Websites are secretly tracking you using your browser’s 'fingerprint'

Many people worry about their online privacy and try to protect it by deleting cookies – but new research reveals this method is no longer effective.

A study led by Texas A&M University exposes how modern websites quietly track users with a technique called browser fingerprinting.

Unlike cookies, fingerprinting doesn’t leave traces you can erase. It works silently, building a detailed profile based on how your browser behaves and what kind of device you use.

Most users don’t even know this type of surveillance exists. Even more troubling, some companies may be doing it without consent – ignoring privacy laws completely.

Websites track you even after deleting cookies

Every time you open a website, your browser leaks information. It shares your time zone, screen size, operating system, and device type. These details might seem harmless. But combined, they create a unique fingerprint that identifies you, even if you don’t log in or accept cookies.

Dr. Nitesh Saxena is a cybersecurity researcher, professor of computer science and engineering, and associate director of the Global Cyber Research Institute at Texas A&M.

“Fingerprinting has always been a concern in the privacy community, but until now, we had no hard proof that it was actually being used to track users,” said Dr. Saxena. “Our work helps close that gap.”

This fingerprint acts like a digital signature. It silently follows you from site to site. And unlike cookies, which you can remove or block, fingerprints are almost impossible to avoid. Even privacy-focused browsers like Tor or Brave struggle to fully mask them.

Devices leave behind a digital trail

Most people assume that browsing in incognito mode or using privacy tools keeps them safe. But the Texas A&M study shows that assumption is flawed. You might feel hidden, but your device keeps leaving tracks behind.

“Think of it as a digital signature you didn’t know you were leaving behind,” explained co-author Zengrui Liu, a former doctoral student in Saxena’s lab. “You may look anonymous, but your device or browser gives you away.”

That silent trail means advertisers and websites can continue identifying you. And because you never directly share your name or login information, you’re unlikely to know it’s happening.

Connecting fingerprints to advertising

What makes this research different from past work is its real-world approach. It doesn’t just look at whether fingerprinting exists. It examines how fingerprinting connects to digital advertising and user tracking.

Study co-author Dr. Yinzhi Cao is an associate professor of computer science and technical director of the Information Security Institute at Johns Hopkins University.

“While prior works have studied browser fingerprinting and its usage on different websites, ours is the first to correlate browser fingerprints and ad behaviors, essentially establishing the relationship between web tracking and fingerprinting,” said Dr. Cao.

To test this, the researchers developed a measurement system called FPTrace. It assesses whether advertising systems respond to changes in a browser’s fingerprint. By altering the fingerprint and observing how ads behave, the researchers uncovered the role fingerprinting plays in digital surveillance.

Website tracking to target users

With FPTrace, the research team went beyond surface-level code. They analyzed how ad systems changed their behavior in response to fingerprint alterations. The idea was simple: if fingerprinting truly influences ad tracking, changing the fingerprint should affect how advertisers bid for space.

“This kind of analysis lets us go beyond the surface,” said co-author Jimmy Dani, Saxena’s doctoral student. “We were able to detect not just the presence of fingerprinting, but whether it was being used to identify and target users – which is much harder to prove.”

The team found that changing the fingerprint reduced syncing events and affected the value advertisers were willing to pay. This meant advertisers were using fingerprint data in real time to determine how valuable a user was.

A stealthy system of website tracking

One of the study’s most surprising findings was how fingerprinting worked even after users deleted cookies. This is important because it shows fingerprinting does not rely on traditional tracking tools. It survives across sessions and devices.

The team noted shifts in HTTP records and bidding behavior when fingerprints changed, meaning users were being re-identified without their consent. This suggests a new method of tracking that’s stealthier and more durable than anything cookies could offer.

Even more, fingerprint-based data may be passed along during backend ad bidding. This process happens in milliseconds and can share your browser fingerprint with third parties without your knowledge.

The limits of privacy laws

One of the most alarming aspects of the research is how fingerprinting bypasses privacy laws. Even when users opt out under strict laws like Europe’s GDPR or California’s CCPA, fingerprinting continues silently.

The law requires companies to respect a user’s decision not to be tracked. But fingerprinting falls into a gray zone. It happens in the background, with no visible alert or consent prompt. That makes enforcement difficult and user awareness nearly impossible.

This kind of invisible tracking undermines the very laws created to protect consumers. The researchers warn that current regulations need to expand to address fingerprinting directly.

Time for stronger privacy protections

The study doesn’t just expose a problem. It also points toward solutions. The team believes browsers need to take a stronger stance against fingerprinting. Current anti-tracking tools don’t go far enough.

The experts also hope FPTrace can help regulators audit companies and websites that use fingerprinting without permission. With the right tools, oversight agencies could start identifying violations more clearly and taking action.

Based on their results, the researchers call for a deeper look at how fingerprinting is used, especially in the ad tech industry. They argue that privacy protections must evolve to keep up with these new forms of tracking.

Your browser’s digital fingerprint

This breakthrough research, presented at the ACM Web Conference (WWW) 2025, shows how far online tracking has come – and how little most users know about it.

Clearing cookies used to feel like enough. But browser fingerprinting proves that companies have developed new ways to follow you, even when you try to disappear.

As companies find creative ways to bypass privacy protections, new tools and updated laws must respond. Until then, the digital fingerprint your browser leaves behind will continue to tell more about you than you ever intended to share.

This research was a collaboration between Texas A&M University and Johns Hopkins University. Funding came from the Texas A&M Engineering Experiment Station (TEES).

The study is published in the journal ACM digital library.

—–

Like what you read? Subscribe to our newsletter for engaging articles, exclusive content, and the latest updates. 

Check us out on EarthSnap, a free app brought to you by Eric Ralls and Earth.com.

—–