Why clearing cookies is not enough
Why it matters You may clear your cookies, or browse in a private window, and feel that a site can no longer tell it is you. Often it still can. Knowing how helps you pick defences that actually work, and, if you build sites, helps you avoid recognising people who did not ask to be recognised.
Badge or face?
Think of a cookie as a name badge a shop pins on you at the door. Next time you walk in, the shop reads the badge. Take the badge off and the shop has nothing to read.
Now imagine a shop assistant who never gives out badges but is very good with faces. They notice your height, your coat, your accent and the way you walk. None of those things is unique on its own, but together they are often enough to say "that is the person from Tuesday". That is fingerprinting.
Browser fingerprint: a set of small facts about your browser and device, such as screen size, time zone, language and installed fonts, that together can be distinctive enough to recognise you again. No ID is stored on your device, so there is nothing for you to delete.
Trait: one of those small facts. "Time zone is Europe/London" is a trait. In this course we also call it an attribute or a signal.
Where the traits come from
When a page loads, its scripts (small programs that run inside the page) can ask the browser many questions. Browsers answer most of them because real features need the answers: a page needs your screen size to lay itself out, and your time zone to show the right meeting time.
A fingerprinting script asks all of these questions at once and does not use the answers for layout at all. It joins them into one long string and turns that string into a short code, like 7d2a91. Two visits that give the same code were probably made by the same browser.
- Things you set: language, time zone, dark mode, zoom.
- Things your device is: screen size, number of processor cores, graphics chip.
- Things that are subtle: tiny differences in how your machine draws text or processes sound. The next lesson measures these.
Why clearing cookies does not reset it
Clearing cookies deletes things the site stored on your device. A fingerprint is not stored on your device; it is recomputed from your device every time. So after you clear cookies, the script simply asks the same questions again, gets the same answers, and arrives at the same code.
Trackers can go one step further. If the code matches a visitor they knew, they can quietly link the new, empty cookie to the old profile. Your fresh start is stitched back onto your old history.
A common misconception
"Private browsing makes me anonymous." A private window forgets cookies and history when you close it, which is useful. But your screen, fonts, graphics chip and time zone are the same in a private window as in a normal one, so much of your fingerprint stays the same. Some browsers do hide a few extra traits in private windows; a later lesson covers which defences really help.
Fingerprints are not perfect either. They change when you update your browser, plug in a second screen or install a font. That is why trackers usually combine fingerprints with cookies and logins rather than relying on one method.
Recap
- A cookie is a stored ID you can delete; a fingerprint is recomputed from your device on every visit.
- Each trait is common on its own; the combination is what can single you out.
- Clearing cookies or using a private window does not change most traits, so it does not reset a fingerprint.
- Fingerprints drift over time, so trackers usually mix them with other methods.
This lesson is locked
Lessons open one at a time. Finish the previous lesson to unlock this one.