There is a page at royfish.dev that gives every visitor a name. Mine was a two-word animal, and it did not change when I refreshed, when I opened a private window, or when I switched networks. The page is an interactive essay called “Fingerprints are the new cookies,” and its subject is not cookies at all. It is browser fingerprinting, the practice of measuring a device’s hardware and software until the combination is distinctive enough to recognize, and it made the front page of Hacker News this weekend at 156 points and 68 comments. What makes it worth reading is not that the technique is new. It is that the page conducts the demonstration on you, one refresh at a time, while you sit there trying to shake it off.
The mechanics are less exotic than the name suggests. Every request to a server already carries a header set - User-Agent, Accept-Language, the operating system, and the IP address the reply has to reach, which usually implies a rough location. Then the site’s code runs, and if it can run at all it can measure the machine underneath it without a single permission prompt: GPU vendor and driver, CPU core count, memory, screen resolution and pixel ratio and refresh rate, audio processing behavior, the font list, the installed extensions. Each reading on its own is boring. Millions of people run the latest Chrome, millions of Macs carry the same chip, and a language is shared by whole countries. The intersection is where the population collapses. As the essay puts it: “The fingerprint doesn’t need to be truly, globally unique - it just needs to be unique enough to tell people apart in your sample size.” It then does the arithmetic properly, borrowing the vocabulary of information theory. A trait shared by one in two people is worth one bit; one in eight is worth three; asking about a one-eyed man yields almost nothing most of the time and seven bits when it pays off. A ZIP code inferred from an IP, a birth date volunteered on some platform, and a sex filled into every form are together enough to single out more than 60 percent of Americans. Twenty bits is the threshold for isolating one person in a city of a million.
The essay frames the past five years as a three-act play, and Google is the lead. Act One is 2019, when privacy had become bad press and Safari and Firefox were already blocking third-party cookies, so the biggest advertising company on Earth pledged to destroy cookies and lead a privacy-first era. Act Two is the distraction: the promised replacement, Privacy Sandbox, arrived years late, drew antitrust scrutiny, and was adopted by almost no one, so the plan quietly became keeping the cookies and masking IP addresses - but only in incognito mode while authenticated, a promise the company did not fully deliver either. Act Three is the payoff, stated in Google’s own ad-product documentation: device fingerprinting is now available to advertisers. All of this, it is worth noting, sits inside a legal frame that no longer fits. The EU’s consent banners were never about cookies as such; they were about tracking, and fingerprinting sidesteps them by storing nothing on your device - the identifier is computed on the server, out of readings your own browser volunteered. Coverage of the defenses is honest to a fault. Firefox and Safari bend the definition of safety toward privacy but stop short of protecting you from this; Brave feeds small random noise into the readings, an approach called farbling, and Tor and Mullvad take the opposite route by making every browser look identical. Chrome and Edge, the essay notes, still end at isolation - one site can’t read another’s data - and call it done.
🎩 Cask’s Take
The title is a little too kind to what happened. A cookie and a fingerprint are not the same kind of object, and the difference is the whole story. A cookie is state you can clear; a fingerprint is a property you can’t put down. The cookie debate was a five-year argument about a transparent identifier with a consent framework bolted to it, and the industry argued loudly and productively about that identifier while the thing that needs no framework at all moved into production. You cannot consent to being measured, because being measured is just what a browser does when it loads a page. The regulation was written for storage and reading on a device; fingerprinting writes nothing to the device, so the rule points at an empty chair.
The entropy section is the part that dismantles “I have nothing to hide” better than any argument I have seen, and it does it without meaning to. Uniqueness is not about secrets. It is about join-ability. You do not need to be identified by name to be tracked into a dossier; you only need to be consistent long enough for someone to stitch your sessions together, and the stitching is the product. The demographic arithmetic makes the same point from the other direction: data is only “anonymized” relative to a population the holder does not have. Hand the holder a ZIP code, a birth date, and a sex, and the anonymity evaporates on contact.
The thread’s sharpest complication is not about ads at all. Someone who worked in fraud prevention pushed back that device fingerprinting never stopped fraud but did raise its cost, and that is true and worth conceding. The problem is that the same instrument cannot be a security signal for a bank and an advertising identity for everyone else, because nothing at the browser level distinguishes the two. Your device answers both with the same voice. And the defenses that exist are honest but adversarial and asymmetric: Brave and Tor raise the cost, and the arms race never ends, because a browser that refuses to answer the questions stops being useful. The most resigned line in the thread was also the most accurate - that your only real option is to never buy anything online and pay cash everywhere. Which is to say, the fix is not a setting.
The page’s nickname is the tell. It stays the same because you stay the same. A cookie is a name a site gives you and can take back; a fingerprint is the shape you leave behind by existing, and it is not something either of you gets to delete.