerprinting harder. Tor Browser is the strongest option, because every user is deliberately made to look identical — but it is slow and breaks many sites.

2. Understand the fingerprinting paradox before installing extensions

This trips people up. Installing five privacy extensions and a rare font pack makes your browser more unusual, and therefore easier to fingerprint. Blending in beats standing out. Use one good content blocker, not seven.

3. Use one solid content blocker

uBlock Origin is the standard recommendation — it blocks trackers as well as adverts, is open source, and is not funded by an advertising company. Adding Privacy Badger alongside it is reasonable; adding six more is counterproductive.

4. Change your search engine

Your search history is the richest single source of profile data. DuckDuckGo, Startpage, or Brave Search remove that source entirely, and switching costs nothing.

5. Block tracking pixels in email

Turn off automatic image loading in your mail client, or use a provider that proxies images. Apple Mail Privacy Protection does this automatically and is worth enabling.

6. Use email aliases

Hashed-email tracking works because you use the same address everywhere. A unique alias per service breaks the link between your profiles and tells you exactly who leaked your address.

7. Reset your advertising ID on mobile

On iPhone, turn off "Allow Apps to Request to Track" entirely. On Android, delete or reset the advertising ID under privacy settings. Do this now and again periodically.

8. Strip tracking parameters from links

Before sharing a URL, delete everything after the "?" — it usually still works and no longer carries an identifier. Some browsers and extensions do this automatically.

9. Opt out where the law gives you the right

In the EU and UK, reject non-essential cookies on the banner rather than accepting. In California and similar jurisdictions, use "Do Not Sell or Share My Personal Information" links. Global Privacy Control, supported by several browsers, sends that signal automatically and is legally binding in some places.

10. Remove yourself from data brokers

Tracking data merges with broker profiles. Submitting deletion requests to the major brokers reduces what can be linked to your browsing.

11. Understand what a VPN does and does not do

A VPN hides your IP address from sites and your browsing from your ISP. It does not stop fingerprinting, cookies, or tracking of accounts you are logged into. It is a useful tool aimed at a different problem.

12. Test your setup

Use the EFF's Cover Your Tracks tool. It shows whether your browser blocks trackers and how unique your fingerprint is, and it lets you see whether a change you made actually helped.

The Realistic Goal

Complete anonymity online requires giving up most of the convenience of the modern web, and almost nobody will do that. That is fine — it is not the right target.

The realistic aim is to stop being trivially easy to track: block the obvious trackers, remove the identifiers you can, and avoid handing over the same email address everywhere. That alone removes most of you from most profiles.

The Bottom Line

Clearing your cookies has not been meaningful protection for years. Modern tracking identifies your device by its characteristics, follows you across browsers through your email address, and merges the result with data you gave to someone else entirely.

Three changes do most of the work: switch to Firefox with Strict protection or Brave, install uBlock Origin and nothing else, and change your default search engine. Add email aliases and turn off app tracking on your phone, and you have removed yourself from the easy majority of tracking.

Then run Cover Your Tracks once, so you can see the difference rather than just hoping for it.