Browser tracking has moved from cookies into your hardware

Browser tracking no longer ends when you clear your cookies. It has moved into audio hardware, graphics chips, and Bluetooth radio waves — and the rules designed to stop it were written for a simpler era.

The Headphones That Stopped Answering Your Phone

Your phone rings. You are sitting at your desk, headphones on, listening to nothing in particular while a browser tab sits open in the background. The headphones do not switch. The call goes to your phone's own speaker, or to voicemail, while the headphones remain stubbornly attached to the laptop that is doing absolutely nothing audible. You have probably blamed the headphones. The real culprit is a shopping website you opened an hour ago and forgot about.

Here is what is actually happening. When you load the AliExpress homepage, two JavaScript files, collina.js and fireyejs.js, quietly build what is called an AudioContext inside your browser. An AudioContext is the browser's internal wiring to your sound hardware. These scripts connect that wiring into a zero-gain audio graph, a processing chain that produces no sound whatsoever but sits there actively occupying the desktop audio path. Your browser holds the connection open even when you mute the tab.

That occupied audio path is the problem. Modern Bluetooth headphones use a feature called multipoint, which lets them maintain live connections to two devices simultaneously, say a laptop and a phone. The protocol works beautifully as long as the laptop's audio path is idle. When it is not, the headphones see an active signal and do not release their grip to answer the secondary device. A tracking script written to fingerprint your browser hardware ends up, as a side effect, physically preventing your headphones from answering a phone call.

The fingerprinting itself works because every audio card processes signals with tiny manufacturing variances. Those variances produce a measurable, stable signature. AliExpress reads that signature to identify your browser without touching a single cookie.

The fix is unglamorous but it works. Installing uBlock Origin and blocking collina.js and fireyejs.js removes the hidden AudioContext entirely. Most people who discover this report their headphones started behaving normally within minutes. A browser tab was holding your hardware hostage, and a filter list was the key.

The Great Cookie Reprieve

For roughly five years, the advertising industry held its breath. Google had promised to kill the third-party cookie, that small persistent file that lets a tracker on one website recognize you on a thousand others. Deadlines slipped. Then, in April 2025, Google simply stopped. The phase-out was abandoned. The cookie would live.

The retreat did not happen quietly. Google had built an entire alternative architecture called Privacy Sandbox, a suite of browser APIs designed to let advertisers target users without exposing their individual identities. The central ideas — Topics, which classified your browsing interests inside the browser itself, and Attribution Reporting, which measured ad conversions without cross-site identifiers — were genuinely novel engineering. The industry largely ignored them. Advertisers saw too much measurement loss; publishers saw revenue risk; the UK Competition and Markets Authority raised concerns that the whole system would entrench Google's own ad business at competitors' expense. On October 17, 2025, Google retired the majority of Privacy Sandbox APIs. The experiment was over.

Here is what filled the vacuum. Trackers did not wait for a replacement to be handed to them. They had already been building one. The Electronic Frontier Foundation, auditing the web's most visited destinations in April 2026, found browser fingerprinting running on 78 percent of the top ten thousand sites. Fingerprinting does not use a file you can delete. It reads the specific, hardware-linked quirks of your machine — the way your audio card rounds a number, the way your GPU draws a curve — and assembles them into an identifier that follows you without asking permission and survives every cleared cache. The policy failure did not reduce tracking. It pushed it deeper into the machine.

When Browser Tracking Makes Your Hardware Your Identity

Cookies can be cleared. Browser history can be wiped. But the particular way your graphics card hesitates — for a fraction of a millisecond — when compiling a shader program? That is not going anywhere.

This is the territory WebGPU has opened up for trackers. Every GPU has minute manufacturing variances: microscopic differences in how it handles sub-pixel rendering, tiny timing irregularities in how it processes shader compilation. Scripts can measure these, combine them, and produce a signature so specific to your physical hardware that WebGPU-based identification achieves over 92% accuracy across sessions, regardless of whether you have cleared your cache, switched browsers, or opened a private window. The signal does not live in software. It lives in silicon.

The same logic applies one layer down, in the encrypted handshake your device makes before any website loads. TLS fingerprinting, specifically a method called JA4, identifies a machine by the unique pattern of how it initiates a secure connection: which cipher suites it proposes, in what order, with what extensions. Every operating system and browser combination produces a slightly different handshake. That pattern, too, is a hardware-and-software composite that persists across sessions.

Here is the practical consequence. A cookie is a note someone left on your desk. You can throw it away. A hardware fingerprint is your handwriting. You cannot change your handwriting by deleting files. The only way to present a genuinely different identity to these systems is to use a genuinely different machine.

None of this requires any consent banner. None of it triggers the cookie policies that privacy regulations spent a decade designing. The tracking simply moved somewhere the rules hadn't thought to look.

The only way to present a genuinely different identity to these systems is to use a genuinely different machine.

Ten Centimeters: The New Precision of Bluetooth

Picture a department store at midday. Shoes squeak on polished tile. Someone is testing a perfume near the entrance. And somewhere above the ceiling panels, a small radio device is noting, with centimeter-level confidence, that you have stopped walking and are now standing in front of the winter coats.

That device runs Bluetooth 6.0, released by the Bluetooth Special Interest Group in September 2024. The specification introduced a feature called Channel Sounding, and its core technique is Phase-Based Ranging — PBR. Instead of guessing distance from how loud a signal arrives (the older Received Signal Strength Indicator method, which is essentially asking "how far away is that shout?"), PBR analyzes the phase of the radio wave itself. Phase is the timing of the wave's oscillation cycle. When two Bluetooth devices exchange signals at multiple frequencies and compare how the phase has shifted across each, they can calculate the distance between them with a precision of 10 to 30 centimeters.

For comparison, the best previous methods managed 3 to 5 meters on a good day, in an empty room, with no interfering signals. That is the difference between knowing someone is "probably in the kitchenware aisle" and knowing they have been standing in front of the same saucepan for ninety seconds.

Here is the strange part. The privacy response that came before this — MAC address randomization, where a phone rotates its hardware identifier to avoid being tracked across time — solves exactly the wrong problem. It addresses identity persistence. Channel Sounding does not care who you are. It cares, with considerable precision, where you are standing right now.

A Market That Already Knows Which Aisle You Are Standing In

The numbers tell you who is betting on this, and how much. The Bluetooth Low Energy indoor location market is projected to reach $11.8 billion by 2030 — roughly the GDP of Iceland, staked on the premise that knowing where someone stands inside a building is worth serious money. That is not a projection built on speculation. The infrastructure is already shipping.

Qualcomm's FastConnect 7900 platform is expected to handle 84% of Bluetooth 6.0 chipset volume in flagship Android phones for 2026. One company, one platform, most of the hardware. When a single silicon decision propagates that widely, the capability it carries — centimeter-level Channel Sounding — stops being optional and starts being ambient.

Compare this to the old RSSI approach, which estimated proximity the way a person estimates a stranger's distance in fog: plausibly, hopefully, wrongly. The new hardware does not estimate. It measures.

In March 2026, fleet management company Motive launched a Bluetooth beacon designed specifically to track heavy-duty equipment in real time. The use case is sensible, even admirable — knowing where a forty-tonne excavator is parked saves money and lives. The technology doing that tracking is structurally identical to the hardware mapping which clothes rack a shopper lingers beside. The beacon does not know the difference between a forklift and a person. The software reading it decides what counts.

The Slow Shield Against the Fast Tracker

Protection tends to arrive after the wound. In 2024, Apple and Google jointly released the Unknown Tracker Alerts standard, a shared protocol to warn users when an unfamiliar Bluetooth device follows their movement. It was a meaningful step. It was also, by design, aimed at rogue hardware — the tile-sized tag slipped into a bag, not the invisible script running in a browser tab.

That gap matters. WebAudio and WebGPU fingerprinting do not need a consent banner. They require no cookie dialog, no opt-in, no click. A tracker that operates below the threshold of user permission is also below the threshold of most regulation. The Electronic Frontier Foundation found device fingerprinting present on 78% of the top 10,000 websites as of April 2026. The scripts are not hiding. The rules simply have not caught up.

The pattern holds elsewhere. A 2026 study examined 3,360 child-facing YouTube videos and found that 45.5% lacked proper in-platform ad disclosure labels. Tracking capability and platform accountability are not racing neck and neck. One is a sports car; the other is walking.

The unanswered question sitting at the centre of browser tracking — and the Bluetooth hardware surveillance building alongside it — is whether browser vendors will impose hard limits on AudioContext or WebGPU access, knowing that doing so would also break legitimate applications built on the same APIs. That is not a rhetorical question. Nobody has answered it yet.