I found out I was being tracked in a way I didn’t understand during a conversation with someone who worked in digital advertising.

We were talking about targeting how ads find specific people across different websites and I made some comment about how I always used incognito mode when I didn’t want to be tracked. He looked at me the way someone looks at a person who has said something confidently incorrect, which is a specific look that I’ve learned to recognize as the prelude to learning something I wish I’d known earlier.

“Incognito doesn’t really do what you think it does,” he said. Not unkindly. Just as a fact.

I told him I knew that it didn’t save history locally. That wasn’t what I meant. I meant that websites couldn’t track me across sessions without cookies. He smiled again with that same expression and said, “That’s also not quite right.”

What followed was a forty-five minute conversation that made me feel simultaneously more informed and more unsettled than I had been before I sat down. I’ve been thinking about it ever since, and what I want to do here is share what I actually learned — not the technical version that requires a computer science degree to follow, but the version that made it land for me as a regular person who uses the internet and assumed, incorrectly, that I understood the basics of how I was being seen online.

The starting point is a concept called browser fingerprinting, and once you understand it, the internet feels slightly different. Not necessarily worse. Just more legible.

When you visit a website, your browser sends information. This is unavoidable it has to, in order to display the page correctly. Your browser needs to communicate things like what kind of browser it is, what operating system you’re running, what screen resolution you have, what language your system is set to, what fonts are installed on your device, what plugins you’re running, what your time zone is. All of this information gets sent as part of the normal process of loading a webpage.

None of this sounds alarming on its own. Knowing your screen resolution isn’t knowing your name. Knowing your timezone doesn’t tell a website who you are. But here’s what took me a while to fully absorb: the combination of these individual pieces of information, taken together, creates something that is in practice nearly unique to you specifically.

Think about it this way. Lots of people have 1920 by 1080 screen resolution. Lots of people use Chrome. Lots of people have their system set to English. Lots of people are in the Eastern time zone. But the specific combination of your resolution, your exact browser version, your specific operating system, your installed fonts, your graphics card settings, your timezone, your language preferences, and about two hundred other data points — that combination is, statistically, likely to belong to you and almost nobody else.

It’s like a fingerprint. Not a fingerprint in the literal sense, but in the functional sense: a unique identifier that follows you across the internet regardless of whether you’ve accepted any cookies, regardless of whether you’re in incognito mode, regardless of whether you’ve cleared your browser history, regardless of whether you’re using a VPN that changes your visible IP address.

I remember sitting with that for a moment in the original conversation. I’d been operating under the assumption that clearing cookies and occasionally using a VPN was roughly equivalent to being a clean slate to the websites I visited. That assumption was significantly wrong.

The VPN point is worth pausing on because I think a lot of people myself included have a somewhat inflated sense of what a VPN actually does for privacy. A VPN changes your IP address. That’s real and it’s useful for certain things. But your IP address is one data point among hundreds. Changing it while keeping everything else the same is a bit like wearing a hat to avoid being recognized. It might fool someone at a distance. It doesn’t fool a system that’s looking at your gait, your height, your specific shoes, the way you hold your phone, and the particular scratch on your watch. The hat doesn’t move the needle on any of those other identifiers.

The thing that genuinely unsettled me when I started actually reading about this was canvas fingerprinting specifically. Canvas is an HTML element that’s used to render graphics in the browser. When a website uses canvas fingerprinting which is invisible to you, you never see it happening it instructs your browser to draw a hidden image. The image itself isn’t important. What’s important is how your specific combination of graphics hardware, browser, operating system, and installed fonts renders that image. The result is subtly different for different systems, consistently different, in ways that can be used to distinguish your browser from others.

You never see this happen. There’s no notification. There’s no permission request. Your browser just quietly draws a hidden image and the result gets logged as part of your fingerprint. I found this specifically disconcerting not because the data point itself is alarming but because of what it represents: a tracking mechanism that operates entirely outside your awareness and entirely outside the controls you might think you have.

WebGL fingerprinting works similarly but through the 3D rendering capabilities of your graphics card. If canvas fingerprinting is using your browser as a slightly unique pen, WebGL fingerprinting is using your graphics card as a slightly unique paintbrush. The output varies based on your specific hardware in ways that are consistent enough to serve as an identifier. Again, invisible, automatic, outside your control.

The font fingerprinting piece is the one I find most conceptually interesting, which is strange because it sounds the most mundane. Your computer has a specific set of fonts installed on it. This set is determined by your operating system, your installed applications, any fonts you’ve manually installed over the years, and various other factors. Websites can query which fonts you have installed. The resulting list not just which fonts but the specific combination of which fonts is surprisingly distinctive. Two people on otherwise identical computers who have installed different software over the years will have meaningfully different font lists. That difference is measurable and usable as a tracking signal.

I went through a phase after learning all of this where I became slightly paranoid about it in ways that probably weren’t productive. I started noticing when ads seemed to follow me across websites and wondering exactly how they were doing it. I downloaded browser extensions that claimed to help. I read forum discussions that sent me down rabbit holes about privacy tools that ranged from genuinely useful to completely overkill for someone with normal threat concerns.

What I eventually landed on was a more nuanced position than either “incognito mode is fine or the only solution is to go completely off-grid online.

The honest reality is that most people are not being individually targeted by sophisticated actors who are specifically trying to identify them. What’s happening is more systematic and less personal than that advertising networks building profiles based on behavior patterns, analytics systems understanding aggregate user behavior, fraud detection systems checking whether the person claiming to be you is actually you. Some of this tracking is genuinely useful to you as a user, even if the mechanism is invisible and the data collection is broader than you’d ideally choose.

That said, having a clearer understanding of what’s actually happening puts you in a better position to make informed choices about it rather than operating on assumptions that turn out to be incorrect.

The most straightforward thing most people can do that actually helps not incognito mode, which primarily protects your local history is use a browser designed with fingerprint resistance as a priority. Firefox, with appropriate privacy settings configured, does meaningfully better than Chrome on fingerprint resistance. The Brave browser was built with fingerprinting specifically in mind and applies active randomization to many of the fingerprint signals that would otherwise be consistent across sessions. These aren’t perfect solutions and they create their own tradeoffs, but they’re meaningful steps that don’t require dramatic lifestyle changes.

Browser extensions that block JavaScript can significantly reduce what fingerprinting information a website can collect, though they also break a lot of website functionality in ways that become annoying quickly. I tried running a strict JavaScript blocker for about two weeks and spent a significant portion of that time troubleshooting why various websites weren’t loading correctly. It was more friction than I was willing to maintain long-term.

What I actually do now, which feels like a reasonable practical compromise rather than either extreme: I use Firefox as my primary browser with the privacy settings configured more carefully than the defaults, I use a separate browser for things I actually care about keeping separated from my general browsing profile, and I’m more conscious than I used to be about which sites I’m logged into while browsing. None of this makes me invisible. It makes me somewhat less legible than I was before, which feels like an appropriate response to a threat model that’s real but not existential.

The thing I keep coming back to from that original conversation is the specific feeling of having an assumption corrected that I’d been carrying around confidently for years. I thought I understood how tracking worked well enough. I didn’t understand how tracking worked at all I understood a simplified version that was accurate for an earlier period of the internet and had become significantly outdated.

That’s not an unusual situation. The internet evolves faster than most people’s mental models of how it works, and the gap between “what I think is happening when I go online” and “what is actually happening when I go online” is wider than most people would be comfortable with if they looked at it directly.

I’m not trying to make you paranoid about it. I went through that phase and it wasn’t useful. But I do think understanding what’s actually happening is more valuable than the comfortable but inaccurate assumption that incognito mode and occasional VPN use means you’re browsing privately. You’re not browsing privately. You’re browsing with varying degrees of pseudonymity, and understanding that distinction changes how you think about what you’re doing and what choices you have.

The advertising person who corrected my assumption two years ago probably didn’t expect that conversation to change how I think about using the internet. It did. I’m telling you what he told me, with all the additional reading I’ve done since, in the hope that it lands for you the way it landed for me.

It’s a lot to absorb. But it’s better to know than not to know.