IP vs cookies vs fingerprinting
Four ways you get recognized, ranked by how well they actually work. The address comes last.
Why the ranking matters
Almost every guide to online privacy leads with your IP address, and almost every one that does is selling something that changes it. The ordering below is the reason that framing is misleading: an address is the least durable and least specific of the four ways you get recognized.
1. Your IP address
What it is: the return address on your connection.
Why it is weak as an identifier: three separate reasons, each enough on its own.
- It is shared. Everyone behind your router uses the same one. On carrier-grade NAT it can be thousands of strangers.
- It changes without being asked. A lease lapse, a reboot, a walk down the street with a phone.
- It is coarse. It resolves to a provider and a rough area, not a person.
What it is genuinely used for: regional targeting, fraud signals, rate limiting, and routing. All real, none of it a profile of you.
2. Cookies
What it is: a small value a site asks your browser to store and hand back on every subsequent visit. If the value is unique to you, the site recognizes you exactly.
A first-party cookie belongs to the site you are on and is mostly how staying logged in works. A third-party cookie belongs to something embedded in the page, and because the same ad network is embedded in thousands of sites, it can recognize the same browser across all of them. That is the mechanism people mean when they say they are being followed around the internet.
The good news: this is the one you can actually do something about. Clearing cookies works. Blocking third-party cookies works. Every major browser now restricts them by default to some degree, which is precisely why the tracking industry moved toward the next item.
The cookie is stored on your device and sent regardless of which network you are on. Connect through a VPN and the site sees a new address attached to the same cookie it set last week, which tells it more than the address alone ever did.
3. Browser fingerprinting
What it is: recognizing your browser by its characteristics rather than by anything stored on it. Nothing is saved to your device, so there is nothing to clear.
The uncomfortable property is that hardening against it can make you more identifiable, not less. A browser with unusual privacy settings, rare fonts and a blocked canvas is a distinctive browser. This is why the serious anti-fingerprinting approach is to look like everyone else rather than to look like nobody, which is the design Tor Browser follows.
What helps: using a mainstream browser in a mainstream configuration, or one that actively randomizes or standardizes these signals. Changing your address helps not at all, because none of the inputs come from your connection.
4. Being logged in
What it is: you told them who you are.
This is the one that makes the other three academic, and it gets the least attention because it does not feel like tracking. If you are signed into an account, no inference is required: the address, the cookie and the fingerprint are corroboration rather than identification.
It also links across devices in a way nothing else can. A phone and a laptop share no address, no cookie and no fingerprint, and one login joins them permanently.
So what should you actually do?
It depends entirely on which of two different worries you have, and they call for nearly opposite responses.
| If your concern is | The thing that helps | The thing that does not |
|---|---|---|
| Advertisers profiling you across sites | Block third-party cookies, use a blocker, review account settings, sign out | Changing your IP address |
| A specific person knowing your rough area | A VPN or Tor, and not sharing an address in peer-to-peer chat | Clearing cookies |
| Your provider seeing which sites you visit | A VPN or Tor, which moves that view rather than removing it | Incognito mode, which changes nothing on the network |
| A site knowing it is you specifically | Not signing in, and a separate browser profile | Almost everything else, if you are signed in |
The general shape: tracking concerns are browser problems, and location concerns are network problems. Most advice conflates them, which is how people end up paying monthly for a tool that does not address what was actually bothering them.