Online privacy is changing as a result of browser fingerprinting. The way it works is worrisome to regulators & technology companies, making them pay more attention to it.
Unlike what happens with conventional tracking cookies, which store identifiers in a browser, fingerprinting makes use of characteristics of a device to know how it is different from others.
The practice is not sitting well with users, especially with Google making the decision to permit fingerprinting. This decision came under its advertising product policies, and has reversed what the company’s stance was earlier on when it opposed it.
The shift raises questions about how easy it will be for users to control how their moves are tracked online. Also, there are concerns about whether privacy protections can keep up with advertising technologies that carry out their activities even without the users’ knowledge.
Similar privacy concerns have emerged around AI tools that process private conversations, as explored in OpenAI’s Apple Messages tool, which raises privacy concerns over decrypted chats.
Google reverses stands on cookies & fingerprinting
There have been a lot of changes in Google’s privacy strategy since 2019. Then, the company made announcements on its Privacy Sandbox initiative & promised it would remove third-party cookies in Chrome.
The project came with alternative technologies which will support online advertising and reduce the usual cross-site tracking. However, in July 2024, Google dropped the former plan to remove third-party cookies, saying instead that it will give users the power to choose the cookies themselves.
Another controversy came up in December 2024 because Google announced that it has changed its advertising policies. This change would allow clients to use “device fingerprinting” and this will start from February 2025.
After it announced this, the UK Information Commissioner’s Office expressed criticism about the move. Its argument was that fingerprinting can remove control from users because the signals it uses will be harder to manage or clear, unlike what people do with cookies.
However, the regulator stressed that the requirements in place to make sure users’ data is safe still apply. Fast forward to April 2025, Google confirmed it would continue to use this existing approach, allowing users to choose cookies, instead of introducing a new standalone prompt.
Google said then that the decision was because of how the industry is changing. Also, due to the different views plus opinions which publishers, regulators & advertisers have about the entire project.
How browser fingerprinting identifies devices
The way browser fingerprinting works is by making use of the technical characteristics that a website can observe when any page loads. Some information comes up like normal network requests. And these might be browser headers, language preferences plus the IP address in the device.
Scripts running in the browser can reveal more characteristics of the device. These could be the dimensions of the screen, or the fonts installed. It could also be the settings of the time zone & details of graphics or audio processing.
According to what the UK Information Commissioner’s Office disclosed, all the above plus other browser & device signals can be tools for fingerprinting. As single elements, there is nothing to fear about these device characteristics. But when developers combine them, they can make a browser configuration more distinctive.
It is important to state that fingerprinting does not reveal a person’s name automatically. Instead, what it can do is to assist a tracker to recognise that the same browser made certain visits or infer links between browsing sessions.
Unlike the usual cookie identifier, the engineers can come up with a profile from these observable characteristics rather than using only a stored identifier. This makes it hard for users to remove fingerprinting by simply clearing cookies.
What users can do to reduce fingerprinting?
Protecting yourself from fingerprinting all depends partly on how the browser you use handles the information websites can collect. Blocking third-party cookies alone will not stop fingerprinting from taking place.
Also, making use of private browsing modes only puts a limit to what is retained locally after a session. So it is not right to treat them as comprehensive anti-tracking solutions. The good news is that some browsers take additional steps to reduce the distinctiveness of their users.
Brave says it has protections that will block or change some browser signals & randomise selected values. The aim of Tor Browser is to make users’ configurations appear alike. It does this by standardizing or reducing the characteristics that are bare to prying eyes & this, including screen-size information.
Following these approaches, it will be harder to pinpoint the differences in individual browsers. Although there is no method that guarantees complete protection.
Another browser is the Mullvad Browser, which developers launched while collaborating with the Tor Project. It follows the same privacy-focused approach as Tor to reduce the headaches of online tracking & fingerprinting.
However, users can check the level of their browser’s exposure with the Electronic Frontier Foundation’s Cover Your Tracks. This evaluates tracking protections & estimates how distinctive a browser appears within its observed sample.
Note that the results you get does not guarantee you 100% anonymity online. Also, remember that the population used for comparison can change. To get protection that you can count on, it’s best to use browsers that come with built-in anti-fingerprinting features.
Also, you should keep software updated & reduce the way you add unnecessary extensions to your browser. It is better to pursue browser-level protections because they give you more coverage than depending on a single privacy extension.
