Cookies are old news — fingerprinting is the new default
For years, website owners and privacy-conscious users worried about tracking cookies — small files stored in your browser that let advertisers and analytics platforms follow you around the web. Cookies can be blocked, cleared, or opted out of. But a growing body of evidence suggests that attackers and trackers have quietly moved on to something far harder to stop: browser fingerprinting.
Fingerprinting works by collecting a bundle of tiny details about your browser and device — things like your screen resolution, installed fonts, graphics card behaviour, timezone, and even how your browser renders certain shapes. None of these are secret. Every website you visit can read them. When you combine enough of them together, the result is a profile that is unique to you, and it never needs to be stored on your machine.
What recent testing actually shows
Independent testing published on LowEndBox found fingerprinting accuracy to be alarmingly high — close to 100% in some cases. You don’t need to log in, accept any cookies, or install anything. Just loading a page is enough. Tools like FingerprintJS and similar libraries are already widely used in fraud detection, paywalls, and advertising. Most users have no idea this is happening.
For someone running a website, there are two sides to this. First, if you use any third-party scripts — analytics, comment systems, ad networks, payment widgets — those scripts may be fingerprinting your visitors without you realising it. That could create legal exposure under privacy laws like GDPR or CCPA, which require you to disclose what data is collected about people on your site.
Second, if you run a self-hosted login system or admin panel, fingerprinting is actually something you could use to your advantage — as a lightweight extra check that flags when a known user suddenly appears on an unfamiliar device or browser profile. Some security-conscious apps already do this quietly.
What you can do right now
Audit the third-party scripts on your site. Tools like Blacklight from The Markup can scan a URL and tell you what tracking technologies are running. If you are using Google Analytics, consider whether a self-hosted alternative like Pluma or Matomo gives you the data you need without handing visitor information to a third party. Privacy-focused browsers such as Firefox and Brave attempt to reduce fingerprinting accuracy by adding small amounts of random noise to the data they expose, but no browser eliminates it entirely.
Going forward, fingerprinting is likely to become the baseline for tracking across the web as cookie-based methods face tighter regulation. For website owners, the practical takeaway is straightforward: know what your site collects, disclose it clearly, and think twice before adding yet another third-party script you do not fully control.
