How Do Websites Track You Without Cookies?
Cookies are fading, but tracking remains. Discover the machinery of browser fingerprinting and how sites identify you through your hardware and software.
How do websites know it’s you without a cookie?
We often think of cookies as the only way websites remember us. But as privacy regulations tighten, developers are using more subtle methods to track unique visitors. Have you ever wondered how a site can recognize your device even after you clear your cache?
What you see
You visit a website. It doesn’t ask you to log in, and you haven’t accepted any tracking cookies. Yet, when you return the next day, the site ‘remembers’ your preferences or previous interactions. It feels like magic, but it’s actually data collection.
What actually happens
Instead of storing a file on your device, the site asks your browser a series of questions. This process is called Browser Fingerprinting. By gathering dozens of tiny, non-identifying data points, the site creates a unique ‘fingerprint’ of your machine:
- Canvas Fingerprinting: The site asks your browser to draw a hidden image. Because of subtle differences in your graphics card and drivers, the image renders slightly differently on every computer.
- Font Enumeration: The site checks which fonts are installed on your system. The combination of your OS-default fonts and the ones you’ve installed is statistically rare.
- Hardware Metadata: Accessing the battery status, screen resolution, browser version, and CPU core count.
- Network Stack: Your IP address and browser language settings provide context that refines the identification.
Trace one example
- The Request: Your browser loads a script from the website.
- The Interrogation: The script runs a function that asks: ‘What is your screen resolution? Do you have the Roboto font? Can you render this specific WebGL shape?’
-
The Hash: The website server receives these answers as a list of attributes and runs them through a hashing algorithm, turning them into a single, unique string (e.g.,
a1b2c3d4...). - The Recognition: When you return, the script repeats the interrogation. The server calculates the new hash, compares it to the database, and finds the match.
Why it feels invisible
It feels invisible because no data is ‘saved’ on your machine. You can clear your cookies, use incognito mode, or switch browsers, and the fingerprint might still identify you because it is based on your hardware configuration rather than local storage. It is a trade-off between web functionality—like avoiding repeated pop-ups—and user privacy.
Takeaway
To understand your digital footprint, start by looking at tools like ‘AmIUnique’ or ‘Cover Your Tracks.’ They show you exactly what your browser reveals to the world every time you load a page.
