Browser fingerprinting: the thing a VPN cannot hide

A fingerprint is built from things your browser tells every page it loads, mostly for legitimate reasons. Screen dimensions so layouts fit. Fonts so text renders. Timezone so dates display correctly. Language so content is chosen. Graphics capabilities so pages can decide what to draw.

Individually none of these identifies anyone. Combined, they frequently produce a value unique among millions of visitors, and it works with cookies disabled, in private browsing, and behind any VPN.

What goes into one

• Screen resolution, colour depth and available window size
• Installed fonts, probed by measuring rendered text
• Timezone and system language
• Canvas and WebGL rendering, which differ by GPU and driver
• Audio processing characteristics
• Hardware concurrency and device memory
• Platform, user agent and browser version
• Installed plugins and supported media types
• Touch support and pointer capabilities

EFF's Cover Your Tracks measures your own in a few seconds, and the result is usually more distinctive than people expect.

Why a VPN does nothing about it

Every one of those properties is reported by the browser about the machine. None is derived from the network. Changing where your packets exit changes the address in the header and nothing above it.

Worse, it can add a signal. A German exit address, an en-GB browser language, a Europe/London timezone and a UK keyboard layout is an unusual combination, and unusual combinations are exactly what fingerprinting keys on.

The two strategies against it

Blend in. Make your browser look identical to everyone else's. Tor Browser does this deliberately: fixed window sizes, a uniform user agent, a limited font set, canvas access blocked by default. It works because a large population is made to share one fingerprint.

Randomise. Change values so the fingerprint differs each time. Brave and several extensions do this. It defeats simple matching and produces a recognisable pattern of its own — a browser reporting different hardware every visit is not blending in.

Blending in is stronger and requires accepting real usability constraints. Randomising is easier and less effective.

What actually helps

• Use a mainstream browser in its default configuration. Every customisation makes you rarer. This is the counterintuitive part: a heavily hardened browser is often more identifiable than a plain one.
• Do not resize the window unusually. Window dimensions are a strong signal.
• Use Tor Browser for anything where fingerprinting is genuinely part of your threat model.
• Block trackers, which reduces how many parties collect a fingerprint even though it does not change the fingerprint itself.
• Use containers or separate profiles to keep identities apart, which addresses the linkage problem from a different direction.

What does not help

Private browsing, which clears storage and changes none of the properties above. Changing your user agent string, which conflicts with everything else your browser reports. And installing several anti-fingerprinting extensions, which tend to make the fingerprint more distinctive rather than less.

Where it sits among the other identifiers

Fingerprinting matters most when cookies are unavailable — after clearing them, in private windows, across browsers on the same device. Where a login exists it is redundant, because the account is a better identifier than anything inferred.

So the practical hierarchy is: accounts identify you exactly, cookies identify you reliably, fingerprints identify you probabilistically and durably, and your IP address identifies your connection. A VPN addresses the last of those four.

The honest position

A VPN is a network tool. Fingerprinting is an application-layer problem, and no network tool can solve it. Anyone selling a VPN as protection against tracking is describing one narrow part of tracking and leaving out the parts that work better.

Check what a VPN does control — the address the web sees, on what is my IP, and whether WebRTC is quietly contradicting it on the WebRTC leak test — and treat fingerprinting as a separate problem needing separate tools.

Why it is hard to fix at the platform level

Every property in the list is there because something needs it. Remove screen dimensions and responsive layouts break. Remove font metrics and text rendering breaks. Remove canvas readback and a large category of applications stops working.

The W3C's guidance to specification authors reflects this: the advice is to minimise new surface, require permission where possible, and accept that existing surface cannot simply be removed. Progress is therefore incremental — reducing precision, restricting access to secure contexts, requiring user activation — rather than a fix.

That is why fingerprinting has not been solved after a decade of attention, and why it is likely to remain the durable identifier after third-party cookies finish disappearing.