Browser fingerprinting scene showing a laptop and mobile devices with biometric, audio, graphics, and data signals representing online tracking without cookies.

Browser Fingerprinting: How Websites Identify You Without Cookies

By Geoffrey Wenger Published August 25, 2026

Category: Cybersecurity

Tags: Browser Security Data Harvesting Data Privacy Digital Footprint Online privacy Tracking

Most people know cookies can follow them around the web, but blocking them does not make a browser invisible. Modern websites can combine details about hardware, software, graphics, audio, timing, and behavior into a browser fingerprint that may help distinguish one device from another. A recent AliExpress discovery made that process unusually visible, showing how sophisticated tracking can happen quietly during an ordinary website visit without obvious warnings or traditional tracking cookies.

AliExpress Exposed a Bigger Privacy Risk

The story started with something that seemed more annoying than alarming. Researcher Matthew Callaghan noticed that his multipoint Bluetooth headphones behaved strangely whenever he visited AliExpress. Audio playing from his phone would stop shortly after the AliExpress homepage loaded, almost as if his computer had taken control of the headphones. Yet nothing on the webpage seemed to be playing. Closing the AliExpress tab brought the phone audio back, while simply muting the tab, Firefox, or Windows did not solve the problem.

That odd hardware glitch eventually pointed to something much bigger. According to an Ars Technica investigation, heavily obfuscated scripts running on AliExpress were creating Web Audio processing graphs inside the browser. The code generated a known waveform, analyzed how the browser processed it, and routed the result through a gain node set to zero. The browser was doing audio work, but the person sitting in front of the computer heard nothing.

Callaghan’s investigation also uncovered code gathering a wide range of browser and device details. Those measurements included Canvas and WebGL information, screen and viewport dimensions, device memory, processor concurrency, supported media formats, WebRTC behavior, browser performance timing, mouse and touch activity, device motion, and properties commonly associated with automated browsers.

The browser-side evidence shows that a large collection of fingerprinting-related measurements was gathered and sent back to AliExpress. What the public investigation does not prove is exactly how Alibaba used, stored, combined, or retained that information after it reached its servers. It could have supported fingerprinting, fraud detection, bot detection, analytics, or several purposes at once.

That distinction matters. The real privacy story is not simply that a shopping site generated silent audio. It is how much information an ordinary browser can reveal in the background.

How Browser Fingerprinting Works

A browser fingerprint is built from characteristics a website can observe while your browser loads and uses a page. Many of those details exist for completely normal reasons. A website needs information about your display so text, menus, and images appear correctly. Streaming services need to know which audio and video formats your browser supports. Games and design tools may need access to graphics capabilities, while other sites measure performance or input methods so their pages work properly.

The privacy concern begins when many of those ordinary details are collected together. Mozilla describes browser fingerprinting as a tracking method that can build an identifier from characteristics of a person’s browser and computing environment. One detail may tell a website almost nothing. A large collection can be much more useful.

Some of the signals a website may be able to examine include:

Screen resolution, browser-window size, and device pixel ratio.
Browser version, operating system, language, and time zone.
Graphics hardware, WebGL capabilities, and Canvas rendering.
Processor concurrency and available device memory.
Supported audio and video formats.
Browser plugins and other exposed software characteristics.
WebRTC and certain networking behaviors.
Web Audio processing results.
Performance and timing measurements.
Mouse, touch, scrolling, motion, and orientation information.

Take screen resolution as an example. Millions of people may use the exact same resolution. The same goes for a browser version or processor configuration. Those facts are not very useful on their own.

Start combining dozens of small details, though, and the number of browsers that look exactly alike may shrink. That is what makes fingerprinting useful. It does not always need one obvious identifier if the overall collection of characteristics is distinctive enough.

Why Blocking Cookies Is Not Enough

Cookies and browser fingerprints can both help websites recognize visitors, but they work in very different ways. A cookie is closer to a numbered ticket. A website stores that ticket in your browser, and the browser can present it again during a later visit. Delete the cookie and that particular stored identifier disappears.

Fingerprinting relies more on observation. Imagine walking into a store where nobody hands you a ticket. Instead, someone notices your height, shoes, watch, backpack, accent, car, and clothing. One of those details may describe millions of people. The combination may describe far fewer.

WebKit’s Tracking Prevention Policy describes fingerprinting as a form of stateless tracking because it can rely on characteristics of a user’s behavior, device, browser, configuration, location, or network connection instead of depending entirely on traditional client-side storage.

That is why clearing cookies cannot erase every tracking signal a site may have already observed.

A browser fingerprint is not necessarily permanent, either. Updating your browser, changing hardware, switching networks, altering settings, or using different privacy protections can change some of the information a site sees. Fingerprinting also does not automatically reveal your name or real-world identity.

The bigger concern is recognition. A distinctive browser may be easier to recognize across visits, and that fingerprint may become more useful if it is later associated with an account, purchase, login, or other identifying information.

Blocking cookies is still worth doing. It simply does not cover the entire tracking picture.

Silent Audio Made Tracking Visible

The Web Audio part of the AliExpress story drew so much attention because it created a physical side effect that a user could actually notice. The scripts generated a waveform and examined the resulting audio data, but the gain was set to zero, so Callaghan heard nothing. Even so, the audio graph remained connected to the system’s audio destination, which was enough to interfere with his multipoint headphones.

Audio fingerprinting itself is not new. In the past, websites could sometimes use small differences in the way operating systems, browsers, processors, mathematical libraries, and audio implementations processed the same signal. Give several computers the same audio task, compare the outputs, and tiny differences could become one more clue in a larger browser fingerprint.

Modern browsers have reduced the value of that technique. Firefox 118, released in September 2023, changed Web Audio processing so Firefox uses the same FDLIBM math library across systems. Mozilla documented the change in its official Firefox 118 release notes and specifically said it was intended to improve anonymity with Fingerprint Protection.

The reporting also notes that the Alibaba audio test produced only a small number of common results for nearly all Firefox users in Mozilla’s data. That makes this particular signal much less useful for separating one Firefox user from another than similar techniques once were. Chrome also ships with its own relevant libraries, which reduces the operating-system differences that made older audio fingerprinting methods more valuable.

Safari takes a different approach in some cases by adding controlled noise to fingerprintable data.

So this was not a hidden sound capable of uniquely identifying every computer. The audio technique mattered because it exposed activity that most users would never have noticed. Once the code was examined more closely, the larger collection of browser measurements became the bigger story.

Private Browsing Still Leaves Clues

Private Browsing and Incognito modes are useful, but people often expect them to do more than they were designed to do. Their traditional purpose is mainly to reduce what remains on your own computer after the private session ends. Depending on the browser, that may include browsing history, cookies, site data, cached files, and information entered into forms.

That can be helpful on a shared computer or anytime you do not want ordinary local browsing history hanging around. It does not make your computer disappear from the websites you visit. A private window still has to run JavaScript, render graphics, process media, communicate over the internet, and expose enough browser information for sites to function.

Browser makers have added stronger privacy protections over time. Safari, for example, documents advanced fingerprinting protections that can add small amounts of noise to Canvas, WebGL, and Web Audio results. Safari can also reduce the precision of other information that might otherwise help distinguish one browser from another.

Firefox has its own anti-fingerprinting protections as part of its broader tracking defenses. These features can reduce the amount or quality of identifying information that websites receive.

Even with those protections, private browsing should not be confused with anonymity. A website may still see your network connection and some browser characteristics. If you sign into an account, the service obviously knows which account is being used.

Private mode still has real value. It just solves a different set of privacy problems than many people assume.

Privacy Tweaks Can Make You Stand Out

Browser fingerprinting creates one of the stranger problems in online privacy: trying too hard to look private can sometimes make your browser look unusual. If millions of people use similar browsers with similar settings, each person blends into a very large group. That makes it harder for a tracker to separate one browser from the rest.

Now picture a browser with dozens of advanced settings changed, several uncommon extensions installed, certain APIs disabled, a spoofed user-agent string, unusual font behavior, and a collection of other custom changes. Some of those choices may block individual tracking methods. At the same time, the full configuration may be shared by very few other people.

The Electronic Frontier Foundation explains this issue in its browser fingerprinting resources. A privacy modification can itself become another identifying clue if it causes your browser to behave differently from most others.

This is why strong anti-fingerprinting systems do not simply tell users to change every value at random. Browser makers may standardize certain information, lower its precision, block access to high-value data, limit known fingerprinting scripts, or introduce carefully controlled variations.

The goal is not to make your browser strange. Ideally, the goal is to make you harder to separate from a larger crowd while keeping normal websites working properly.

For most people, a current browser with well-designed privacy protections is a better choice than a long list of obscure experimental tweaks pulled from random posts online.

Practical Ways to Reduce Fingerprinting

Completely stopping browser fingerprinting is difficult because websites need some information about your device to function. A page cannot adapt to your screen, process video, or render graphics without learning at least a few things about the environment it is running in. The better goal is to reduce unnecessary tracking without making the web frustrating to use.

A handful of steps provide the most practical benefit:

Keep your browser updated. Browser vendors regularly change APIs and internal behavior to close privacy gaps and reduce fingerprinting opportunities. The Web Audio changes involved in this story are a good example of why current browser versions matter.
Use built-in tracking protection. Firefox, Safari, Brave, and other browsers provide different levels of tracker and fingerprinting defense. Mozilla explains its current Firefox tracking protections and the controls available to users.
Keep blocking unwanted third-party cookies. Fingerprinting does not make cookie controls pointless. Trackers can combine several methods, so removing one reliable source of identification still helps.
Review website permissions. Microphone, camera, location, motion, and notification access should generally be allowed only when a website actually needs it.
Avoid unnecessary extensions. Extensions can improve privacy and security, but each one adds code and may change how your browser behaves. Choose reputable extensions that have a clear purpose.
Know what a VPN actually does. A VPN can hide your normal public IP address from the destination website, but it does not automatically conceal screen size, graphics behavior, browser features, Web Audio output, or many other fingerprinting signals.

None of these steps is a magic switch. Together, though, they reduce several common ways websites and third parties can collect persistent tracking information.

JENI® and Browser Data Cleanup

Browser fingerprinting is a good example of why privacy tools and maintenance tools should not be treated as interchangeable. JENI® is an on-demand computer maintenance and optimization tool, not an anti-fingerprinting browser. Its job includes cleaning supported browser-related buildup such as caches, temporary files, logs, and other accumulated data while also performing broader computer maintenance.

That cleanup can be useful for routine privacy and computer housekeeping, but deleting stored browser data does not stop every form of fingerprinting. A website can gather fingerprinting signals while the page is open because it is observing characteristics exposed by the browser at that moment. Cleaning temporary files afterward cannot change every hardware, graphics, browser, or system characteristic the site may already have seen.

The better approach is to use each tool for the job it was designed to do. JENI® can handle supported local cleanup and maintenance, while your browser’s privacy controls, tracker protections, permission settings, and security updates help reduce exposure while you are actively browsing.

Using both approaches makes more sense than expecting one privacy or maintenance tool to solve every problem.

Browser Fingerprinting FAQ

Can websites fingerprint me without cookies?

Yes. Browser fingerprinting can combine observable details about your browser, device, hardware, software, graphics environment, network connection, and behavior without relying entirely on a stored cookie. Blocking cookies is still useful, but it does not stop every method that might help a website distinguish your browser from others.

Was AliExpress listening through microphones?

There is no evidence in the published investigation that AliExpress was secretly turning on users’ microphones or recording conversations. The discovered scripts generated and analyzed Web Audio data inside the browser with audible output set to zero while also collecting many other fingerprinting-related measurements.

Can a browser fingerprint reveal my name?

Usually not by itself. A fingerprint is generally used to distinguish a browser or device environment, but it may become more revealing if a service can connect it with an account, purchase, login, or other information that identifies the person using that browser.

Does a VPN stop browser fingerprinting?

No. A VPN can change the IP address visible to websites and hide your normal public IP address from them, but it does not automatically conceal screen dimensions, graphics behavior, browser capabilities, processor information, Web Audio results, or many other characteristics that can contribute to a fingerprint.

Does Incognito mode stop fingerprinting?

Not completely. Private or Incognito browsing can reduce locally stored history and may enable additional tracking protections, depending on the browser, but websites can still observe some of the information your browser must provide to communicate with them and display their content.

Tracking Has Moved Beyond Cookies

One of the most interesting parts of the AliExpress discovery is how ordinary the warning sign was. There was no malware alert, dramatic browser warning, strange pop-up, or antivirus notification. A pair of Bluetooth headphones simply stopped behaving the way their owner expected, and that small clue eventually led to silent audio processing and a much wider collection of browser and device measurements.

The specific Web Audio technique involved appears to have limited value for distinguishing users in several modern browsers. That does not make the incident unimportant. If anything, it makes the larger point easier to see. Websites can collect many types of information that most visitors never notice, and the usefulness of a fingerprint often comes from combining signals rather than depending on one unusual trick.

Some of those signals have legitimate uses. Fraud-prevention systems need ways to spot suspicious activity. Websites try to identify bots, stop automated abuse, measure performance, and determine whether software is working correctly. The privacy concern grows when large collections of browser data are gathered with little visibility for the person using the computer, especially when it is unclear how that information may be stored or combined later.

If you are curious about what your own browser may reveal, the Electronic Frontier Foundation’s Cover Your Tracks project offers a useful demonstration of browser tracking protections and fingerprint characteristics. No single test can tell you whether you are completely protected, and results can vary, but it helps show why online privacy cannot be reduced to one setting or one piece of software.

The practical lesson from the AliExpress discovery is not to panic about silent audio. It is to recognize that online tracking has changed. Keep your browser current, use its built-in privacy controls, limit unnecessary permissions, continue blocking unwanted cookies and trackers, and be selective about extensions. Private Browsing and VPNs can help too, as long as you understand what they actually protect.

Cookies are still part of the privacy picture. They are just no longer the whole picture.