What is Browser fingerprinting?
Browser fingerprinting identifies a device by combining its observable characteristics — user agent, screen size, fonts, time zone, rendering quirks — into a signature distinctive enough to recognise later. It requires no cookie and no storage, which is why it survived cookie restrictions, and why regulators treat it as tracking regardless.
How it works
Any single attribute is unremarkable. Combined, they are not. Screen resolution, installed fonts, time zone, language, GPU model, audio processing quirks and the exact way a hidden canvas renders a string together produce a signature that is frequently unique among millions of browsers.
The reason it spread is that it defeats the visitor’s controls. Clearing cookies does nothing. Private browsing does nothing. There is no stored artefact to delete, and usually no way to tell it happened.
Why “no cookies” is not the same as “no tracking”
This is the claim to check carefully in any privacy-analytics comparison. A tool can truthfully say it sets no cookies while fingerprinting every visitor — and that is a worse privacy position than the cookie, because at least the cookie could be cleared.
Regulators have been explicit: the ePrivacy consent requirement covers gaining access to information stored in terminal equipment, which the EDPB has confirmed reaches fingerprinting. A fingerprint that singles out a person is also personal data under the GDPR. The absence of a cookie changes nothing about either.
The distinction that decides it
Both fingerprinting and honest cookieless analytics derive an identifier from request characteristics. The difference is durability, and it is not a small one.
Fingerprinting maximises persistence deliberately: the goal is to recognise the same device months later, across sites. A rotating salted hash does the opposite — it is designed to stop working. Once the salt rotates, the identifier cannot be regenerated by anyone, including the operator, so recognition expires by construction rather than by policy.
One is built to remember. The other is built to forget. That is the line, and it is worth asking a vendor which side of it they are on.