Explore checkers, demos and evaluation routes →
Summarize this page with
Browser fingerprinting can derive evidence without reading an existing cookie, but “without cookies” does not describe every part of a recognition system. A product may combine fingerprint observations, stored state, server evidence and prior history. Evaluate the actual implementation rather than assuming cookie removal guarantees either anonymity or recognition.
The practical question is whether a returning browser is matched correctly when one condition changes. That requires known labels, repeated observations and a record of collection availability.
- 1Separate stored state
- 2Repeat permitted visits
- 3Change one condition
- 4Inspect recognition
Separate what changed
| Test condition | Keep separate in the record | Question to answer |
|---|---|---|
| Storage cleared | Previously stored state and current observations | Can the system recognize the permitted repeat visit? |
| Private session | Available observations and isolation behavior | What result is returned on this browser configuration? |
| Network changed | Current connection and browser evidence | Does normal movement cause an unnecessary split? |
| Browser upgraded | Component changes and final identity | Does matching remain useful after ordinary updates? |
Change one condition at a time before testing combinations. Otherwise an incorrect result can be difficult to attribute to collection, matching or the application’s event association.
Avoid translating browsers directly into people
A shared workstation may legitimately connect several accounts. One person can also use separate browser environments. Keep those facts visible when evaluating recognition and account abuse. An identity relationship can support investigation without proving that a policy was violated.
ShieldLabs combines returning-visitor recognition with device/network intelligence and ready-made account-abuse events. Thumbmark distinguishes its local fingerprint from a hosted Visitor ID. Those are product-specific designs that need evaluation on your traffic, not interchangeable guarantees.
Keep privacy mode and missing collection distinct
An unavailable observation may reflect browser configuration, blocking or an integration failure. Record it separately from a completed result. The integration guide describes the failure contract and trusted result association.
Also record which identifier changed. A local component hash, a device identifier and an application account can have different lifetimes. Comparing only one displayed string can miss a correct re-link or hide an incorrect merge.
Review privacy obligations by implementation
The absence of a cookie is not a general exemption from device-access or personal-data rules. The ICO guidance explicitly discusses fingerprinting within storage and access technologies. The exact legal assessment depends on purpose, jurisdiction and how the implementation operates.
Document collection purpose, retention, access and deletion paths with the people responsible for privacy review. Avoid turning a marketing phrase such as “cookieless” into an unsupported compliance claim.
FAQ
Does clearing cookies guarantee a new fingerprint?
No. Stored state and observed browser characteristics are different. The resulting match depends on the implementation and available evidence.
Does private browsing guarantee recognition fails?
No universal outcome follows from the mode name. Test the supported browser configurations and record collection and matching separately.
Is cookieless fingerprinting automatically exempt from privacy rules?
No. Device access and personal-data obligations can apply. Review the actual purpose, jurisdiction and implementation rather than relying on the label.
Sources
Checked October 22, 2026: ICO storage and access guidance, ShieldLabs identification, Thumbmark. Related: matching errors.
Continue reading
- What is a browser fingerprint? From browser observations to a returning visitor
- Browser fingerprinting techniques: compare rendering, environment and network evidence
- Audio fingerprinting in browsers: what the signal can and cannot tell you
Compare all ten tools or read the complete deployment guide.