The cookie banner gives you a satisfying little moment of control. Reject, close, continue reading.
It is still worth making that choice. But the button cannot change everything a website can observe about the browser that arrived. Your browser has to describe some of its capabilities to do its job: how large a page should be, which features it supports, how text and graphics should appear. In combination, those details can become a way to recognize it.
That is browser fingerprinting. It does not require leaving a conventional tracking cookie behind, which is why clearing cookies and preventing fingerprinting are different tasks.
The distinction matters more than the familiar promise to “browse privately.” Privacy is not one switch. It is a collection of separate controls over separate ways of being recognized.
A description can become an identifier
A cookie can give a browser an assigned identifier. Fingerprinting works in the other direction: it tries to derive a recognizable description from observable characteristics.
Consider an imaginary room full of people. “Wears glasses” is not much of an identifier. Neither is “has a blue coat.” Add a few more details, however, and the description may fit only one person in that particular room.
Browser characteristics can work similarly. The important question is not whether any single detail sounds personal. It is how much the combination narrows the group.
This also explains a common misunderstanding: a fingerprint does not have to contain your name to be useful for tracking. Recognizing the same browser can be valuable even without knowing who sits behind it. Conversely, a browser that looks unusual in a test has not thereby been proven to have been tracked.
What the Firefox research actually measured
A study by researchers from Mozilla, the University of Toronto, and UC San Diego uses telemetry from almost 25 million Firefox release users to examine browser fingerprintability. Its modeled commercial fingerprinters found that the evaluated protections, shipped in Firefox 143, reduced the share of uniquely identifiable users from 75 percent to 46 percent.
Those figures describe the study’s population and models, not the percentage of internet users followed by advertisers. The researchers also found substantial differences across operating systems. A pooled result does not tell you exactly how much protection your own device gains.
Their analysis considers how large the groups sharing a fingerprint are, not only whether a browser is unique. Looking like a handful of others offers less ambiguity than blending into a large crowd. The practical lesson is to avoid turning a uniqueness result into a personal privacy grade. A browser that is distinguishable in a test has not necessarily been tracked; one that shares its result with others has not been certified anonymous.
Decide what you are trying to prevent
Consider three ordinary situations. You read an article without signing in. You return to a shop where you previously accepted cookies. You open a service while logged into your account.
Those visits do not present the same privacy problem. In the first, reducing identifying browser characteristics can make recognition harder. In the second, a stored identifier may already supply a connection between visits. In the third, the service can associate activity with the account you chose to use, regardless of whether the browser’s fingerprint stands out.
This is why an impressive result on one testing page is not a complete answer. Ask what the result actually demonstrates: fewer exposed characteristics, a blocked script, or a comparison with a particular sample of browsers? None of those is equivalent to proof that every site has lost the ability to recognize you.
A useful privacy routine starts with the connection you want to limit. It does not start with a promise that a single setting can erase all of them.
Two defenses, two different jobs
Mozilla’s explanation of Firefox’s protections describes two complementary approaches. One blocks known fingerprinting scripts. The other limits or alters some of the information a page can obtain, including details associated with fonts and graphics rendering.
The first is like refusing to answer a known collector’s questions. The second changes how distinctive the answers are when a question does get through.
Neither approach is magic. Lists cannot identify everything in advance. Changing browser behavior can also affect legitimate websites, since the same capabilities used for fingerprinting have ordinary uses. Mozilla documents possible compatibility problems and site-specific exceptions for that reason.
The design challenge is to make protection useful enough that people leave it enabled. A defense that routinely breaks the thing someone came to do may be switched off long before it helps them.
A better routine than chasing a perfect score
Start with the browser you actually use. Keep it updated and review its built-in tracking and fingerprinting controls through its current documentation. Check which protections apply in ordinary windows, not just in a private window; names and defaults vary by browser and version.
In Firefox, those controls live under Settings → Privacy & Security → Enhanced Tracking Protection. Mozilla’s documentation explains the available levels and the distinction between known and suspected fingerprinters. If a necessary site breaks after a change, investigate that site’s exception rather than immediately disabling protections everywhere.
Continue rejecting unnecessary cookies. That choice still addresses a real mechanism even though it does not address every mechanism. Be equally clear about what it cannot do: it cannot make an account login anonymous, and it cannot instruct every website to stop observing all browser characteristics.
Be cautious about treating a long list of obscure configuration tweaks as an automatic upgrade. A more complicated setup is harder to diagnose, and a promising result on one testing page is not proof of a better experience across the web. Prefer documented controls whose purpose and trade-offs you understand.
The useful goal is less exposure, not a theatrical promise of invisibility. Rejecting a cookie is one step. Reducing the details that can distinguish your browser is another. Knowing the difference makes both choices more meaningful.