Fingerprints Are the New Cookies: Why Clearing Your Browser Data Does Nothing Anymore

There is a page on the web right now that will give you a nickname, and then refuse to forget you. Clear your cookies: same nickname. Open an incognito window: same nickname. Connect a VPN so your IP address changes: still the same nickname. It only changes if you open it on a different device, and then it settles on that device just as stubbornly.

The page is Fingerprints are the new cookies, a demo by developer Roy Fish, and it spent a day near the top of Hacker News with over 700 points and 350 comments. What it demonstrates is not new technology. What makes it worth your time in 2026 is that the industry's main defense against it, the consent banner, quietly stopped applying, and the biggest ad company on earth reversed its position on the practice last year.

Full disclosure: I have not built a fingerprinting system, and the demo site's owner did not share any data with me. Everything below comes from the demo itself, its linked sources, and the Hacker News discussion, all linked inline. Where I am interpreting instead of reporting, I say so.

What fingerprinting actually is

A cookie is a file. You can delete it, block it, or refuse it, and the server simply loses track of you. Fingerprinting needs no file at all. Your browser freely announces dozens of small facts about itself on every page load: the user agent string, screen resolution, installed fonts, time zone, language, hardware concurrency, GPU model exposed through the graphics API, and a long tail of behavioral quirks.

Individually, none of these identify you. Combined, they often do. The tracker hashes the whole set into one value, and that value acts like a cookie you cannot delete, because it is regenerated from your hardware and software configuration the moment the script runs again. The demo site is honest about being simplified: it hashes a handful of measurements, and any single change breaks the hash. Professional trackers are more durable, maintaining identification even when individual variables change.

The practical consequence is the part people find unsettling. The standard advice for a decade has been "clear your cookies and browse privately." Against fingerprinting, that advice is worthless. The author's own challenge on the demo page is to try incognito, try a VPN, clear everything, and watch the nickname come back.

The Google arc: pressure, distraction, reversal

The most useful framing in the original article is its three-act retelling of Google's position on cookies, and every act has a public document behind it.

Act one was the pledge. In 2019, with Safari and Firefox already blocking third-party cookies and the practice turning into a public relations problem, Google announced a "privacy-first" path to phase them out of Chrome.

Act two was the delay. Five years of slippage followed, ending in 2024 with Google's announcement that instead of deprecating third-party cookies outright, it would introduce "a new experience" in Chrome and let users choose. The Privacy Sandbox technologies meant to replace cookies had struggled to gain adoption and attracted antitrust scrutiny along the way. Chrome holds roughly two thirds of the browser market, so Google's timeline effectively is the web's timeline.

Act three was the reversal. In January 2025, Google's ad products were opened up to device fingerprinting, with the company citing the rise of connected TVs and other environments where cookies do not work. The UK's Information Commissioner's Office responded sharply, noting that fingerprinting is a way to covertly collect sensitive information about users that they cannot reasonably prevent, and that privacy-invasive techniques should not be smuggled in by treating a policy update as consent.

Here is my read on why that reversal matters more than it sounds. Consent banners, the most visible privacy mechanism on the web, were never really about the cookie file. They exist because regulators classified tracking itself, not storage, as the thing requiring consent. A fingerprint requires no storage, so the banner never appears, and the tracking happens anyway. As one commenter on the Hacker News thread put it, this is already illegal in the EU in principle, because the rules cover the tracking. The gap is not the law, it is detection: cookie blocking is trivial to enforce, and there is no equivalent switch for a script that reads your screen resolution.

Why you cannot just install an extension

This is where most advice online goes wrong, and the demo article gets it right: countermeasures that hide you can also make you stand out.

The logic is blunt. Fingerprinting works by finding what makes your configuration unusual. If an extension disrupts the most common signals, the remaining signals, plus the fact that almost nobody runs that extension, become your identity. The article's own words: privacy extensions can make you more unique, since fewer people have them, and a smart tracker will simply ignore the signals you disrupted and focus on the ones it can still read. The same problem applies to browser settings like Firefox's Resist Fingerprinting flag, which breaks some sites and makes the users who enable it a smaller, more identifiable population.

The defense that actually holds up is engine level: the browser itself lies consistently to every script, so that you look exactly like thousands of other users. Per the article, the only major browsers doing this today are Brave, Tor Browser, and Mullvad Browser. Chrome users, in the author's phrasing, are walking around with an ID on their forehead. Safari and Firefox land in the middle: meaningfully better than Chrome, still identifiable by advanced trackers.

One honest caveat comes straight from the HN discussion. Fingerprinting is an entropy game, and the crowd on a default iPhone is enormous. If your device configuration is common, your fingerprint may be shared by thousands of people, which blunts the technique against you specifically even though it still works statistically across the population. The users who should worry most are the ones with unusual setups: exotic Linux builds, niche browsers, high-end multi-monitor rigs with unusual font collections. The more you tinkered, the more unique you are.

The 15-minute fingerprint audit

Here is the save-worthy part. If you do nothing else after this article, do these four things this week.

• Measure your uniqueness. Visit coveryourtracks.eff.org from the EFF. It shows your fingerprint's entropy for each measured data point and tells you, roughly, how many browsers share your exact configuration. If it says your browser has a unique fingerprint, that is the number to improve.
• Check your threat model honestly. If you are on a default-configured mainstream browser on a common device, your statistical exposure is lower than the scary demos imply. If you are a developer with a customized environment, assume you are easy to single out. The EFF test tells you which camp you are in; act accordingly.
• Pick one engine-level protected browser for sensitive browsing. You do not have to switch everything. Brave for daily use or Tor Browser for the sessions where tracking is the last thing you want is a reasonable split. Engine-level protection beats every extension, because the browser controls what the scripts can see in the first place.
• Drop the useless rituals. Clearing cookies and using incognito windows remain good hygiene for other reasons, but stop believing they hide you from trackers. Knowing which tools do nothing is itself privacy protection, because it stops the false sense of security.

The uncomfortable takeaway

The comment that stuck with me from the Hacker News thread came from a developer who called the situation two things at once: cool tech, horrifying invasion of privacy. Their team evaluated a commercial fingerprinting product and settled instead on transport-layer fingerprinting, ja3 and ja4 hashes, at the CDN layer. That detail is worth sitting with. The same technique that quietly tracks you is also the technique that keeps credential-stuffing bots out of login endpoints. There is no clean side to be on; fingerprinting is infrastructure now, and it is used by both the attackers and the defenders of every system you touch.

The deeper lesson is about how privacy actually regresses. It rarely happens through one dramatic announcement. It happens through a five-year sequence: a pledge, a distraction, and a quiet reversal, each step defensible on its own, with the press release for each step supplying the headline and the fine print supplying the policy. The consent banner era assumed the tracked thing was visible, a file you could delete. The fingerprint era assumes nothing needs to be stored at all. Every privacy tool built for the first era needs re-examining against the second.

One genuine bright side: the cat and mouse is not over. As the discussion noted, the next moves are already being debated, from browsers that deliberately slow their responses to confuse measurement, to regulators treating fingerprinting as the consent-requiring practice it always was. Two thirds of the web runs a browser whose owner sells ads. That is the structural problem, and no extension fixes it. What fixes it, eventually, is enough users choosing browsers whose business model does not depend on knowing who they are.

I write about backend engineering, security, and AI every week. Subscribe, it is free, so the next investigation lands in your feed instead of the algorithm's shuffle.

Your turn: run the EFF test and drop your result in the comments. Did your browser come back unique, or are you one of the crowd? And if you already switched to Brave, Tor, or Mullvad, what broke, and was it worth it?