There are a whole BUNCH of other ways available. In practice, no single thing is even close to 100% accurate, but once you have enough distinct indicators you c

There are a whole BUNCH of other ways available. In practice, no single thing is even close to 100% accurate, but once you have enough distinct indicators you can fingerprint to a pretty high level of accuracy (for many advertisers 80% accuracy is enough, and it's probably not worth spending lots of effort to go above 90%). Clock skew, for example, is slightly different on each device, but on a given device doesn't change that quickly. Mouse/finger movement patterns, TLS negotiation timings, etc, etc. There are even technologies able to track users across different devices, but it's been too long since I worked in this area to be able to speak confidently about the methods used to implement that.