The Tracking Trick That Survives Incognito Mode, VPNs, and Clearing Your Cache

1. A Quick Question Before We Start

Quick question. When was the last time you thought about the tiny icon sitting next to your tab's title — the little logo that shows up before the page even finishes loading? Never, right? Nobody does. It's the most ignorable element on the entire internet. Which, it turns out, is exactly the point.

Back in 2021, researchers at the University of Illinois Chicago published a paper describing something that sounds almost too simple to work: a way to track a person across visits to a website using nothing but that ignored little icon, called a favicon. A developer named Jonas Strehle read the paper, built a working demo, and published it. He called it "supercookie," and the name undersells it a little, honestly, because a regular cookie has an off switch. This thing barely does.

2. What a Favicon Actually Is, Mechanically Speaking

Here's the boring technical setup, and it matters, so stick with it for a second. Browsers keep a separate storage bucket just for favicons — completely apart from your regular cache, your cookies, your browsing history, all of it. It's got its own name, the "favicon cache," or F-cache if you want to sound like you work in the field. The reason it exists on its own is speed, not privacy. Loading a tiny icon instantly, every single time, without re-downloading it, makes tabs feel snappier. Nobody designed this thinking about tracking. That's kind of the whole problem, actually — it was built for convenience, and convenience features have a nasty habit of becoming surveillance features by accident.

When your browser hits a page, it checks: do I already have this site's favicon sitting in my F-cache? If yes, it just displays what's already there — no request sent anywhere. If no, it asks the server for one. That single "did it ask, or didn't it" moment is the entire vulnerability. Everything else is just clever arithmetic built on top of it.

3. The Trick: Turning "Missing" Into an Identity

So here's where it gets genuinely clever, and I mean that as a compliment to whoever first thought of it, even though it's a privacy nightmare. Instead of serving one favicon, a site can serve a whole set of them — say, thirty-two different tiny icons, each tied to its own unique little sub-path on the site. Visit for the first time, and your browser, having none of these cached yet, requests every single one. The server notes that, and from that moment on, it deliberately makes sure only some of those thirty-two icons ever actually get cached in your browser going forward. Come back later, and here's the reveal: your browser only re-requests the icons that are missing. The ones it already has, it just uses silently, no request sent. The server watches which specific icons you did and didn't ask for again, and that exact pattern — this one present, that one missing, on and on across all thirty-two — becomes a unique binary fingerprint. Ones and zeros. A number. You, expressed as a sequence of tiny icons the site quietly decided to give you or withhold from you the first time you showed up.

4. Why This Survives the Stuff That Kills Regular Tracking

This is the part that should genuinely bother you a little. Every normal privacy habit you've been taught — clear your cookies, use a VPN, browse in incognito, run an ad blocker — leaves this method completely untouched. Not weakened. Untouched. Strehle's own research documentation states plainly that the identifier survives flushing the cache, closing the browser, restarting the operating system, using a VPN, and installing ad blockers. Researchers confirmed it even works inside incognito mode, for a reason that's almost funny once you hear it: incognito mode shares the same favicon cache as your regular browsing session. The one storage bucket nobody thought to wall off is the one doing all the identifying.

Compare that to a normal tracking cookie, which dies the instant you clear your browser data on purpose. This doesn't. It's not hiding from your privacy tools. It's just sitting somewhere your privacy tools were never built to look.

5. Who Actually Found This, and Why It Matters That It Was a Proof of Concept

Worth being straight about something here: this wasn't malware caught in the wild, secretly harvesting data from unsuspecting victims on some sketchy corner of the internet. It was academic security research, published openly, specifically to warn browser makers before anyone weaponized it at scale. Strehle's GitHub repository says as much directly — it exists for educational and demonstration purposes, meant to draw attention to the problem, not exploit it quietly. That's a meaningfully different story than most privacy scares you read about, and it's honestly the reason this technique got taken seriously by browser vendors instead of dismissed as theoretical noise.

6. Where Things Stand Now, and What You Can Actually Do

Here's the more reassuring update, and it deserves equal airtime to the scary part. Since this research went public, browser makers have started partitioning favicon caches by site — meaning a favicon cached while you're on one website gets stored separately from the "same" favicon cached while you're on a completely different one. A tracker sitting on multiple sites can no longer check the same shared bucket across all of them the way it originally could, which blunts the cross-site version of this attack considerably, even if the underlying caching quirk that makes single-site tracking possible hasn't vanished everywhere overnight.

Practically speaking, there's no single toggle labeled "disable favicon tracking" sitting in your settings menu, which is a little unsatisfying to admit. What actually helps:

• Keep your browser updated — the partitioning fixes browser makers have rolled out only protect you on versions that actually include them.
• Use a browser with strong tracker-blocking extensions, several of which have added filters specifically targeting known favicon-tracking domains.
• Don't treat "cleared my cookies" and "cleared everything trackable about me" as the same sentence — this whole story exists precisely because they aren't.
• If a site's behavior seems oddly tailored to you despite a fresh incognito session, remember the favicon cache is one of the quieter places that memory could be hiding.

The bigger lesson here goes beyond one clever exploit involving tiny icons. Every browser feature built purely for convenience — caching, autofill, prefetching, the list goes on — is also, whether anyone intended it or not, a potential place to hide a fingerprint. The favicon was never designed with any of this in mind. That's exactly why nobody saw it coming until somebody finally sat down and asked the one question everybody else had been too bored to ask: what else is this little icon quietly remembering about me?