Reviewed 20 August 2026.
Private browsing reduces the traces a browser leaves on a device after a session, but it does not make your browser invisible to websites or network observers. Sites can combine ordinary request data and values revealed by web code into a fingerprint that may help them distinguish or probabilistically recognise a returning browser or device.
What is browser fingerprinting?
Browser fingerprinting is the combination of observable browser, device, or configuration characteristics to identify or re-identify a user agent or device. The W3C Privacy Working Group explains the distinction between passive request signals and active collection using code on the device, and it recommends mitigation approaches for web specifications. W3C Privacy Working Group, Mitigating Browser Fingerprinting in Web Specifications.
Developer documentation and glossaries list typical signals that can be included in a fingerprint, including request headers, browser version, time zone, language, display size, installed fonts, supported codecs, and rendering differences from canvas or WebGL. These sources emphasise that a fingerprint is a probabilistic signal, not proof of a person’s legal identity. MDN Web Docs, Fingerprinting.
How a fingerprint is created and used
1. Passive request signals
When a page loads, the browser sends network and protocol data that a destination can observe without running scripts. This includes the IP address and standard HTTP request headers. A site can use these passive signals as part of a broader recognition effort. W3C guidance on passive and active signals.
2. Active measurement via page code
Pages may also run JavaScript, query web APIs, or render graphics to measure differences in output. Canvas rendering, font lists, WebGL outputs, audio processing characteristics, and other measured values can each contribute a signal; browsers may limit or perturb some of these values as a defence. MDN Web Docs, Fingerprinting.
3. Combining and comparing signals
An operator can combine multiple signals into a fingerprint and compare it with previously observed patterns to estimate whether the same browser or device has returned. Recognition is probabilistic and its reliability depends on signal stability, browser protections, and the operator’s data holdings. Deleting cookies does not necessarily change the underlying characteristics used in a fingerprint. W3C Privacy Working Group guidance and MDN.
Why private browsing does not stop fingerprinting
Private browsing modes primarily change what the browser retains locally after the session. For example, Google documents that Chrome Incognito temporarily keeps cookies and site data during a session and removes them when the session ends; it also notes that visited sites and network operators can still observe activity. Google Chrome Help, Browse in Incognito mode.
Closing a private window does not change the browser version, operating system, display settings, language, or many other attributes that contribute to a fingerprint. Some browsers add fingerprinting defences in private windows, but private mode’s defining purpose is to limit local traces rather than to provide anonymity against remote observers. Mozilla Support, Firefox protection against fingerprinting.
Quick comparison of common options
| Option | Local history after the session | IP seen by the destination | Fingerprint exposure | Primary use |
|---|---|---|---|---|
| Ordinary browsing | Usually retained until cleared | Normal connection IP | Depends on browser protections | Everyday browsing and persistent sessions |
| Private browsing | Generally not retained after all private windows close | Normal connection IP | Still possible; defences vary by browser | Reduce local traces and separate temporary sessions |
| VPN connection | Controlled by the browser mode | VPN server IP | Browser and device signals can remain visible | Change the destination-visible network address |
| Browser anti-fingerprinting controls | Controlled by browser mode and settings | Normal connection IP unless another network tool is used | Signals may be blocked, limited, standardised, or perturbed | Reduce fingerprint distinctiveness |
| Tor Browser | Designed around privacy-preserving sessions | Tor exit IP | Many signals standardised or restricted; risk reduced but not eliminated | Combine network anonymity and browser standardisation |
The table describes typical functions rather than guarantees. Tor Browser intentionally standardises many values to make users appear less distinct; see the Tor Project documentation for details. Tor Project Support, How Tor Browser protects you against browser fingerprinting.
A threat-model worksheet before changing settings
Choose protections for the specific observer and consequence rather than relying on a single general promise of privacy. Work through these four questions and record answers before changing settings.
- Who are you trying to limit? Another user of the same computer, a website or advertising network, your internet provider, an employer, or a more capable adversary observe different signals.
- What must be separated? Decide whether the goal is to avoid local history, reduce cross-site profiling, conceal a home IP address, or keep multiple identities unlinkable.
- What can identify you directly? Signing in, providing an email, paying with a linked account, or revealing personal details can identify you regardless of fingerprint protections.
- What breaks if protection is strict? Script blocking, disabled APIs, or standardised settings can affect logins, media playback, payments, and accessibility. Plan a fallback for sites you must use.
People facing stalking, domestic abuse, workplace monitoring, state surveillance, or legal jeopardy should not rely on this general guide as individual operational-security advice. No single private window, browser setting, extension, search engine, VPN, or network tool guarantees anonymity.
Practical steps that can reduce fingerprinting exposure
Start with documented browser protections
Enable the privacy and anti-fingerprinting features your browser documents before adding third-party tools. Mozilla documents protections that block known fingerprinters and limit some exposed signals in Firefox. Mozilla Support, Firefox protection against fingerprinting. Apple documents simplified system configuration and tracking protections in Safari. Apple Safari User Guide, Prevent cross-site tracking in Safari. Follow the vendor documentation for your chosen browser and platform.
Keep software updated
Install official updates for the browser and operating system so you receive security fixes and any improved privacy protections.
Limit and vet extensions
Only install extensions you trust and need. Extensions add code and permissions that can increase configuration distinctiveness or introduce security risks.
Avoid unusual customisation on browsers that standardise values
Anti-fingerprinting works by grouping users into larger cohorts with similar reported values. Unusual overrides or rare combinations of settings can make a browser more distinctive. Tor Browser limits user-selectable spoofing options for this reason. Tor Project Support.
Use script controls selectively
Blocking unnecessary scripts can reduce active fingerprint collection but may break essential site functionality. Prefer per-site controls and test important services after tightening controls. Mozilla Support notes that stricter protections can affect site behaviour.
Understand what a VPN does and does not hide
A VPN can replace the IP address visible to a destination with the VPN server’s IP, but it does not change browser or device attributes that contribute to a fingerprint. A VPN also requires trusting the VPN operator with your network traffic. Treat a VPN as a network-layer tool for the specific goal of changing the destination-visible IP address.
Legitimate uses and legal context
Fingerprinting has legitimate uses such as fraud detection and account security where device signals are one risk signal among many. The UK Information Commissioner’s Office gives an example where hardware, browser, location, and IP information are used to detect potentially fraudulent activity and explains how PECR and data-protection law can apply. UK ICO guidance on storage and access technologies.
Regulatory treatment varies by jurisdiction and purpose. For example, French guidance explains consent considerations for advertising operations that use terminal information. Organisations planning fingerprinting should document purpose and data flows, provide required transparency and controls, and obtain qualified legal advice. CNIL, Alternatives to third-party cookies.
Frequently asked questions
Does private browsing prevent browser fingerprinting?
No. Private browsing mainly controls what the browser stores locally; it does not make the browser invisible to visited sites or network operators. Google documents that Incognito removes temporary session data when the session ends but does not hide activity from sites or network observers. Google Chrome Help.
Can a fingerprint identify me personally?
A fingerprint can help an operator recognise a returning browser or device, but it is not guaranteed to uniquely identify a specific person. Identification depends on the signals collected and how they are combined with other data, such as account sign-ins. W3C guidance and MDN.
Is fingerprinting legal?
There is no single global answer. Legal requirements depend on jurisdiction, purpose, data type, and technical implementation. The UK ICO and CNIL provide jurisdiction-specific guidance and examples; organisations should obtain qualified legal advice for their country and use case. UK ICO, CNIL.
Conclusion
Private browsing reduces local traces but does not make you invisible to websites or network observers. To reduce fingerprinting exposure, enable documented browser protections, keep software updated, limit extensions, avoid unusual customisation, and use script or site-specific controls carefully. Treat a VPN as a network tool, not an anonymity guarantee. Choose protections for a defined observer and risk, and review vendor and regulator documentation as protections evolve.
For questions about this article, contact contact@gacalo.com. Gacalo, Somalia.
[…] Check the Numbers […]