How Websites Track You: What Your Browser Reveals About You

In 2010, the Electronic Frontier Foundation ran an experiment on nearly half a million browsers and found that 83.6% of them were unique enough to identify on their own, no cookies involved at all. Among browsers with Flash or Java installed, that number climbed to 94.2%. The technique behind it, browser fingerprinting, has only gotten more capable since then, while the method most people actually worry about, cookies, has become the one browsers are best at blocking.

Most of this exists to serve ads. A site doesn't need your name to sell space next to your attention; it just needs to recognize you again. That's the practical reason tracking survived years of cookie crackdowns: there was never only one way to do it.

Here's what your browser reveals, the different techniques that use it, and what narrows the gap.

The Three Ways Websites Track You

Tracking breaks down into three families that work independently of each other, which is why blocking one rarely stops the others.

Cookies are small files a site asks your browser to store and hand back on later visits. They're the most familiar mechanism and the one under the most active restriction, and they're covered in depth in what accepting or rejecting cookies actually changes. This article won't re-explain them.

Fingerprinting doesn't store anything on your device at all. It reads characteristics your browser already exposes, like fonts, screen size, and rendering quirks, and combines them into a signature that can identify you without ever writing a file.

Tracking pixels are a delivery mechanism rather than a storage mechanism: a tiny image request that tells a server you were there, often paired with cookies but not dependent on them.

Cookies are also the one browsers already fight hardest against, through blocking, expiry limits, and consent prompts. Fingerprinting and pixels don't sit in a cookie jar a browser can clear, which is why the rest of this article spends more time on how they work.

What Is Browser Fingerprinting?

Browser fingerprinting is a tracking technique that identifies you by combining characteristics your browser reveals automatically, without setting a cookie or storing anything on your device. Your browser routinely exposes its version, your operating system, installed fonts, screen resolution, timezone, language settings, and dozens of smaller details. Individually, none of these is identifying. Combined, they narrow down to a small group of people, sometimes a group of one.

This is exactly what the EFF's 2010 experiment measured, under the project's original name, Panopticlick. The project is still running today as Cover Your Tracks, and it does something none of the numbers above can: it tests your specific browser right now and shows you how identifiable it is, which browser signals are giving you away, and whether known trackers can already see you.

Because fingerprinting reads information your browser already sends, rather than something it stores, deleting cookies or clearing your cache does nothing to it. That distinction is the reason fingerprinting has become the more durable half of online tracking as cookie restrictions have tightened.

What Is Device Fingerprinting?

Device fingerprinting is the broader version of the same idea: identifying a physical device using any signal it exposes, not just the ones visible to a web browser. Browser fingerprinting is device fingerprinting's most common form on the open web, since a browser is the interface most sites actually see. The same underlying logic shows up elsewhere too, in mobile apps that read device sensors and hardware IDs, and in ad networks that combine browser signals with network-level details like IP address to build a profile that survives switching browsers on the same device.

For most people reading about this because of something they saw in their own browser, the two terms describe the same practical problem.

Canvas Fingerprinting: A Concrete Example

Canvas fingerprinting is worth walking through because it shows exactly how fingerprinting turns an invisible browser quirk into an identifier.

A script instructs your browser to draw a short piece of hidden text or a simple shape onto an HTML5 canvas element, then reads back the resulting image as pixel data. The same instructions, run on different machines, don't produce identical output. Your GPU, graphics driver, operating system, and installed fonts all introduce tiny rendering differences invisible to the eye but present in the raw pixels, and hashing that pixel data produces a value that's often unique to your specific hardware and software combination. Nothing is stored. The technique works because your device renders graphics in a way that's subtly, consistently its own.

The technique was first measured at scale by researchers at Princeton, who found it running on about 5.5% of the web's top 100,000 sites in 2014, the same study that first documented evercookies (covered further down). A 2025 measurement by researchers at UC San Diego found canvas fingerprinting on 12.7% of the top 20,000 sites, over twice the 2014 rate among comparably popular sites. It's a technique with its own Wikipedia entry at this point, not a fading curiosity.

What Is a Tracking Pixel?

A tracking pixel is a tiny, usually invisible image, often just 1x1 pixel, embedded in a page or email specifically so that loading it sends a request to a server. That request alone tells the server your IP address, approximate location, device type, and the exact moment you opened the page or email, before any JavaScript or cookie is involved.

Pixels and cookies are often deployed together but solve different problems. A cookie needs to be written to your browser and read back later, which is exactly what browsers have gotten better at blocking. A pixel just needs its image request to complete once, which is far harder to prevent without blocking images or the specific tracking domains behind them. That's also why an opened marketing email is trackable even though nobody clicked anything inside it.

The pattern is common enough that browsers are now building formal alternatives to the raw version of it. Mozilla's own documentation on the Attribution Reporting API lists a 1x1 tracking pixel as one of the standard triggers the API supports, giving that same "did they see this" signal a path through aggregated, privacy-preserving reporting instead of a raw request straight to an advertiser's server logs.

Here's the mechanism end to end. A marketing email arrives with a single-pixel image referencing a unique tracking URL, one generated specifically for your address. You open the email without clicking anything. Your mail client requests that image to display it, the request reaches the sender's server carrying your IP address and the exact timestamp, and the server logs the open against your email address before you've read past the subject line. No cookie was set. No link was clicked. The sender still knows, because loading an image was never something you had to consent to separately.

Cross-Site Tracking Isn't Just About Cookies

Cross-site tracking is best defined by what it does, not by which mechanism does it: a site recognizing you based on somewhere else you've already been, even though you never told it that.

Third-party cookies are the version most people have heard of, and they're exactly what's covered in the breakdown of first-party and third-party cookies. But the behavior doesn't require a cookie at all. If the same fingerprinting script runs on two unrelated sites, or the same tracking pixel loads on both, whoever operates that script or pixel can link your visits together without either site sharing a cookie or a login. This is precisely why browsers restricting third-party cookies didn't end cross-site tracking. It removed the easiest method, not the underlying incentive, and fingerprinting and pixels absorbed a meaningful share of what cookies used to do. Website tracking, as a whole, is really just this: whichever signal survives, gets used.

Cookies That Don't Go Away: Supercookies, Evercookies, and Zombie Cookies

Clearing your cookies and cache does exactly what it says: it removes what's stored in those specific places. Some tracking mechanisms exist specifically to survive that, and the actual scope of a normal cache clear doesn't touch them.

A supercookie stores an identifier somewhere other than the standard cookie jar, an ISP-injected header, for instance, or a browser cache location a normal cookie-clearing flow doesn't check. A zombie cookie is a supercookie built specifically to regenerate: if any one copy survives deletion, in Flash storage, a browser cache, or another quiet corner, it recreates the rest, including the standard cookie you thought you'd removed. Evercookie, the project that gave this category its name, was built by security researcher Samy Kamkar as a proof of concept, deliberately storing the same identifier in as many places as possible so that deleting it from any one of them, even most of them, wasn't enough. The same Princeton research that first measured canvas fingerprinting documented evercookies in the wild for the same reason: both techniques were designed around the same gap, tracking that doesn't depend on a cookie a user can simply delete.

How to Reduce Your Tracking Footprint

There's no setting that makes a browser untrackable, and any claim that there is deserves skepticism. Cookies and pixels are largely handled by the ad and tracker blocking most privacy-focused browsers already run by default. Fingerprinting is the harder part, since there's no file to block, only signals to reduce:

• Check your exposure first. Running your browser through Cover Your Tracks shows which specific signals make you identifiable, rather than guessing.
• Reduce entropy where you can. Fewer installed fonts, a common screen resolution, and a mainstream browser configuration all make you blend into a larger crowd instead of standing out.
• Block known fingerprinting scripts and tracking pixels, the same way ad and tracker blockers already interrupt known third-party cookie domains.
• Treat browser choice as part of the answer. Some browsers actively randomize or block fingerprinting-relevant signals by default; others expose them exactly as requested. The comparisons in 5 Most Private Browsers in 2026 go through this trade-off browser by browser.

None of this produces anonymity. It reduces how easily you're singled out, which is a different and more realistic goal.

Where Sigma Fits

Sigma includes anti-fingerprinting protection and built-in tracker and ad blocking as standard behavior, not an opt-in setting, which is the same claim made in the comparison of Sigma against Chrome Incognito.

What that means in practice: fewer of the small signals covered above are exposed in the first place, and known pixel- and script-based trackers are blocked before they load. It doesn't mean invisibility. Fingerprinting defense is an ongoing trade-off between blending in and breaking sites that expect normal signals, not a switch that turns tracking off entirely, and treating it as anything more than that would be the same overpromise this article has been arguing against.

‍