Browser fingerprinting: what it is, where it came from and which browser to choose

Why this article

A website can recognise you on your next visit even if you have deleted all your cookies, refused them in the banner or opened your browser in incognito mode. It doesn’t need to store anything on your device: it only needs to take a close look at the device itself. This technique is called browser fingerprinting.

Almost everyone knows about cookies by now: banners with an “Accept” button appear on every other website. Very few people know about fingerprinting, even though it has been around for a long time and is widely used. It is harder to see, harder to explain and almost impossible to delete. That is exactly why we built a dedicated check on gdpru.eu and wrote this article.

The check shows what your browser tells any website about you without asking. The article explains everything else: what fingerprinting is, where it came from, who uses it and why, what the law says and, most importantly, what to do about it. We will also look at a question everyone who cares about privacy eventually faces: which browser to use day to day, and why.

There is no technical detail here. You don’t need to know how to program to understand how fingerprinting works, just as you don’t need to be a mechanic to understand why you lock your car.

The article is useful for three groups of readers:

• Ordinary users who want to understand what happens when they open a website and choose their browser consciously.
• People who already care about privacy: they delete cookies, install ad blockers and believe that is enough.
• Website owners and those responsible for data protection in a company: fingerprinting falls under the same rules as cookies, and this is often forgotten.

What a browser fingerprint is

A fingerprint is a way of recognising a person not by a tag they were given, but by traits they already have.

The badge and the guard

Imagine you were handed a badge at the entrance to a building. People recognise you by it in the corridors, in the canteen, on the next floor. But you can take the badge off and throw it away, and then security sees a stranger again. That is how cookies work: a website places a small tag in your browser and later recognises you by it. Delete the cookies, and you have taken off the badge.

Now imagine a guard who doesn’t hand out badges at all. He simply remembers you: your height, the colour of your jacket, the way you walk, your voice, your habit of coming in on Tuesdays. There is nothing to take off. You can come back tomorrow and he will still recognise you, because the traits stayed with you.

A browser fingerprint is that guard.

What traits a browser has

When you open a website, your browser happily tells it about itself. This is not malicious: the site really does need to know a few things to display the page properly. How big the screen is, so the text fits. Which language you read, so it can offer the right version. What time it is for you, so it can show the right meeting time.

Here is what is usually available to any website without permission:

• The browser and its version, the operating system. For example, “Chrome version so-and-so on Windows” or “Safari on iPhone”.
• The screen: size, number of colours, scaling.
• The language or several languages set in your settings, and their order.
• The time zone. It reveals which part of the world you are in, even if you never allowed location access.
• The graphics card: often its exact model.
• How many processor cores and how much memory the device has, at least roughly.
• Whether there is a touchscreen.
• Which fonts are installed. People’s font collections differ surprisingly: office software, graphics editors and games all bring their own.

There are cleverer traits too. A website can ask the browser to draw an invisible picture with some text and look at the result. The same text comes out very slightly differently on different computers: the edges of the letters are smoothed differently, colours are blended a little differently. You can’t see it with your eyes, but for a program the difference is obvious. There is a similar trick with sound: the browser “plays” a silent signal, and tiny differences in processing become a trait as well.

Why one trait means nothing, but ten are almost a passport

On its own, each trait means very little. Hundreds of millions of people use Windows. Tens of millions have Russian in their language settings. A particular screen size is shared by a huge number of people too.

But traits add up. Each one rules out part of the population. Russian language, but a Berlin time zone. A particular graphics card. An unusual set of fonts. A second monitor. After a dozen such cuts, very few people match you on every trait at once, and often nobody does. Studies we describe below have shown that for the vast majority of people the combination of traits is unique.

A program glues all the traits into one short string of letters and numbers. That is the fingerprint. As long as you don’t change your device and browser, the string barely changes.

Why you can’t simply delete it

With cookies it’s straightforward: they sit in your browser, and you can find and wipe them. A fingerprint is not stored on your side but on the server of whoever took it. There is nothing for you to delete, because the traits are properties of your device, not a file.

This has several unpleasant consequences:

• Incognito mode doesn’t help. It wipes cookies and history when you close the window, but the graphics card, screen and fonts stay the same.
• Refusing in the cookie banner doesn’t help if the site doesn’t separately ask permission for fingerprinting, which is often the case.
• You see nothing. Cookies can at least be found in the browser settings. A fingerprint is taken silently, and an ordinary user will never know it happened.
• A fingerprint can restore what you deleted. If you deleted your cookies but your fingerprint stayed the same, the site can work out that the “new” visitor is you and give you your old tag back.

Who takes fingerprints, and why

The fingerprint is taken not by the browser itself or by your computer, but by a program the website loads along with the page. Sometimes it is the website’s own program, but more often it belongs to someone else: an advertising network, an analytics service, a fraud prevention system.

They have two goals, and they are very different.

The first is protection. A bank wants to be sure that it really is you logging into your account, and not a fraudster with a stolen password. If the login comes from a device with completely different traits, the bank can ask for extra confirmation. A shop wants to tell a real customer from a bot that buys up stock or tries stolen passwords. Here the fingerprint works for you.

The second is tracking. An advertising network wants to recognise you across thousands of websites that carry its code and combine your visits into one profile: what you read, what you search for, what you buy. Cookies used to be enough for this. When browsers began to restrict them and people began to delete them, fingerprinting turned out to be a convenient substitute that can neither be deleted nor blocked with a single tick box.

Technically, it is the same technique. The difference lies in the purpose, and in whether you were told and asked for consent. That is exactly what the law looks at, as we explain below.

Where it came from

Fingerprinting was born not in advertising but in the fight against fraud, and only later was it picked up by those who track people for advertising.

Banks came first

In the 2000s, banks and online shops faced a problem: passwords were being stolen on a massive scale, and a password alone couldn’t tell who was logging into an account. So systems appeared that looked not only at the password but also at the device: which computer, which browser, which time zone the login came from. If everything matched the usual pattern, all was well. If the password was correct but the computer looked completely different, that was a reason to be suspicious.

This went by different names: “device recognition”, “device ID”, “anti-fraud”. Users hardly knew about it, and at the time it bothered few people: the purpose was clear and useful.

2010: “Every browser is unique”

The turning point came in 2010. Researcher Peter Eckersley of the US digital rights organisation EFF (Electronic Frontier Foundation) launched the Panopticlick experiment. Anyone could visit the site and check how recognisable their browser was. A year earlier, in 2009, Jonathan Mayer had tested a similar idea on a small sample, but it was the EFF study that was the first truly large-scale one (study).

The result surprised even the authors. Of 470,000 browsers, 83.6% had a unique combination of traits. Among browsers with the then-popular Flash or Java plug-ins, 94.2% were unique (EFF, 2010). It was this work that brought the very term “browser fingerprinting” into use and showed that it was not a theory but reality.

The study also noticed something that remains true today: the hardest browsers to recognise are those deliberately made identical, and mobile phones, which resemble each other more than computers do (Washington Technology, 2010).

2012–2014: the invisible picture and the first scandal

In 2012, researchers at the University of California, San Diego described the invisible-picture trick mentioned above. It turned out that the same text is drawn very slightly differently on different computers, and that this makes an excellent trait.

It didn’t take long. In the summer of 2014, researchers from Princeton and the Belgian university KU Leuven published a paper with the telling title “The Web Never Forgets”. They checked the 100,000 most popular websites and found the technique on 5,542 of them, roughly one in eighteen. Almost all cases, around 95%, led to a single company: AddThis, which made “Share” buttons for websites (KU Leuven).

The most troubling part was that the owners of many sites, including government and medical ones, didn’t even know their visitors were being fingerprinted. They had simply installed free buttons, and the buttons came with a “payload”.

After a wave of press coverage, AddThis stopped using the technique within two days, and developers released the first browser extensions that blocked the invisible picture (Princeton, 2016). This was the first lesson worth remembering: publicity works.

2016–2021: how unique are we really?

Researchers then began to argue about the main question: is almost every browser really unique?

In 2016, the French project AmIUnique got a result similar to EFF’s: about 89% unique fingerprints. But in 2018 the same researchers ran their test not on a special site for the curious but on one of the most visited French news sites, where completely ordinary people go. Of two million fingerprints, only 33.6% were unique, and among phones only 18.5% (Hiding in the Crowd, 2018).

Why such a difference? First, testing sites attract people interested in privacy, who often configure their browsers in unusual ways. Ordinary visitors to a news site are much more alike. Second, by 2018 browsers had dropped Flash and Java, which gave away many traits. An interesting detail from the same study: on the French site, language and time zone barely helped tell people apart, because almost everyone had the same ones, French language and Paris time (summary of the study).

This means a trait works more strongly the more you differ from the people around you. A Russian speaker living in Germany or Estonia stands out among the locals from the combination of language and time zone alone.

Later, longer studies again showed high numbers. For example, observing four million fingerprints on the same French site over six months found about 81% unique, and most traits barely changed for months (review of studies).

The honest conclusion from this debate is: not everyone is unique, but very many people are. And even if your fingerprint matches someone else’s, adding one or two traits, such as your internet address, is enough to single you out of the crowd again.

The race between trackers and browsers

The past fifteen years have been a race: trackers invent new traits, browsers hide them, and every major browser has picked its own side in this race.

Why the browser decides everything

A website cannot protect you from other people’s code on its own pages, and you cannot forbid a website from asking questions. The only thing standing between you and a tracker is your browser. It decides whether to answer honestly, answer “like everyone else” or fib a little. That’s why the question “how do I protect myself from fingerprinting” almost always comes down to “which browser do you use, and how is it set up”.

Tor Browser: hiding in the crowd

The oldest and most consistent approach belongs to Tor Browser. Its creators understood from the start: if every user is slightly special, they can be singled out. So Tor makes everyone look the same. Windows open at a standard size, time is reported in a single zone for everyone, the same language is reported, and invisible pictures are drawn so they don’t give away the hardware.

The idea is simple: if a million people look identical, the tracker sees not you but a crowd. Later, some of these protections were brought into regular Firefox, where they can be switched on manually.

Firefox: block the known, hide the conspicuous

Since 2020, Mozilla, the maker of Firefox, has blocked known tracking and fingerprinting scripts by default using a constantly updated list. Since 2021, the browser has gradually added protection against the techniques themselves: it adds noise to the invisible picture and hides some system details.

In November 2025, Firefox 145 introduced a new layer of protection. According to Mozilla’s own measurements, it nearly halves the share of users who can be uniquely identified by their fingerprint (Mozilla). An important caveat: at release, this protection worked in private windows and in strict tracking protection mode, and Mozilla promised to switch it on for everyone later, after testing (BleepingComputer). So it makes sense to turn on strict mode in Firefox manually.

Safari: protection on by default for everyone

Apple has made privacy part of its brand and has been steadily restricting tracking in Safari since the late 2010s. You saw an example of this on our page: Safari doesn’t name the graphics card model, it gives a generic answer.

In September 2025, with the release of iOS 26 and macOS Tahoe 26, Safari switched on advanced fingerprinting protection by default in all windows, not just private ones. Users don’t need to do anything (9to5Mac). A separate, stricter setting that also blocks known tracking services is still on by default only in private browsing, but it can be turned on for all browsing in Safari’s settings (SecureMac).

Brave: a little different every time

Brave took a third path. It doesn’t make everyone identical and doesn’t just hide traits; it distorts them slightly by adding random noise. A fingerprint in Brave comes out different on different websites and changes after the browser restarts. A tracker can take it as many times as it likes but won’t be able to link the results together.

In Brave, this protection is part of Shields, the lion icon in the address bar. It can be turned off for an individual site if that site doesn’t work properly.

Chrome: the most popular and the most reluctant

Chrome holds most of the market, and its owner, Google, earns most of its money from advertising. This contradiction runs through the whole history of its approach to tracking.

In 2019, Google announced the Privacy Sandbox project: it promised to drop third-party cookies and replace them with “more private” ways of showing ads, and to fight fingerprinting along the way. The project was postponed many times, and regulators treated it with suspicion. In 2024, Google abandoned its plan to switch off third-party cookies, in April 2025 it decided to leave everything as it was, and in autumn 2025 it shut down almost all Privacy Sandbox technologies (TechSpot).

At the same time, a turn took place that directly concerns our topic. From 16 February 2025, Google stopped prohibiting fingerprinting for advertisers using its advertising services. Before that, such techniques were banned by its own rules. The UK data protection regulator, the ICO, called the decision irresponsible and warned that fingerprinting could take the place of third-party cookies (ICO).

Chrome itself offers minimal fingerprinting protection. It has done a few things: for example, it no longer reports the phone model in its general self-description. But a website can request this information separately, and Chrome will provide it. In normal mode, Chrome has neither Brave-style built-in noise nor Safari-style masking.

Where the race stands today

Here’s the picture. Three browsers — Safari, Firefox and Brave — actively protect against fingerprinting, each in its own way. Tor Browser protects most strongly, but at the cost of convenience. Chrome and browsers built on it, unless they add their own protection, do practically nothing, and the world’s largest advertising company has officially allowed its clients to use this technique. That’s why the choice of browser matters more today than ever.

What EU law says

In the EU, fingerprinting for tracking and advertising may not be done without your consent — under the same rules as cookies — although in practice far from everyone complies.

The rule about “access to the device”

Many people think cookie banners are a GDPR requirement. In fact, the main rule is set out in a different document, the ePrivacy Directive, Article 5(3). Translated from legal language into plain English, it says: nothing may be stored on a person’s device or read from it without their consent, unless it is strictly necessary for a service the person themselves requested.

The key word here is “read”. The rule covers not only cookies that a website writes, but any information a website obtains from your device. When a script asks the browser for the graphics card model, asks it to draw an invisible picture and collects the result, it is reading information from your device.

European regulators said this plainly as early as 2014: their joint opinion on device fingerprinting places the technique under the same rule as cookies. Later, the European Data Protection Board (EDPB) issued detailed guidelines on what exactly counts as access to a device. The final version was published in 2024. It confirms that what matters is not the name of the technology but what it does. If a technique collects information from your device for tracking or advertising, consent is required.

Where does GDPR come in?

GDPR comes into play at the next step. A fingerprint that can identify a specific person is personal data. The text of GDPR explicitly mentions “online identifiers” and device information. That means everything done with the fingerprint afterwards — storing it, linking it to purchases, passing it to partners — is subject to GDPR. You have all the usual rights: to find out what data has been collected about you, to demand its deletion, to object to its use for advertising.

When the law allows fingerprinting

Not every fingerprint is unlawful without consent. If it is strictly necessary for a service you requested, or for its security, things are different. The clearest example is a bank checking whether a fraudster is logging into your account. The bank has a legitimate reason here, but even that doesn’t give it the right to use the same data for advertising.

The line is drawn by purpose. Fraud prevention may be justified. Advertising and tracking across websites — only with consent.

What happens in practice

In practice, things are much worse with fingerprinting than with cookies, for a simple reason: it’s hard to see. Cookies can be found in the browser and are checked by regulators and journalists. A fingerprint is taken invisibly, and proving a violation requires special analysis.

On top of that, many consent banners don’t mention fingerprinting at all. A person clicks “Reject”, believes they are protected, and the fingerprinting script on the page keeps running. This is one of the reasons we build checks on gdpru.eu: so that such things can be seen and shown.

Regulators take a firm line. When Google allowed its advertising clients to use fingerprinting, the UK regulator ICO stated plainly that companies would have to prove such collection is lawful, and that this is a high bar (ICO). The UK is no longer in the EU, but its rules in this area are very similar to the European ones.

The rules may change

In November 2025, the European Commission proposed a large package of changes, the so-called “Digital Omnibus”. Among other things, it moves the rules on cookies and device access from the ePrivacy Directive directly into GDPR, into new Articles 88a and 88b. The draft contains some ideas that are good for people: rejecting cookies with one click, a ban on repeatedly asking for consent after a refusal, and an obligation for websites to respect a “no consent” signal sent directly by the browser.

But so far this is only a proposal. As of autumn 2026, negotiations in the European Parliament and the Council of the EU are ongoing, and according to industry publications, some of the cookie rules are in doubt in the Council’s position (Recording Law, Usercentrics). Until it is adopted, the current rules apply: the ePrivacy Directive plus GDPR. For fingerprinting, this means consent is already required now.

What you can do

• Ask. Under GDPR, you can write to a company and demand to know what data it has collected about you, including information about your device. The company must reply, as a rule within one month.
• Object. If a company uses your data for advertising, you have the right to object, and it must stop.
• Complain. If a website fingerprints you without consent, you can contact the supervisory authority in your country. In Estonia, this is the Data Protection Inspectorate (Andmekaitse Inspektsioon); in Germany, the data protection commissioners of the federal states.

And of course, the best protection is the kind that requires no letters or complaints: a well-chosen, properly configured browser. We will come back to that.

How to use the check on gdpru.eu

The check at gdpru.eu/fp-check does to your browser exactly what a fingerprinting script does, and shows the result to you rather than to an advertising network.

What to know before you start

Nothing is sent anywhere. All calculations happen in your browser. We don’t receive a single line of what you see, we don’t store the result, and we don’t know who visited the page. This is the principle behind all our checks: we build the APK, browser extension and HAR checks the same way.

No registration or installation is needed. Just open the page.

Step 1. Open the page and look at the list

You will see eleven rows, each one a trait of your browser or device: the invisible picture, the graphics card, indirect signs of the graphics card, browser and system, screen, pixel density, language, time zone, processor cores, memory, touchscreen.

Each row has three parts:

• The value — what exactly your browser reported.
• A label saying whether the trait identifies you “strongly”, “moderately” or “weakly”, with a short explanation why.
• “Where you’ll find it” — where this trait comes from: the browser settings, the system settings or the hardware itself.

The last part is especially useful. It shows at once what you can change yourself and what only browser protection can help with.

Step 2. Read the labels

The strongest identifiers are traits that depend on hardware and are rare: the invisible picture, the graphics card, the exact browser and system version. Screen, language and time zone identify you moderately, especially in combination. Cores, memory and touchscreen identify you weakly: they have few possible values and add only a little to the rest.

If a row says “the browser didn’t provide it”, that’s good: your browser hides this trait. If it says “hidden by the browser — this is protection”, that’s good too: the browser answered, but generically, like Safari with the graphics card.

Step 3. Look at the fingerprint code

At the bottom of the page is a short eight-character code. This is all the traits glued into one string. You can copy your code with a button.

It’s important to understand that this is our teaching code. Real trackers collect more traits and calculate differently. But the principle is the same, and it’s enough for comparison: if our code doesn’t change, theirs most likely doesn’t either.

Step 4. Run some experiments

The most interesting part starts when you begin to compare. A few experiments that take a couple of minutes:

1. Restart your browser completely, not just the tab, and open the page again. Is the code the same? In Chrome, almost certainly yes. In Brave, probably not: it changes the noise from session to session.
2. Open a private window and compare the code. If it’s the same as in a normal window, private mode doesn’t protect you from fingerprinting. That’s usually the case.
3. Open the page in another browser on the same computer. The code will be different, and that in itself is a lesson: a fingerprint is tied not only to the device but also to the browser.
4. Change a setting and compare. For example, Brave has a tick box that prevents websites from fingerprinting you based on your languages. With it on, the “Language” row will show a single language instead of a list. In Firefox you can turn on strict tracking protection.
5. Compare your computer and your phone. On an iPhone you will most likely see far fewer details than on a computer.

Step 5. Save the report as a PDF

The “Save report as PDF” button opens a print window with a clean sheet: date and time, browser name, fingerprint code and a table of all the traits. In the print window, choose “Save as PDF”.

Save such a report in every browser you use and put them side by side. You’ll see at once which browser hides more and which one gives everything away. It’s a handy way to choose a browser based on facts rather than advertising.

One warning: the report describes your device. Sending it to a friend for comparison is fine. Posting it publicly is not a good idea.

What the check doesn’t do

To avoid false expectations, let’s be honest:

• It doesn’t measure how unique you are. That would require a large database of other people’s fingerprints, and we don’t collect or store anything.
• It doesn’t check other websites. It shows what any website can see, but doesn’t tell you which particular site is fingerprinting you. That’s a job for our other check, based on a HAR recording of network requests.
• It doesn’t protect you. A website cannot switch on protection for you: browsers are designed so that websites don’t control their settings. Otherwise any website could also switch protection off. You turn on protection yourself, and the check helps you confirm that it works.

Two ways to protect yourself: look like everyone else, or look different every time

You can’t hide from fingerprinting completely, but you can make it useless — either by blending into the crowd or by constantly changing your traits.

Why you can’t just “switch everything off”

The first idea that comes to mind is to forbid the browser from answering questions. Report neither the screen, nor the language, nor the graphics card. The trouble is that without these answers, most websites simply won’t work: the page won’t know how to lay out text, video won’t start, a map won’t render.

The second idea is to install an extension that replaces your traits with random ones. This is a trap. Home-made spoofing is almost always imperfect: the extension changes one thing but forgets another. The result is inconsistencies — the browser calls itself an iPhone, but it has a large monitor and no touchscreen. Such inconsistencies make you even easier to single out than having no protection at all: real iPhones with those traits don’t exist, so you are the only one.

That’s why only two approaches work, and both require the protection to be built into the browser itself and consistent down to the smallest detail.

Approach one: look like everyone else

The idea: if thousands of people look identical, a fingerprint doesn’t point to anyone in particular. The guard sees a crowd in identical grey jackets and can’t tell which of them came in yesterday.

This is how Tor Browser and Mullvad Browser work, and to a lesser extent Safari and Firefox in strict mode. The browser answers questions in a standard way: a generic graphics card, rounded values, sometimes the same window size and time zone for everyone.

What it costs. The stronger the protection, the more noticeable the inconvenience. In Tor Browser, websites may show a time that isn’t yours, the window opens at an unusual size, and some sites are slow or show CAPTCHAs. In Safari and Firefox the inconvenience is usually small, but the protection is weaker too.

The weak spot. The approach only works if the crowd is large and truly identical. Change something to suit your taste — enlarge the window, install a rare font or an unusual extension — and you stand out again.

Approach two: different every time

The idea: if your traits change slightly on every visit, today’s fingerprint won’t match yesterday’s. Each time the guard sees a slightly different person: a jacket of the same colour but a different shade, a similar walk but not quite the same.

This is how Brave works, and partly Firefox in strict mode: the browser adds random noise to some answers. To the website everything looks plausible and the page works normally, but the fingerprint code is different on every site and changes after a restart.

What it costs. Almost nothing in everyday life. Occasionally a site that needs precise graphics may behave oddly, and then you can switch the protection off just for that site.

The weak spot. Constantly changing traits are noticeable in themselves. Fraud prevention systems at banks and shops sometimes find this suspicious and show a CAPTCHA more often or ask you to confirm your login with a code. This isn’t dangerous, just a little inconvenient.

What matters more than the fingerprint

The most important thing people forget: the fingerprint isn’t the only trait. Even perfect fingerprinting protection won’t help if:

• You are logged in. The website knows you by your login and doesn’t need any fingerprint. This applies to the browser itself too: if you are signed into a Google account in Chrome, Google knows who is using that browser.
• You have a fixed internet address. At home it usually stays the same for weeks. Together with a few browser traits, that is often enough to recognise you.
• You tell them about yourself. An email address in a newsletter form, a phone number in a loyalty programme, paying with the same card.

Fingerprinting protection is needed above all against tracking between websites: when you haven’t logged in anywhere, but an advertising network still combines your visits into one profile. This is where it works best.

Which to choose

For everyday life, the second approach or a mild version of the first makes sense: a browser that protects by default and breaks almost nothing. That means Brave, Safari, and Firefox in strict mode. The strict version of the first approach, Tor Browser, is good for special tasks but not for every day. More on each browser in the next section.

Which browser to choose

For most people in Europe, a sensible everyday choice is Brave, Firefox in strict mode, or Safari on Apple devices; Chrome is the worst fit if privacy matters to you.

What to put first

Before comparing names, it’s worth agreeing on what to choose by. Here are the criteria in order of importance.

1. Protection by default. The most important one. Most people never open the settings. A browser that protects on its own, without tick boxes and extensions, protects you, your parents and the colleagues you install it for.
2. How the browser’s maker earns money. The browser is free, but developing it costs a fortune. If a company lives off advertising, it will always be tempted not to get in the way of advertising trackers. That doesn’t make such a browser bad, but its interests and yours don’t fully align.
3. Regular security updates. The browser is your main door to the internet. If it isn’t updated quickly, no amount of privacy will help: a security hole can be used to steal far more than a fingerprint.
4. Convenience on all your devices. The best browser is the one you actually use. If it’s inconvenient, you’ll go back to your old one within a week.
5. Which laws the company operates under. For EU residents it matters where data is stored and which authorities can demand access to it.
6. How tightly the browser is tied to an account. The more insistently a browser asks you to sign in and sync everything, the more its owner knows about you.

The main browsers at a glance

Brave

Brave is built on the same foundation as Chrome, so websites work the same way and extensions from the Chrome store fit. But unlike Chrome, Brave blocks ads and trackers by default and adds noise to the traits we discussed. You can see this on our page: the fingerprint code changes after the browser restarts.

Pros. Strong protection with no setup. A familiar interface for those coming from Chrome. Versions for desktop, Android and iPhone.

Cons. Brave is a commercial company looking for ways to make money: its own opt-in ads, a crypto wallet, a paid VPN, a built-in AI assistant. All of this can be switched off, but some people find it annoying. In 2020 there was an unpleasant episode: the browser inserted affiliate codes into the addresses of some crypto exchanges; the company apologised and fixed it. It’s also worth knowing that on iPhone, browsers almost always run on Safari’s engine (in the EU Apple formally allows other engines, but major browsers barely use them yet), so Brave on iPhone protects less than on a computer.

Verdict. The best choice for most people on desktop and Android. After installing it, go through the settings once and switch off what you don’t need: the wallet, Brave’s ads, the AI assistant.

Firefox

Firefox is the only major browser with its own engine, independent of both Google and Apple. It’s made by Mozilla, an organisation with non-profit roots. This matters not only for privacy: Firefox is one of the last reasons the web doesn’t belong to a single engine.

Pros. Protection against known trackers by default, strong fingerprinting protection in strict mode and in private windows. The best support for privacy extensions, including the full version of uBlock Origin. Plenty of fine-grained settings for those who want them.

Cons. At the time of writing, the strongest fingerprinting protection isn’t on by default in all windows: you have to turn it on by choosing strict mode. Mozilla gets most of its money from a default-search deal with Google, which creates exactly the dependence we talked about. In 2025, Firefox’s new terms of use drew a wave of criticism over clumsy wording about data; Mozilla clarified them, but some users’ trust was shaken.

Verdict. An excellent choice for those willing to open the settings once: “Settings → Privacy & Security → Strict”. If a site misbehaves afterwards, you can relax the protection just for that site.

Safari

Safari is the built-in browser on iPhone, iPad and Mac. Since autumn 2025 it protects against fingerprinting in all windows by default and hides some traits, such as the graphics card model.

Pros. Protection without any action. Excellent battery life and memory efficiency on Apple devices. Apple earns from selling devices rather than advertising in the browser, so its interests are closer to yours.

Cons. Apple devices only. The protection is based on “like everyone else”: on iPhone this works well because millions of iPhones already look alike, on Mac less so. The strictest setting, which also blocks known tracking services, has to be turned on manually for all windows: “Settings → Safari → Advanced → Advanced Tracking and Fingerprinting Protection → All Browsing” (on newer iOS versions Safari sits under Settings → Apps; on Mac, in Safari’s settings under “Advanced”). Exact item names may vary slightly between system versions.

Verdict. If you have an iPhone, Safari is the best default choice. On a Mac it’s good, but Brave and Firefox give you more control.

Mullvad Browser

Mullvad Browser is made by the Swedish company Mullvad together with the Tor Project. Essentially, it’s Tor Browser without the Tor network: the same “like everyone else” protection, but websites open from your normal address at normal speed.

Pros. One of the strongest fingerprinting protections available without major sacrifices. Free, no ads, no account.

Cons. To keep the crowd identical, the browser deliberately limits customisation: a standard window size, few extensions. Your internet address isn’t hidden, so Mullvad Browser is often used together with a VPN. There’s no mobile version.

Verdict. Good as a second browser for sensitive tasks: looking up health information, legal questions, anything you don’t want linked to you.

Edge and Chrome

Microsoft’s Edge and Google’s Chrome are built on the same foundation. Edge blocks some known trackers; Chrome has practically no built-in fingerprinting protection. Both companies earn from advertising and services and actively encourage you to sign in and sync everything.

They are fast, convenient and well protected against hacking: updates come out often. If what matters most to you is compatibility with every site and familiarity, they are a workable option. But if you’ve read this far, privacy probably matters to you, and then they aren’t the best choice. If you stay with Chrome anyway, at least install a blocker for known trackers and don’t sign into your Google account in the browser itself.

A practical setup

Many people do well with a two-browser setup:

• Main browser — Brave or Firefox in strict mode on the computer, Safari or Brave on the phone. For everything day to day: news, shopping, social media, email.
• Second browser for sensitive things — Mullvad Browser or a Firefox private window. For anything you don’t want linked to your main profile.

And if a site misbehaves in a protected browser, it’s better to relax the protection for that one site than to give it up everywhere.

What not to use for everyday browsing

For everyday use, avoid tools that are too “heavy”, browsers whose owners operate under laws that give the authorities almost unlimited access to data, and the built-in browsers of apps.

Tor Browser: an excellent tool, but not for every day

Tor Browser doesn’t just hide your traits; it also routes all your traffic through a chain of other people’s computers around the world. This gives very strong protection: a website sees neither your traits nor your address. For journalists, human rights defenders and people in countries with censorship, it is an invaluable tool.

But for everyday life it is inconvenient and often pointless:

• It’s slow. Pages take noticeably longer to load, and video stutters.
• CAPTCHAs and blocks. Many websites treat Tor network addresses with suspicion: they show endless “I’m not a robot” checks, and banks and shops may block access altogether or lock your account over a “suspicious login”.
• Logging in defeats the purpose. If you log into your email or social network in Tor, the website knows who you are from your login. The anonymity disappears, but the inconvenience remains.

Tor Browser’s proper place is special tasks where anonymity really matters. For everyday privacy, the browsers from the previous section are a better fit.

Browsers from companies subject to laws with broad state access to data

For Russian-speaking residents of the EU this point is especially important, because many people use Yandex Browser out of habit.

The issue here isn’t the quality of the browser but the law. Yandex is a Russian company and must comply with Russian legislation. Russian laws require many internet companies to store user data and hand it over to the security services on request, with practically no independent judicial oversight of such requests. And a browser sees more than any single app: which websites you open, what you search for, sometimes what you type.

For someone living in the European Union, this means information about their online life may end up somewhere GDPR doesn’t apply, where you can neither find out who looked at it nor complain. If you need Russian services for work or to keep in touch, use their websites in a normal, protected browser. As for the browser itself, choose one that operates under European or at least comparable rules.

The same logic applies to any browser whose owner operates in a country where the authorities can access user data without a court order.

The built-in browsers of apps

When you tap a link in Instagram, TikTok, Facebook or another app, the page often opens not in your browser but in the app’s own built-in browser. It looks convenient, but you lose all of your browser’s protection settings, and the app gains the ability to watch what you do on someone else’s website.

In 2022, researcher Felix Krause showed that the built-in browsers of several popular iPhone apps add their own code to the pages they open. In TikTok’s case, this code could technically track keystrokes, meaning everything a person types on the site; the company said it does not use this capability (Computing). The researcher himself stressed that adding code doesn’t in itself prove bad intent. But from the outside, it’s impossible to check what actually happens to the data.

What to do. Look for an “Open in browser” option in the app (usually behind a three-dot icon). If there isn’t one, copy the link and paste it into your browser. This is especially important if the page asks for a password, card details or personal information.

“Anti-detect browsers”

Online you can find paid browsers that promise “complete invisibility”: they generate a fake fingerprint for each tab and let you run hundreds of accounts that a website won’t link to each other. They are advertised as privacy tools.

In reality, their main customers are people who need to get around platform rules: multiple accounts in advertising and social media, traffic arbitrage, and quite often outright fraud. For an ordinary person they have nothing but downsides: they are paid and closed, you hand a third-party service access to all your accounts, and using such programs often violates websites’ rules and can end in a ban. For an ordinary person’s privacy, Brave, Firefox or Safari do a better job, for free.

Browsers with a “built-in VPN” that isn’t one

Some browsers advertise a “free built-in VPN”. Often it isn’t a real VPN but a proxy for the browser only: it changes your address as seen by websites, but doesn’t protect other programs’ traffic and does nothing to hide the browser’s traits. On its own, such a proxy offers no protection against fingerprinting at all: the address is new, but the graphics card, screen and fonts are the same.

It’s also worth remembering that Opera has been owned by Chinese investors since 2016. That doesn’t make it a bad browser, but when choosing it, it’s sensible to consider which laws its owner operates under, as with Yandex.

Outdated browsers and unknown “privacy browsers”

• An outdated browser is one that no longer receives updates, for example on an old version of Windows or an old phone. Its security holes can be used to steal far more than a fingerprint. If a browser is no longer updated, it’s time to replace it, even if it “still works”.
• Unknown browsers from app stores with grand names like “Super Private Browser” and ads inside. Nobody has checked what they do with your data. If a browser is free but you can’t tell how its developer makes money, the answer is most likely you.
• Free VPN extensions of unclear origin. They see all your browser traffic and sometimes sell data about it themselves.

In short

For everyday tasks, don’t choose what is too inconvenient (Tor), what operates under laws with broad state access to data (browsers from Russian and similar companies), what gives you no control (the built-in browsers of apps), or what promises more than it can deliver (anti-detect browsers, “built-in VPNs”, nameless apps).

Your phone: browser, apps and advertising ID

On a phone, the browser fingerprint is the lesser problem: apps hardly need it, because the phone already has a ready-made advertising tag, and that is what you should switch off first.

The browser on iPhone

Oddly enough, an iPhone gives away less about itself than a computer. Millions of people carry the same model, with the same screen size and the same system version, so it’s hard to tell them apart by browser traits. This is “like everyone else” protection, built into the market itself. On top of that, since autumn 2025 Safari hides some traits in all windows by default.

If you have an iPhone, Safari is a good choice. You can additionally turn on the strict protection for all windows: “Settings → Safari → Advanced → Advanced Tracking and Fingerprinting Protection → All Browsing” (on newer iOS versions Safari sits under Settings → Apps).

The browser on Android

Android phones are far more varied: there are thousands of models, each differing slightly in screen, graphics and features. Chrome on Android no longer writes the phone model into its general self-description, but a website can request it separately, and the browser will provide it.

On Android, it makes sense to install Brave or Firefox. Both are available on Google Play and protect just as they do on a computer. If you use Samsung’s built-in browser, it also has tracker blocking in its settings, and it’s worth turning on.

Apps: the real leak

The most important thing about phones: apps track you differently from websites. They don’t need to guess who you are from traits, because the phone has an advertising ID — a ready-made “badge” the system issues specifically for advertising. Advertising and analytics modules (SDKs) built into apps read it and pass it to advertising networks. That’s how the same advertising network recognises you in a game, in a shopping app and in a weather app.

To see which modules are built into a particular app and who owns them, you can use our app check: it shows the list of SDKs inside an Android app and the country of their owners.

How to switch off the advertising ID

This is one of the most useful things you can do for privacy on your phone, and it takes a minute.

• Android: “Settings → Google → Ads → Delete advertising ID”. The path may vary slightly depending on the system version and manufacturer. After deletion, apps receive a string of zeros instead of the ID.
• iPhone: “Settings → Privacy & Security → Tracking”, and switch off “Allow Apps to Request to Track”. Apps then can’t even ask for permission, and they won’t get the ID.

Do apps use fingerprinting too?

Yes. If the advertising ID isn’t available, some modules try to recognise the phone by its traits: model, system version, language, carrier, amount of memory. Apple forbids developers from doing this, and since 2024 has required them to explain why their app accesses a number of system details that are often used for fingerprinting. Google also restricts access to permanent device identifiers. This doesn’t solve the problem completely, but it narrows it considerably.

The best thing you can do yourself: switch off the advertising ID, install fewer apps, and use the website in a protected browser wherever the app adds nothing but tracking. For many shops and delivery services, for example, the website works just as well as the app.

Links from apps

And once more about built-in browsers, because on a phone this matters especially: links in social media and messengers often open inside the app. If you are about to enter a password or card details there, first open the page in your own browser using “Open in browser”.

What to expect next

In the coming years there will be more fingerprinting, not less, but browser protection will also get stronger — and the gap between protected and unprotected users will widen.

Tracking without cookies is becoming the norm

For years, everyone expected third-party cookies to disappear. Safari and Firefox restricted them long ago, and Chrome promised to switch them off. But in 2025 Google finally abandoned that plan and shut down its alternative, Privacy Sandbox. At the same time, it allowed advertisers to use fingerprinting.

The market drew its conclusion: relying on cookies alone is unreliable, because people delete and block them, while fingerprinting is a working fallback that the world’s largest advertising company has turned a blind eye to. Expect more and more advertising and analytics services to combine both methods: cookies where they exist, fingerprints where they don’t.

“Sign in to continue”

The second trend is a shift from guessing to direct identification. Websites benefit when you log in or leave your email address: then no fingerprint is needed, because you identify yourself. Hence more and more “members only” articles, “subscribe for a discount” offers and loyalty programmes. The email address is then often turned into an encrypted tag and passed to advertising partners so they can recognise you on other sites.

It’s important to understand that no browser can protect you from this. The protection here is your decision about where to register and which email address to give. Separate addresses for newsletters help, as do services that create disposable alias addresses.

Trackers are getting smarter too

A primitive fingerprint that glues a dozen traits into one string breaks when the browser adds noise. So trackers are learning to link similar fingerprints to each other, even when they don’t match completely, using machine learning. Another growing area is behaviour: how you move the mouse, how fast you type, how you scroll the page. In banks’ fraud prevention, such information is already used to protect against account takeover. The danger is that the same techniques sooner or later find their way into advertising.

Browsers will protect more strongly

The good news is that browsers are moving in the opposite direction. Over 2025, Safari turned on fingerprinting protection in all windows by default, and Firefox released a new layer of protection and promised to eventually switch it on for everyone. Brave is continuing along its path. In a few years, fingerprinting protection will probably be as ordinary a feature as pop-up blocking is today.

But there is an important caveat: all of this applies only to people who use these browsers. Chrome users will still be left almost unprotected, and Chrome is the most popular browser in the world. So the gap will widen: some people will be nearly invisible to trackers, while others will be in plain sight.

The law may become more people-friendly

The EU is discussing moving the rules on cookies and device access into GDPR. If the package is adopted as proposed, three useful things will appear: rejection with one click, a ban on repeated persuasion after a refusal, and an obligation for websites to respect a “no consent” signal sent by the browser itself. The last one is especially important: you would only need to set up your browser once, rather than clicking “Reject” on every site.

But the negotiations are difficult, and the final text may differ significantly from the draft. It’s worth following, but not worth relying on.

Browsers with artificial intelligence

A separate new topic is browsers with a built-in AI assistant that opens pages, reads them and carries out tasks on its own. For privacy, this cuts both ways. On the one hand, such an assistant sees everything you see and even more, and the data often goes to the servers of the company that makes it. On the other hand, it becomes a target for fingerprinting and tracking itself on the websites where it acts on your behalf. The rules for such browsers are only taking shape, and they deserve even more careful consideration than ordinary ones.

What we will do

The fingerprint check on gdpru.eu is a first step. The next steps: teach our network request check (HAR) to find fingerprinting scripts on specific websites and show which traits were sent to third parties. Then you’ll be able not only to see what any website can see, but also to find out exactly who is using it, and where.

Checklist: what to do today

Ten minutes that will noticeably reduce what websites and apps learn about you:

1. Check your browser at gdpru.eu/fp-check and save the report as a PDF.
2. Choose a main browser with protection by default: Brave, Firefox, or Safari on Apple devices.
3. In Firefox, turn on strict mode: “Settings → Privacy & Security → Strict”.
4. In Brave, make sure Shields are on (the lion icon) and tick the box that prevents fingerprinting based on your languages: brave://settings/languages.
5. In Safari on iPhone, turn on advanced protection for all browsing: “Settings → Safari → Advanced”.
6. Switch off the advertising ID on your phone: on Android, “Settings → Google → Ads”; on iPhone, “Settings → Privacy & Security → Tracking”.
7. Check your browser again on our page and compare the “before” and “after” reports.
8. Open links from social media in your own browser, not the built-in one, especially if you need to enter a password or card details.
9. Set up a second browser for sensitive topics, such as Mullvad Browser or a Firefox private window.
10. Tell the people close to you. Protection by default works best when it’s installed for those who would never open the settings themselves.

A fingerprint can’t be deleted, but it can be made useless. You don’t need to understand the technology for that: it’s enough to choose the right browser and set it up once.

Sources

• Eckersley P. How Unique Is Your Web Browser? EFF, 2010 — PDF
• Laperdrix P. et al. Browser Fingerprinting: A Survey — arXiv
• Acar G. et al. The Web Never Forgets, 2014 — KU Leuven
• Englehardt S. A Retrospective Look at Canvas Fingerprinting — Princeton CITP
• Gómez-Boix A. et al. Hiding in the Crowd, 2018 — HAL
• Review of fingerprint uniqueness studies — arXiv
• Mozilla: Firefox expands fingerprint protections, 2025 — Mozilla blog
• Safari 26 and default fingerprinting protection — 9to5Mac, SecureMac
• ICO: response to Google’s fingerprinting policy change — ICO
• Google shuts down Privacy Sandbox — TechSpot
• The Digital Omnibus and cookie rules — Recording Law, Usercentrics
• TikTok’s in-app browser and code injection — Computing