There are a variety of them. Cookies are obvious, but even if you block those, there are a variety of techniques to enable server-side super cookies, where you

There are a variety of them. Cookies are obvious, but even if you block those, there are a variety of techniques to enable server-side super cookies, where you are taking a fingerprint of the browser and storing the information on the server (e.g. https://amiunique.org/fp https://amiunique.org/fp). And that's not even counting stuff you can do with no cooperation from the user-agent at all. You can do a lot of deanonymization using IP blocks, time of day, and behavior analysis. I'm not an expert. There's a lot of stuff here that you can read about if you dig in to it. Personally, I don't believe that Google is doing much if any of this stuff, because I think they rightly believe that if it were discovered that they are, it would go poorly for them in the public sphere.