You Blocked the Cookies. They Still Know It Is You.

By NorwegianSpark Editorial · Published August 8, 2026 — written with AI assistance and reviewed by the NorwegianSpark SA editorial team.

You cleared your cookies, switched to private browsing, and the ads still follow you. That is not your imagination, and it is not a cookie you missed.

Browser fingerprinting identifies you without storing anything on your device at all. Instead of leaving a marker and looking for it later, it reads the characteristics your browser reveals automatically and combines them into something distinctive enough to recognise.

What it reads

Each of these is individually unremarkable. Combined, they are often unique:

• Screen resolution and colour depth
• Time zone and language settings
• Operating system and browser version
• Installed fonts
• Graphics hardware, revealed through how your machine renders a test image
• Audio processing characteristics
• Number of processor cores, available memory
• Whether you have "do not track" enabled — itself a distinguishing signal

Millions of people share any one of these values. Very few share all of them at once. That combination is the fingerprint.

Why it is genuinely hard to stop

Cookies are easy to block because they are a distinct thing that gets stored. You can find them and delete them.

Fingerprinting reads information the browser must expose for pages to work correctly. A site legitimately needs to know your screen size to lay out responsively, and your language to serve the right text. There is no clean line between the data a page needs and the data that identifies you.

Worse, standing out makes it worse. Install an unusual set of privacy extensions, disable a common feature, use a niche browser — and you become *more* identifiable, not less. Blending in beats locking down, which is the opposite of most security advice.

What actually helps

Browsers with built-in anti-fingerprinting. The effective approaches either return standardised values so many users look identical, or add controlled randomness so the fingerprint does not stay stable between sessions. Some mainstream browsers now include protection of this kind; the strongest implementations are in browsers built specifically for the problem.

Not customising much. Every deviation from default is an identifying bit. A stock configuration is a more anonymous one.

Content blockers that stop the scripts loading. A fingerprinting script that never executes gathers nothing. This is the most practical everyday measure, and it improves page speed as a side effect.

What does not help

Private or incognito mode. It clears history and cookies when you close the window. It does not change your screen resolution, fonts or graphics hardware. Your fingerprint is identical.

A VPN, by itself. A VPN changes your apparent location and hides traffic from your network provider — both genuinely useful, neither related to fingerprinting. Your browser still reports the same configuration from the new address. A VPN and anti-fingerprinting solve different problems, and a service that implies otherwise is overselling.

Clearing cookies more often. Nothing is being stored. There is nothing to clear.

A realistic expectation

Perfect resistance is not achievable while still using the web normally, and anyone promising it is selling something. The workable goal is raising the cost: block the scripts where you can, avoid unnecessary customisation, and use a browser that actively works on the problem.

For most people the sensible position is a mainstream browser with tracking protection turned up and a good content blocker — enough to defeat routine commercial tracking without making your setup so unusual that it defeats itself.