Essay argues browser fingerprinting is replacing third-party cookies

An essay on royfish.dev argues that browser and device fingerprinting is replacing third-party cookies as the main way of tracking people online. It opens with a live demo: the page hashes a few measurements of your device and hands you a nickname. Refresh the page, clear cookies or connect to a VPN and the nickname stays the same. Open the page on a phone or another device and you get a different name, just as consistent. The author asks whether it changes in incognito mode; if it is always the same, that is the bad news.

The author then speaks as a hypothetical tracker. Most sites you visit get paid to show ads and indirectly run a script that recognises you. If you have an account on such a site, the tracker can offer to buy whatever data the site may share under its privacy policy: your name, activity, even conversations with AI. The imagined tracker sees patterns rather than people, sells to the highest bidder, and would gladly take money from the police or a government too. The reply to 'I have nothing to hide' is that it is not about you at all.

Next comes a satirical three-act story about Google, introduced as the biggest ad company on Earth and, in the author's telling, the company behind a browser with two-thirds of the market. The author notes that the EU shipped consent banners faster than tech companies acted. Act I is set in 2019: cookies are bad PR and Safari and Firefox already block them. A year later Google pledges to destroy cookies and establish a privacy-first reign. Act II, five years later: people worry about bigger things, and Google's Privacy Sandbox solutions, in the author's words, 'kinda suck', have raised antitrust concerns and are used by nobody. Google keeps the cookies and promises to mask IP addresses, but only in incognito while authenticated, and the author says that was never delivered either. Act III is headed 'You can now use device fingerprinting in our ad products'.

The essay then explains how a fingerprint is assembled from two sources. The network request carries the IP address, which is fragile because of mobile networks, shared WiFi, VPNs and ISP rotation, plus headers such as User-Agent and Accept-Language that reveal browser, OS, versions and language. Code running on the device can measure hardware without any permission prompts, and the readings are surprisingly stable: GPU behaviour, vendor and driver; CPU behaviour, vendor and thread count; memory size; resolution, pixel ratio and refresh rate; audio processing; device model; plus installed fonts, extensions and system info. Millions of devices run the latest Chrome, millions of Macs have an M4 and millions of browsers are set to French, but the number that match all three is far smaller, and with hardware measurements it becomes practically unique. A fingerprint only has to be unique enough within your sample. As a reference point, ZIP code, birth date and sex together uniquely identify over 60% of Americans.

A section on information entropy uses the Akinator guessing game to explain why. An answer that halves the candidate pool gives 1 bit; the rarer the answer, the more bits it carries. A trait shared by 1 in 2 people (is a man) is worth 1 bit, 1 in 8 (has a mustache) is 3 bits, and 1 in 128 (has one eye) is 7 bits. Entropy measures the value of the question rather than the answer: if 1 person in 128 is one-eyed, asking about it is worth about 0.066 bits on average. Independent traits add up, so a man with a mustache and one eye would be 11 bits, or 1 in 2048, but the author stresses that real traits are not independent and the bits do not simply add up. The same reasoning appears in medical tests (a positive result from a 99% accurate test for a disease affecting 0.01% of the population is about 100 times more likely to be wrong than right), in passwords (four random words are as strong as eight random keyboard characters) and in forensics (singling out one person in a city of a million takes about 20 bits, while a witness description matching 1 in 1,000 gives only 10 bits and leaves a thousand suspects).

The closing advice: test your browser at coveryourtracks.eff.org, which shows how unique your fingerprint is with entropy for each data point. The author says Chrome and Edge stop at isolation between websites, so a Chrome user is 'walking around with an ID on your forehead'. Safari (especially on iOS/macOS 26+) and Firefox extend safety to privacy but still do not fully protect against fingerprinting. Brave, Tor and Mullvad Browser are, per the author, the only major browsers with advanced protections. Brave adds noise ('farbling') so the fingerprint is inconsistent; Tor and Mullvad make everyone look the same. Extensions like JShelter intercept browser API calls but break some websites, as does Firefox's Resist Fingerprinting, and the author argues extensions make you more unique and cannot match engine-level protection. A final section lists the methods the demo uses: an offline audio render, WebGL GPU readings, canvas text rendering, Intl time zone and locale settings, and navigator values such as CPU cores, memory and language. The author adds that professional applications are far more complex and keep identification when single variables change.

Key facts

The essay argues that device fingerprinting, not third-party cookies, is now the main tracking method, and a live demo gives each visitor a nickname that survives page refresh, cookie clearing and a VPN.
In the author's satirical three-act account, Google pledged in 2020 to destroy cookies, kept them after Privacy Sandbox went unused, and now allows device fingerprinting in its ad products.
Fingerprints combine network data with hardware and software measurements taken without permission prompts; ZIP code, birth date and sex alone identify over 60% of Americans.
Information entropy explains why: each rare trait adds bits (1 in 128 is 7 bits), and about 20 bits can single out one person in a city of a million, though real traits are not independent.
Per the author, only Brave, Tor and Mullvad Browser offer advanced fingerprinting protection among major browsers; extensions such as JShelter help less and can break sites.

Why it matters

The essay's central claim is that the move away from third-party cookies did not end cross-site tracking, it changed the tool. A cookie can be cleared; the fingerprint the demo computes survives clearing cookies, a refresh and a VPN. The author frames Google's cookie pledges as a sequence of pressure, distraction and acceleration that ended with device fingerprinting allowed in Google's ad products, and uses the entropy explanation to show why combining ordinary traits makes a person nearly unique. It is an opinion piece, but it ties the cookie debate to a mechanism readers can test on the page itself.

Who it affects

Anyone who browses the web, since the data comes from the request and from code the site runs on your device. The author singles out Chrome and Edge users as the least protected, says Safari and Firefox users are still identifiable by advanced trackers, and names Brave, Tor and Mullvad Browser users as the best covered. Ad-funded websites are described as the channel: they run scripts that recognise visitors and, for account holders, can pass on data allowed by their privacy policies.

How to use it

Test your own browser at coveryourtracks.eff.org, which shows how unique your fingerprint is and the entropy of each measured data point. The author's advice is to switch to a browser with engine-level protection: Brave, Tor or Mullvad Browser. If you do not want to switch, extensions such as JShelter disrupt fingerprinting scripts by intercepting browser API calls, with the trade-off that some websites break. The essay's own demo page, which hashes audio, WebGL, canvas, Intl and navigator readings, shows what your device gives away.

How solid is it

This is an opinion essay with a satirical tone, not reporting. The three-act story about Google is the author's framing; the quoted lines in the Act I and Act II headings are not attributed to a named speaker or document, and the Act III claim that fingerprinting can now be used in Google's ad products comes with no date, product name or announcement. The essay does not say which browser holds the two-thirds market share. The mechanics sections (what a fingerprint is made of, how bits and entropy work) are standard and carefully explained, and the demo itself is a working illustration. Statements about how well each browser or extension protects you are qualitative, with no figures.

Risks and caveats

The demo only hashes a few measurements, and the author says professional systems are far more complex and survive changes in single variables. The bit counts are illustrations: the author warns that traits are not independent, so the 11 bits for a man with a mustache and one eye is not a real result. Protection has costs. JShelter and Firefox's Resist Fingerprinting break some websites, and the author argues privacy extensions make you more unique because few people use them, so a smart tracker could ignore disrupted signals and use the rest. The browser rankings are the author's view, and personal asides such as the Arc remark and the Mullvad praise are opinion.

“The fingerprint doesn’t need to be truly, globally unique - it just needs to be unique enough to tell people apart in your sample size.”

— the essay's author, royfish.dev