What Is Browser Fingerprinting? Why It Tracks You Even With a VPN On

Cookies are the other half of tracking — see what this site stores in your browser with our cookie and local storage inspector.

Browser fingerprinting is a way of recognising your device from the settings your own browser hands over — screen dimensions, installed fonts, graphics hardware, time zone, language, CPU cores — rather than from a cookie stored on your machine. That is exactly why it keeps working when a VPN is switched on: a VPN changes the IP address a site sees and nothing else about the device behind it.

The result is a tracking technique with no off switch. You cannot clear a fingerprint the way you clear cookies, because nothing was ever written to your disk. The identifier is the machine.

How much can browser fingerprinting really identify?

The foundational measurement comes from the Electronic Frontier Foundation. In the Panopticlick study, technologist Peter Eckersley collected fingerprints from a large sample of visiting browsers and reported an average of 18.1 bits of identifying information per fingerprint, with 83.6% of the browsers tested being unique in the dataset.

Bits of entropy are worth translating. Each additional bit halves the pool of people who share your profile. Roughly 33 bits is enough to pick one person out of the entire planet, so 18 bits already places you in a group of a few hundred thousand — and that was before high-resolution displays, hardware acceleration and rich media APIs added more variation to read. The EFF now runs the successor tool, Cover Your Tracks, precisely because the signal set kept expanding.

• User agent string: browser name, version and platform.
• Screen resolution, colour depth and device pixel ratio.
• Time zone and preferred languages.
• Installed font list, inferred by measuring how text renders.
• Hardware hints such as CPU core count and available memory.
• Graphics renderer and driver details exposed through WebGL.

Canvas, WebGL and audio: the hardware-level signals

The signals that make fingerprinting durable are the ones tied to physical hardware rather than to preferences you can change.

Canvas fingerprinting

Canvas fingerprinting instructs the browser to draw text and shapes into an invisible canvas element, then reads the resulting pixels back as data. Your GPU, graphics driver, font rasteriser and anti-aliasing behaviour all influence the output, so two machines rendering the identical instruction return slightly different pixel values. Nothing is displayed on screen and no permission prompt appears.

WebGL and audio

WebGL renders a 3D scene and reports the renderer string plus subtle differences in how the scene was drawn. Audio fingerprinting pushes a silent waveform through the Web Audio API and reads floating-point output that varies with your audio stack. Individually these are weak clues; combined with the list above, they are a durable device signature.

Why a VPN does not stop browser fingerprinting

A VPN does one job well: it encrypts your traffic and swaps your visible IP address for the server's. That protects you from IP-based location tracking and from anyone watching the local network — the reason a VPN is still worth running, as we cover in what is a VPN and do you need one.

But fingerprint signals are generated inside your browser and travel through the tunnel with everything else. Your Berlin-based VPN exit does not change a time zone set to America/Chicago, a 2560×1440 display, an English-Canadian locale or a specific GPU string. In fact a mismatch between IP-derived location and browser-reported time zone is itself a distinguishing signal that anti-fraud systems actively look for.

The same logic explains a related misunderstanding. Private windows do not help either, for the reasons set out in does incognito mode actually hide you. You can confirm the IP half of the picture yourself with our IP lookup tool — it shows what the network layer reveals, which is the only part a VPN changes.

How to prevent browser fingerprinting in practice

There are only two strategies that genuinely work, and they are opposites.

1. Blend in. Tor Browser deliberately makes users look identical to one another: it ships a uniform configuration and, according to the Tor Project's own documentation, uses defences including letterboxing — rounding the reported window size to fixed increments so your exact dimensions do not leak — plus user-agent normalisation and first-party isolation.
2. Randomise. Brave takes the opposite route with what it calls farbling, slightly and repeatedly altering the values returned by fingerprinting APIs so the collected fingerprint is inconsistent between sites and sessions, and therefore useless for linking visits.
3. Harden Firefox. Firefox's Enhanced Tracking Protection on Strict, combined with Total Cookie Protection, cuts cross-site tracking sharply, and the resistFingerprinting preference adds Tor-derived normalisation at the cost of some site breakage.
4. Keep your setup boring. Default window sizes, default fonts, no exotic extension mix, and a browser version shared by millions of other people.
5. Reduce what is worth linking. Separate browsers or profiles for banking, shopping and casual browsing limit how much of your life a single fingerprint can join up.

If you want to choose between those options properly, our comparison of the best privacy browsers in 2026 puts Tor, Brave, Firefox and Safari side by side on exactly this criterion.

Is fingerprinting legal, and who uses it?

It is widely used and only partly regulated. In the EU, the ePrivacy Directive treats storing or accessing information on a user's device as requiring consent, and regulators have repeatedly stated that this covers fingerprinting as well as cookies. In the United States there is no single federal ban, though state privacy laws increasingly bring the practice under general tracking and sale-of-data rules.

The users split into two camps. Advertising and analytics firms adopted fingerprinting as third-party cookies became unreliable. Banks, ticketing sites and fraud teams use the same techniques defensively, to notice when an account is suddenly accessed from an unfamiliar device. Both build the same identifier; the difference is what they do next with it.

Perfect anti-fingerprinting is not a realistic target for everyday browsing. The realistic target is being unremarkable — one of a very large crowd, on a browser that either normalises or scrambles the signals that would otherwise make you unmistakable.