Browser Fingerprinting 101: How anti-fraud engines track you even in Incognito mode
Disclosure: some links in this guide are affiliate links. If you sign up through them, I may earn a commission at no extra cost to you. How this site makes money.
Browser fingerprinting identifies a device from attributes it exposes to every website: user agent, screen, timezone, fonts, canvas and WebGL rendering, audio processing, and network signals such as TLS handshakes. Incognito mode clears cookies but changes none of these, so the same device stays recognisable across sessions and accounts.
Cookies are the tracking method people know about, so they're the one people clear. Fingerprinting is the method that survives clearing them. A website, or the fraud-detection script it loads, reads dozens of small facts about your browser and device. It combines them into an identifier that is often unique among millions of visitors, and it needs no storage on your machine at all.
This guide explains what gets collected and why incognito mode and VPNs don't help. It also covers the mistake that matters most for anyone running several business accounts: a fingerprint that contradicts itself.
What a fingerprint is made of
| Layer | Signals | Changes in incognito? |
|---|---|---|
| Browser headers | User agent, User-Agent Client Hints (platform, version), Accept-Language | No |
| Screen & hardware | Resolution, color depth, device pixel ratio, CPU cores (hardwareConcurrency), deviceMemory, touch support | No |
| Locale | Timezone, language list, date and number formatting | No |
| Rendering | Canvas hash, WebGL vendor/renderer (your GPU model), installed fonts | No |
| Audio | Tiny floating-point differences in how AudioContext processes a signal | No |
| Network | IP and ASN, WebRTC-exposed local/public IPs, TLS fingerprint (JA3/JA4), HTTP/2 settings | No |
| Behavior | Typing cadence, mouse movement, scroll patterns, time on page | No |
The rendering signals are the clever part. Ask a browser to draw the same text and shapes and the exact pixels differ slightly by GPU, driver, OS and font smoothing. Hash the result and you get a value that is stable for one machine and different on another.
Why incognito and VPNs don't hide you
Incognito starts with an empty cookie jar and discards history when you close it. That's all it does. Your GPU, fonts, screen and timezone are the same, so the fingerprint is the same.
A VPN changes one signal, the IP, and often makes it worse: commercial VPN exits are well-known hosting ranges shared by thousands of people. Now you have a flagged IP and a fingerprint that still matches the account you logged into yesterday from home.
Uniqueness vs. consistency
Privacy tools focus on uniqueness, that is, how rare your fingerprint is. Fraud systems at marketplaces, ad networks and payment processors care just as much about consistency: does this session look like one coherent, real device?
These are the contradictions that get flagged:
- An IP in Texas, a browser timezone of
Europe/London, and a Hebrew-first language list. - A user agent claiming macOS Safari, with Windows-only fonts and a DirectX WebGL renderer.
- A user agent version that doesn't match what the TLS handshake and Client Hints reveal.
- WebRTC leaking a home IP while HTTP traffic comes from a proxy.
- A canvas hash that changes on every page load. Real devices are stable, so random noise is itself a signal.
That last point surprises people. A fingerprint that never repeats is just as suspicious as one that is shared by ten accounts.
How anti-detect browsers work, and where they fail
Anti-detect browsers (GoLogin, AdsPower, Multilogin, Incogniton and others) are Chromium or Firefox builds that create separate profiles. Each profile has its own cookies, storage, proxy and a set of fingerprint values. Done well, profile A and profile B look like two different computers.
They fail in predictable ways:
- Mismatched presets: a profile set to a MacBook while the underlying machine is Windows. Some signals can't be convincingly faked.
- Stale browser cores: a profile claiming the latest Chrome while running an older engine.
- The human leak: logging into two "isolated" profiles with the same recovery email, phone or card.
Good practice: let the tool generate a profile that matches the real OS, keep the browser core updated, pair each profile with a static proxy whose location matches its timezone, and then don't touch the fingerprint settings again.
Separate profiles are a legitimate way to keep client accounts, team members and business units apart. They don't change a platform's terms. If a marketplace allows one account per seller, isolation doesn't make a second one permitted.
Test your own fingerprint in five minutes
- Cover Your Tracks (EFF) shows how unique your browser is among recent visitors.
- BrowserLeaks shows each layer separately: WebRTC, canvas, WebGL, fonts, TLS.
- CreepJS is aggressive at finding contradictions and spoofing. If it flags "lies", a fraud system can see them too.
- Compare the IP location from the leak test with the timezone and language the browser reports. They should tell the same story.
Repeat the test from each business profile, not just your personal browser. Profiles drift when a tool updates.
A consistency checklist for business profiles
| Check | Should match |
|---|---|
| Proxy IP location | Browser timezone, language, account address |
| User agent OS | Fonts, WebGL renderer, Client Hints platform |
| WebRTC | Disabled, or exposes only the proxy IP |
| Canvas / WebGL hash | Same value across sessions for that profile |
| Recovery email, phone, card | Unique to that profile's business entity |
Pair this with the right IP type from the proxy types guide. A perfect fingerprint behind a burned datacenter IP still fails.
Tools mentioned in this guide · affiliate links
Multilogin Antidetect
AdsPower Browser
Founder of StealthScale.io and e-commerce infrastructure engineer writing field-tested playbooks on proxies, cloud VPS, anti-detect browsers and SEO.