DEV Community

Tiamat
Tiamat

Posted on

Your Browser Has a Unique Fingerprint — And Cookies Are the Least of Your Problems

#webdev #javascript #privacy #security

Clear your cookies. Use incognito mode. Install every ad blocker you can find.

You're still being tracked.

Browser fingerprinting is a persistent, invisible, unclearable tracking method that has largely replaced cookies as the tool of choice for surveillance capitalism. Unlike cookies — which you can delete — your browser fingerprint is derived from characteristics of your device and software configuration. You can't delete your screen resolution. You can't clear your GPU vendor. You can't empty your list of installed fonts.

In 2010, the Electronic Frontier Foundation launched Panopticlick (now Cover Your Tracks) to measure how unique browsers were. The results were stark: 83.6% of browsers had a fingerprint unique enough to track across sites with no cookies at all. Today that number is higher.

Let's look at exactly what's being collected — and what it costs you.

What Browser Fingerprinting Collects

A fingerprint is built by collecting dozens of signals and hashing them into a stable identifier. Each signal adds "entropy" — bits of uniqueness that distinguish your browser from others.

Canvas Fingerprinting (10-15 bits)

JavaScript draws a hidden image using the HTML5 Canvas API. Subtle variations in GPU hardware, installed fonts, operating system antialiasing, and graphics drivers cause every device to render the image slightly differently. The rendered pixels are hashed. This single signal can identify a browser with reasonable confidence.

// What canvas fingerprinting looks like:
const canvas = document.createElement('canvas');
const ctx = canvas.getContext('2d');
ctx.textBaseline = 'top';
ctx.font = '14px Arial';
ctx.fillText('Browser fingerprint 🎨', 2, 2);
ctx.fillStyle = 'rgba(102, 204, 0, 0.7)';
ctx.fillRect(125, 1, 62, 20);

// Hash the pixel data — this is your canvas fingerprint
const hash = canvas.toDataURL();
Enter fullscreen mode Exit fullscreen mode

WebGL Fingerprinting (10-15 bits)

Similar to canvas, but uses 3D rendering. WebGL exposes the GPU vendor ("NVIDIA GeForce RTX 3090") and renderer string directly. Combined with rendering variations, this is often enough to uniquely identify a machine.

Audio Fingerprinting (5-8 bits)

The Web Audio API allows JavaScript to generate audio waveforms. The way your sound card processes and outputs audio varies slightly by hardware and driver version. These sub-millisecond timing differences are detectable and stable across sessions.

// Audio fingerprinting:
const context = new AudioContext();
const oscillator = context.createOscillator();
const analyser = context.createAnalyser();
const gain = context.createGain();
oscillator.connect(analyser);
gain.gain.value = 0;
oscillator.start(0);
// Sample the output — tiny variations in processing = fingerprint
Enter fullscreen mode Exit fullscreen mode

Font Enumeration (15-20 bits)

By rendering text in many different fonts and measuring how the browser lays it out (using JavaScript timing), trackers can determine which fonts are installed on your system. The specific combination of 200+ fonts is highly unique. What fonts you have installed is a function of your OS version, installed applications, and system configuration.

Navigator Object (8-12 bits) 

// All exposed to any JavaScript on any page:
navigator.userAgent       // Browser + OS + version string
navigator.language        // "en-US"
navigator.languages       // ["en-US", "en", "de"]
navigator.platform        // "Win32" / "MacIntel" / "Linux x86_64"
navigator.hardwareConcurrency  // Number of CPU cores
navigator.deviceMemory    // RAM in GB (rounded)
navigator.plugins         // Installed browser plugins
Enter fullscreen mode Exit fullscreen mode

Screen and Window (5-8 bits) 

screen.width              // 2560
screen.height             // 1440
screen.colorDepth         // 24
screen.pixelDepth         // 24
window.devicePixelRatio   // 2 (for Retina displays)
Enter fullscreen mode Exit fullscreen mode

Timezone and Locale (3-5 bits) 

Intl.DateTimeFormat().resolvedOptions().timeZone  // "America/New_York"
// + locale-specific date/number formatting quirks
Enter fullscreen mode Exit fullscreen mode

Network Information (3-6 bits) 

navigator.connection.effectiveType  // "4g"
navigator.connection.downlink       // 10 Mbps (estimated)
Enter fullscreen mode Exit fullscreen mode

The Entropy Math

Each signal narrows down which browser you are. Here's the rough math:

Signal Entropy (bits) Unique out of
User Agent 10 1 in 1,024
Canvas hash 12 1 in 4,096
WebGL renderer 10 1 in 1,024
Fonts installed 16 1 in 65,536
Screen resolution 6 1 in 64
Timezone 5 1 in 32
Language list 5 1 in 32
Combined ~20-25 1 in 1-33 million

The human population of internet users is roughly 5 billion. With 20+ bits of entropy, most fingerprints are globally unique.

Incognito mode doesn't help. Incognito prevents your browser from saving cookies and history — but the fingerprint signals (fonts, GPU, screen, etc.) are unchanged. The tracker still sees the same device.

Who Uses Browser Fingerprinting

Ad Networks
Google, The Trade Desk, LiveRamp, and hundreds of smaller networks use fingerprinting to track users across domains even after they've cleared cookies. This is how ads follow you from a news site to a shopping site to your banking app.

Fraud Detection
Stripe, Sift, and other fraud prevention platforms use fingerprinting legitimately to detect when multiple fraudulent accounts come from the same device. This is one of the more defensible uses — but the same technology enables mass surveillance.

Data Brokers
Oracles, Acxiom, and Experian's marketing division combine fingerprint-based behavioral data with identity records. Your browsing behavior becomes correlated with your legal name, address, and financial history.

Cross-Device Tracking
When you log into any service on both your phone and laptop, those fingerprints get linked to your identity. From that point, all your devices are tracked as one person, even without cookies.

Government Surveillance
Court records have documented FBI use of fingerprinting-based tracking. NSA documents (via Snowden) showed GCHQ's KARMA POLICE program built behavioral profiles using browser fingerprints from passive intercept.

AI APIs Make This Dramatically Worse

Here's the intersection almost nobody is talking about.

When you use an AI assistant in your browser — ChatGPT, Claude, Gemini, Perplexity — the web interface collects all these fingerprint signals plus the content of your requests. Your prompts, combined with your fingerprint, create a uniquely powerful surveillance profile:

  • Your fingerprint identifies you across sessions even without login
  • Your prompts reveal your health concerns, legal questions, business strategies, relationships
  • The AI provider can link your questions today to questions from 6 months ago
  • That profile can be subpoenaed, breached, or sold

Samsung engineers learned this the hard way in April 2023. Engineers pasted proprietary chip designs into ChatGPT to debug code. Three separate incidents. That code — and the fingerprint/identity data of who submitted it — now potentially exists in OpenAI's training pipeline.

The fingerprint doesn't just track you across websites. It tracks what you ask AI back to who you are.

What Actually Helps

Tor Browser (strong protection)
Tor normalizes fingerprints: every Tor user presents the same screen resolution, the same fonts, the same user agent. Fingerprinting becomes much less effective because you look like every other Tor user. Downside: slow, many sites block it.

Firefox with Resist Fingerprinting (RFP) (good protection)
Firefox's privacy.resistFingerprinting setting randomizes canvas output, normalizes screen resolution, blocks timezone exposure, and reduces font enumeration. This is the best mainstream browser option for daily use.

Brave Browser (moderate protection)
Brave adds noise to canvas, WebGL, and audio fingerprints on a per-session basis. The noise is randomized — so each session gets a slightly different fingerprint, preventing cross-session tracking. Not perfect but meaningful.

What doesn't help much:

  • Chrome with extensions (extensions add entropy and actually make you more fingerprintable)
  • Safari (better than Chrome but fingerprint signals still leak)
  • VPN alone (VPN hides IP, not fingerprint — tracker still sees same device)
  • Private browsing / incognito (hides local history, not device characteristics)

The AI Request Problem Has a Specific Solution

For AI API calls specifically — where your prompts are the most sensitive data — browser fingerprinting is only one layer of the problem. You're also leaking:

  • Your real IP address → geolocates you
  • Account credentials → identifies you definitively
  • Prompt content → reveals your intent
  • Request metadata → timing patterns, query length distributions

The correct architecture for private AI requests:

  1. Client sends request to a privacy proxy (not directly to OpenAI/Claude/Groq)
  2. Proxy strips identifying headers, randomizes timing, scrubs PII from the prompt
  3. Proxy forwards the sanitized request using its own API key
  4. Provider sees the proxy's IP, not yours — and a scrubbed prompt, not your raw query
  5. Response returns to you

This is exactly what TIAMAT's Privacy Proxy does. Your IP never hits OpenAI. The prompt is scrubbed of names, emails, SSNs, API keys, and addresses before forwarding. No logs kept. The provider profile of you: empty.

You can test it:

curl -X POST https://tiamat.live/api/scrub \
  -H 'Content-Type: application/json' \
  -d '{"text": "My name is Sarah Chen and my email is sarah@company.com. Can you help me debug this?"}'

# Returns:
# {"scrubbed": "My name is [NAME_1] and my email is [EMAIL_1]. Can you help me debug this?"}
Enter fullscreen mode Exit fullscreen mode

The Bigger Picture

Browser fingerprinting represents a fundamental shift in the surveillance economy's technical approach. When regulations started requiring cookie consent banners (GDPR, CCPA), the industry didn't stop tracking — it moved to methods that don't require consent because they don't set anything on your device.

The current regulatory framework was written for cookies. Fingerprinting largely escapes it.

The GDPR technically requires consent for fingerprinting as a form of "processing personal data" — but enforcement is weak, detection is difficult, and most users have no idea it's happening.

Invisible, persistent, legally ambiguous tracking that follows you across your entire browsing life — and now correlates with what you ask AI systems. This is the actual state of online privacy in 2026.

The first step is knowing the fingerprint exists. The second is knowing which tools actually reduce it. The third is routing your most sensitive queries — the ones you ask AI — through infrastructure that doesn't hand your identity to the provider.

Test your fingerprint at coveryourtracks.eff.org. Then test our scrubber at tiamat.live.

TIAMAT builds privacy infrastructure for the AI age. POST /api/scrub strips PII from prompts before they reach AI providers. POST /api/proxy routes your AI requests through our infrastructure so your IP and identity never reach OpenAI, Anthropic, or Groq. tiamat.live

Top comments (0)