The difficult bit is that your browser is programmable and browsers are different across vendors, devices and releases. This means whatever a bad guy can think

The difficult bit is that your browser is programmable and browsers are different across vendors, devices and releases. This means whatever a bad guy can think of as a test can be sent back over the wire, and you can't realistically block sites from sending data back to servers. So long as there are different browsers etc, there will be tests that can differentiate between them. Currently canvas fingerprinting [1] is a popular option, but there's quite a lot of options for that next thing you can use. Even generic code execution time could be used to an extent. Realistically there is hope at the end of the tunnel, but it's a very long way to go given just how complex of a corner we've painted ourselves into with modern web standards. While it wouldn't stop purely malicious actors, I personally think it might be easier to address the whole situation on the legislation side rather than with technology. Imagine GDPR, except tracking would be illegal altogether: there will always be actors who will work to bypass it, but the majority would do their best to conform, lest they want to go bust with fines. [1] https://en.wikipedia.org/wiki/Canvas_fingerprinting https://en.wikipedia.org/wiki/Canvas_fingerprinting