Fingerprinting survives cookie blocking, and one vendor selling it passed $50M in ARR

What happened

Browser fingerprinting combines measurements a browser hands over without any permission prompt: GPU model, CPU thread count, screen size, audio processing, time zone, language and installed fonts. Each reading is common on its own. Together they narrow a device to a pool small enough to single it out. Clearing cookies or opening incognito changes none of them.

A post on royfish.dev shows this on the page itself. Per the post, a script takes five measurements (audio rendering, WebGL, canvas drawing, Intl settings and navigator values), hashes them with SHA-256, and returns an animal nickname that stays the same after a refresh, a cookie wipe or a VPN switch. The post also explains the information theory behind it: each trait cuts the pool of candidates by some number of bits, and it cites a ZIP code, birth date and sex as enough to identify over 60% of Americans.

The post frames Google's moves as a three-step reversal. The record from other sources supports the outline:

Why it matters now

The UK ICO called Google's change irresponsible and said fingerprinting is not a fair way to track people because it reduces their choice and control. Per a DLA Piper summary, the regulator also said fingerprinting needs consent like any other tracking, including when it is used for fraud prevention. Google's policy now allows it. UK law still asks sites to get consent first.

Browser defenses split into two approaches, per the royfish.dev post. Brave adds small amounts of noise (the post calls it farbling) so the fingerprint changes between sessions. Tor and Mullvad Browser make every user look the same. The post names Brave, Tor and Mullvad Browser as the only major browsers with engine-level protection, and says privacy extensions can make a browser more unique because few people run them. That is the author's view, and the post gives no test data for it.

Who sells it

Fingerprint (formerly FingerprintJS Pro) is the main commercial vendor. Its open-source library has more than 28,000 GitHub stars and about 6.3 million monthly downloads, per Sacra, and the paid cloud service sits on top of it. Customers named in company releases include Dropbox, Glovo and Ramp.

On revenue, a Fingerprint technical lead posted on LinkedIn that the company passed $50 million in ARR, and Sacra estimates $50M in August 2026. Fingerprint's April 2025 release reported 175% revenue growth over two years and 50 new enterprise customers in its fiscal 2025, with no dollar figure. One data aggregator lists $15.4M in revenue and $33M raised. The $33M conflicts with the $77M in the company's own release, so that listing looks stale. No audited confirmation of the $50M exists.

What a small builder could make

These gaps are inferences from pricing and policy pages. No demand has been verified.

Pricing is the first gap. Fingerprint's free plan stops at 1,000 calls a month and its first paid plan costs $99. Sacra lists free-tier abuse at self-serve AI products as a target use case, and small apps with free tiers face the same abuse. A plan at $9 to $29 a month for apps with a few thousand daily visitors would sit below that entry price. cside already charges less per call, so price alone may not hold as an edge.

Consent is the second. The ICO says fingerprinting needs consent in the UK, and Google's change does not alter that. A package that pairs a device ID with a consent banner and a log of each visitor's choice would suit UK and EU sites that want fraud checks without the legal exposure. The searches did not check whether a vendor already bundles the two.

The defense side has independent products too. StealthHound, a Chrome and Edge extension that detects and blocks fingerprinting, launched on Product Hunt in January 2026. Its maker says it reached thousands of users and placed fourth for the day, and a startup directory lists 168 votes. No revenue figure was found. The royfish.dev post argues extensions protect less than engine-level browser defenses, which may cap what this model can charge.

The open-source FingerprintJS library covers the browser side. The royfish.dev post says professional systems keep a visitor's identity when a single trait changes, which suggests the matching logic on the server is where most of the build effort sits. That is an inference, not a measured cost.

What to watch

• The ICO issued draft guidance on storage and access technologies in December 2024, per DLA Piper. Whether it was finalized was not checked.
• Fingerprint's $50M ARR rests on an employee's post and a Sacra estimate. A company announcement or filing would settle it.
• The post's browser rankings come with no test data. The EFF's Cover Your Tracks tool, which the post recommends, shows how unique a given browser is.