A developer-written essay titled “Fingerprints Are the New Cookies” has been making the rounds for a simple reason: it demonstrates, live, how a website can identify you consistently across refreshes, cookie clears, and even VPN connections, without using a single cookie. The trick is device fingerprinting, and the piece argues that Google has quietly gone from promising to kill invasive tracking to explicitly allowing fingerprinting in its own ad products. That shift matters because Google’s browser, Chrome, still runs on roughly two-thirds of the web.

What device fingerprinting actually does

Every time your browser requests a webpage, it hands over a bundle of technical details: browser type and version, language settings, operating system, screen configuration, and your IP address (which the server needs just to send a response back, and which often reveals your general location). Individually these details are mundane. Combined, they form a pattern specific enough to tell you apart from almost everyone else browsing at the same time, a “fingerprint.”

Unlike a cookie, a fingerprint is not stored on your device, so there is nothing to delete. The author’s demo drives this home: refreshing the page, clearing cookies, or switching to a VPN does not change your identifier. Open the same site on a different device and you get a different fingerprint, but it stays just as consistent on that device going forward. Fingerprinting works by observation, not by storage, which is exactly what makes it so hard to opt out of.

Why this is harder to escape than cookies

Third-party cookies became notorious because users could see and delete them, and regulators could target them directly, which is partly why the EU’s consent-banner rules exist in the first place. Fingerprinting sidesteps that entire framework. There is no file to clear, no setting to toggle off in most browsers, and no consent banner built around it in the way cookies got one. The article frames this as a loophole: the industry built an entire regulatory and PR apparatus around cookies, and fingerprinting simply walks around it.

The practical payoff described in the piece is data brokering at scale. A site that gets ad revenue can run a fingerprinting script, identify a visitor consistently, and then combine that with account data, under the site’s own privacy policy, covering names, activity, or even conversations with AI tools. Chained across many sites, this builds a profile that the author says could eventually be more detailed than what your own friends know about you.

The three-act reversal from Google

The essay lays out Google’s position as a story in three parts:

• Pressure (2019): Third-party cookies had become a PR liability. Safari and Firefox already blocked them by default, and Google publicly pledged to “destroy cookies” and move to a privacy-first model.
• Distraction (following years): Instead of deprecating third-party cookies outright, Google proposed replacement technologies under the “Privacy Sandbox” umbrella. According to the article, these drew antitrust scrutiny and saw little adoption, and Google ultimately kept cookies around while offering a much narrower promise to mask IP addresses in limited, authenticated-incognito scenarios, a promise the piece says was not fully delivered.
• Acceleration (now): Google’s ad products now explicitly permit device fingerprinting, according to the source.

Readers should note this three-act framing, including the claim about Privacy Sandbox’s reception and the undelivered IP-masking promise, comes directly from the original essay’s characterization of events; it is presented here as the author’s account rather than independently verified history.

How browsers differ in what they actually block

Not all browsers treat this the same way. The article draws a useful distinction between isolation and privacy. Isolation means a website’s code cannot read data from other websites or your local files without permission, which is where Chrome and Edge’s protections largely stop. Privacy goes further, limiting what a single site can learn about your device in the first place. Safari (especially recent macOS/iOS versions) and Firefox push into this territory but, per the article, still do not fully block fingerprinting. Brave and Tor are described as the current leaders in privacy-first browsing, with Mullvad Browser (built in connection with the VPN provider Mullvad) noted as an up-and-coming option.

What this means if you are a developer or a user

For developers building or auditing websites, the takeaway is that disabling JavaScript defeats this particular fingerprinting technique, since it depends on scripts running in the browser, but it does nothing against network-level identification such as IP-based tracking. That distinction matters when evaluating privacy claims: a site can be “fingerprint-resistant” in one layer and still leak information at another.

For everyday users, the practical options the article points to are browser choice (Brave, Tor, or Mullvad Browser over Chrome or Edge if fingerprinting resistance is a priority) and skepticism toward the common rebuttal, “I have nothing to hide and I prefer relevant ads, and the data is anonymized anyway.” The author’s counterargument is that anonymization matters less once a profile is detailed and consistent enough to re-identify someone regardless of whether a name is attached. The caveat worth remembering: switching browsers or blocking scripts reduces exposure but does not eliminate network-based tracking methods like IP analysis.

Frequently asked questions

Does clearing cookies or using a VPN stop fingerprinting? No. The method described does not rely on stored data, so clearing cookies has no effect, and a VPN only changes your IP address, not the other signals that make up a fingerprint.

Does disabling JavaScript protect me? It stops the specific script-based fingerprinting technique described in the article, but it does not protect against network-based identification such as IP address analysis.

Which browsers resist fingerprinting best? According to the article, Brave and Tor currently lead, with Mullvad Browser emerging as another option; Chrome and Edge focus mainly on isolation rather than fingerprinting resistance, while Safari and Firefox offer partial protection.

Source: Fingerprints Are the New Cookies