Forget cookies - your device's 'fingerprint' is quietly doing the tracking now

The claim

A developer going by royfish has put together a small, unsettling demo: load their page, and it assigns you a nickname based on your “fingerprint” - a combination of browser quirks, screen settings and device details. Refresh the page, clear your cookies, even fire up a VPN, and the nickname doesn’t change. Switch to incognito and it might, but it’ll still be consistent every time you reload. The site’s point is simple: you don’t need cookies to be tracked. Your device already gives you away.

This isn’t new science - fingerprinting has been a known technique for over a decade - but the essay’s real hook is the claim that Google has quietly started allowing device fingerprinting in its own advertising products, after years of insisting it was killing off exactly this kind of tracking.

What the blog actually demonstrates

The demo works by reading information your browser hands over anyway during a normal page request: your browser type, language, operating system, screen and rendering details, plus your IP address, which typically reveals roughly where you are. Combine enough of these signals and you get something close to unique - no cookie required. Disable JavaScript, as the site itself admits, and the trick stops working on you specifically. But that’s not a fix most people will ever apply, because most of the web simply breaks without it.

The author frames this as the quiet third act of a longer saga: Google promising in 2019 that “privacy is paramount,” then in 2020 pledging to kill third-party cookies altogether, then years later admitting its replacement (Privacy Sandbox) wasn’t working and nobody was using it, before ultimately deciding to keep cookies anyway. Fingerprinting, the essay argues, is the backup plan nobody announced loudly.

So who is actually at risk

Here’s the catch worth separating from the drama: this is a demonstration of a technique, not evidence of a specific company spying on a specific reader. The author is making a broader argument - that as cookie-blocking became standard in Safari and Firefox, and regulators forced consent banners on everyone, the ad industry had an obvious incentive to find a replacement that doesn’t ask permission. Fingerprinting is harder to block and, crucially, doesn’t trigger the same cookie-consent pop-ups most of us have learned to click through without reading.

That matters most for anyone browsing on Chrome, which still holds around two-thirds of the global browser market, since it’s the browser the essay singles out as having relaxed its stance on fingerprinting in ad tooling. It matters less if you’re already running privacy-focused browsers or extensions that specifically block fingerprinting scripts - though, as the demo shows, disabling JavaScript entirely is the only method guaranteed to stop it, and that’s not realistic for ordinary browsing.

What to do about it

There’s no single toggle that switches this off. Browser extensions designed to resist fingerprinting (rather than just block cookies) are the closest practical defence, alongside privacy-hardened browsers that deliberately make your device look more generic. VPNs, clearing cookies, and incognito mode - the things people already do - don’t help here, which the demo makes clear in about thirty seconds.

The bigger picture is less about one blog post and more about a pattern: every time one tracking method gets regulated or blocked, another quietly takes its place. Worth watching, not panicking over.