Essay arguing that browser fingerprinting has largely replaced third-party cookies for cross-site tracking, while Google’s multi-year Privacy Sandbox pivot ended with cookies retained (with limited IP masking promises scaled back).
Narrative arc
- EU cookie consent banners addressed third-party cookies, but Safari/Firefox blocked them earlier; Google pledged cookie deprecation in 2020, then in 2025 kept cookies while promoting alternatives.
- Trackers now combine network request metadata (IP, User-Agent, Accept-Language) with in-page measurements that need no permission: WebGL GPU strings, canvas font rendering, audio OfflineAudioContext sums, hardware concurrency, device memory (Chrome), display metrics, installed fonts, Intl timezone/locale (VPN does not change timezone).
Information theory
Uses entropy/surprisal framing (Akinator analogy): independent traits multiply identifying power; correlated traits (Bayes) complicate naive bit sums. ZIP + birth date + sex can uniquely identify a large fraction of Americans in marketing datasets.
Demo on the page
The article implements a live nickname generator hashing:
- OfflineAudioContext compressor output
- WebGL vendor/renderer and extension hashes
- Canvas text/emoji rendering pixels
- Intl date/number settings
navigator.hardwareConcurrency,deviceMemory,language- SHA-256 digest → trait + animal nickname
Mitigations
- Test uniqueness: coveryourtracks.eff.org
- Strongest browser protections cited: Brave (farbling), Tor and Mullvad Browser (uniformity); Safari/Firefox partial; Chrome minimal.
- Extensions like JShelter can break sites and may themselves become fingerprint signals; engine-level protection preferred.
Professional fingerprinting stacks maintain identity across single-variable changes—more robust than the demo hash.