Posted on

Browser fingerprinting without a conventional tracking cookie

Deleting a cookie removes a stored identifier.

It does not necessarily make the browser indistinguishable from every other browser on Earth.

That is where fingerprinting enters the story.

A website can observe characteristics exposed during an ordinary visit: browser version, operating system, language, time zone, screen dimensions, graphics capabilities, supported features, font behavior, and other details.

Any one property may be common.

The combination can be much less common.

The identifier can be calculated instead of stored

A cookie works by writing a value and reading it later.

Fingerprinting can work differently.

The site asks the browser a collection of questions, combines the answers, and computes a signature. On a later visit, it asks similar questions again and compares the new signature with previous ones.

Nothing requires a file named tracker_id=12345 to sit in the cookie jar.

Mozilla describes fingerprinting as an attempt to identify users through a set of characteristics of their browser or device. Firefox now includes Fingerprinting Protection, while its stricter Resist Fingerprinting feature deliberately reduces or standardizes exposed differences. See Mozilla’s current fingerprinting guidance.

The reason those defenses exist is straightforward: uniqueness itself can become an identifier.

A fingerprint is not a magic serial number

This is where explanations often become too dramatic.

Browser fingerprints are generally probabilistic and context-dependent.

Devices update. Fonts change. Window sizes change. Browsers reduce exposed information. Privacy tools deliberately make many users look alike. Two machines can share enough characteristics to collide, while one machine can change enough to look new.

So a fingerprint can be a strong recognition signal without being equivalent to a hardware serial number.

A tracking company may also combine fingerprinting with other evidence such as account logins, IP-derived information, cookies, advertising IDs, or link identifiers.

The confidence comes from the bundle.

Cookie blocking changes the economics, not the desire to recognize

Firefox’s privacy documentation says the browser protects against known third-party trackers and fingerprinting technologies. Safari’s Tracking Prevention Policy likewise defines tracking broadly enough to include methods beyond cookies. See Firefox’s privacy notice and WebKit’s Tracking Prevention Policy.

That broader framing matters.

If privacy protection focused only on cookies, the incentive would be obvious: replace the blocked identifier with something computed from the browser itself.

Modern defenses increasingly treat recognition across contexts as the underlying problem rather than one specific storage mechanism.

That is the Surveillance Economy’s recurring lesson.

The cookie was never the goal.

The goal was remembering which browser came back.

Posted on

Third-party cookies and the construction of cross-site browsing histories

You visit a shoe store.

Then a newspaper.

Then a recipe site.

Three unrelated websites.

One advertising company may have been present on all three.

That is the basic trick that made third-party cookies one of the classic technologies of cross-site tracking.

The cookie is ordinary; the context makes it third-party

There is no magical file format called a third-party cookie.

WebKit’s tracking documentation explains the distinction clearly: if news.example is in the address bar while the page loads a resource from adtech.example, the news site is the first party and the ad-tech domain is a third party. If the browser allows that third party to read and write its cookies in this context, those cookies can carry an identifier across sites. See WebKit’s Tracking Prevention documentation.

Imagine the browser receives this identifier from the tracker:

user=847219

Later, another unrelated site loads the same tracker.

If the browser sends user=847219 again, the tracker can recognize the same browser.

Now the tracker can associate both visits with one identifier.

Repeat that across hundreds of participating sites and the result can become a browsing history.

A browsing history reveals patterns, not just pages

One visit says little.

A sequence can say much more.

Travel research followed by mortgage calculators, moving companies, and school-district pages may suggest a relocation.

Repeated visits to automotive sites can reveal purchase interest. Visits to hobby stores, political publications, technical forums, financial pages, or health-related sites can contribute additional categories and inferences.

Mozilla’s current Firefox documentation describes cross-site cookies in similar terms: when the same tracker appears on multiple sites, it can use cookies to build a more complete profile of browsing activity over time. See Mozilla’s explanation of third-party trackers.

That profile does not require the person to intentionally visit the tracking company’s own website.

The tracker rides inside other pages.

Browsers have sharply restricted this technique

The old third-party-cookie model no longer works uniformly across browsers.

Safari blocks third-party cookies by default as part of Intelligent Tracking Prevention. Firefox enables Total Cookie Protection by default, isolating third-party cookies into separate per-site cookie jars so the same cookie cannot simply follow the browser across unrelated sites.

Chrome took a different path. Google announced in April 2025 that it would maintain user choice for third-party cookies rather than roll out a new standalone prompt or complete a universal deprecation. Chrome blocks third-party cookies by default in Incognito mode, while regular browsing exposes controls that let users allow or block them. See Google’s April 2025 Privacy Sandbox update and Chrome’s cookie controls.

So in 2026, saying browsers killed third-party cookies is too broad.

The reality depends on the browser and settings.

Blocking cookies does not end tracking

Trackers can also use link decoration, browser fingerprinting, first-party storage, account logins, server-side data sharing, IP-derived signals, and other techniques.

WebKit’s own tracking-prevention work discusses defenses against several of those methods because restricting one identifier creates incentives to find another.

That is why third-party cookies belong at the beginning of Surveillance Economy — The Internet Watching You Back, not the end.

They are the easiest version of the idea to see.

You thought you were visiting three websites.

The interesting question is whether a fourth company quietly recognized you at all three.