The Visitor Who Cannot Disappear: Identity That Survives Cookie Wipes, Incognito, and VPNs

In most analytics tools, a visitor disappears the moment they want to. Clear cookies, and they are reborn as a new person. Open an incognito window, and they are a stranger. Switch from Chrome to Safari, and the history resets. Turn on a VPN, and the location lies. Every one of those moves quietly shreds your data, and you end up reporting five visitors where there was one.

That fragility is not a law of nature. It is a side effect of building identity on the one thing the browser is designed to throw away: a client side cookie set by a script. First-party data done properly does not rely on that single fragile slot, which is why the usual evasions stop working.

Identity in layers, not one cookie

The reason a cookie clear erases a visitor elsewhere is that the cookie was the only copy of who they were. OakData does not keep one copy. A visitor's durable identity is mirrored across several independent stores at once:

• localStorage, the obvious one most tools use.
• A first-party cookie on your root domain, written always, not just as a fallback.
• IndexedDB, read before anything is written, so a surviving id wins after a partial wipe.

On every load these stores re-sync with each other. Clearing one, or even most, does not lose the visitor, because the others restore the id and re-mirror it everywhere. A person has to wipe all of them, in the same browser, at the same time, to even reach the next line of defense. Casual cookie clearing, the move most privacy advice stops at, accomplishes nothing.

Known users are deterministic

Storage tricks only matter while a visitor is anonymous. The moment someone signs in, you call oak.identify(userId) and their activity binds to an account you already have. This is the strong, deterministic tier: it is not a guess, it is your own user id.

From there, the cross device problem solves itself. Someone who browses on a phone and buys on a laptop is one person the instant they are identified on both, and their earlier anonymous sessions stitch onto the account too. The path from first anonymous visit to paying customer stays in one piece, which is also what makes a multi session funnel actually trustworthy instead of a pile of fragments.

The device itself is the fallback

Now the harder case. A visitor wipes everything, or arrives in a fresh incognito window with no storage at all, or opens a different browser entirely. Cookies and local storage give you nothing. This is where most tools surrender.

It is also where the device gives itself away. The same physical machine produces a recognizable signature regardless of which browser or window is asking, and OakData reads it in tiers:

• A CPU tier derived from floating point math behavior. Cross browser stable, low entropy on its own.
• A GPU tiercomputed from the hardware's own output. High entropy, and the same across Chrome, Safari, and an incognito window on that device.
• A combined full reading scored with a confidence level.

Incognito clears storage. It does not change the silicon. Switching browsers changes the user agent. It does not change the GPU. So the anonymous "new" visitor who is really a returning one gets recognized as the same device, and their threads get pulled back together.

Why a VPN does nothing

People reach for a VPN expecting to vanish. Against first-party identity it is the weakest move of all, because none of the identity above is built on the IP address.

A VPN changes where your traffic appears to originate. That is a fact about the network, not about the person or the machine. Your durable id still lives in three stores. Your account is still your account once you log in. Your device still produces the same hardware signature. We treat IP as context, a soft hint about network and rough location, never as the thing that decides who you are, precisely because it is so easy to change and so often shared. Flipping on a VPN moves a dot on a map and leaves identity completely intact.

Ad blockers miss what looks like your own site

The last common evasion is the ad blocker, and it fails for a structural reason we covered in first-party vs third-party analytics. Blocklists target known third-party tracker domains. First-party collection happens under your own domain and looks like part of your own site, so the blockers that erase competing tools sail right past it. The result is coverage that holds where third-party tags would have gone dark.

Honest about the edges

None of this is magic, and pretending it is would set you up to trust the wrong number. The fingerprint tiers are a strong probabilistic signal, not a permanent serial number, and we treat them that way:

• It drifts over years. Driver and OS updates move the GPU reading; the stable CPU tier collides across identical hardware. That is exactly why durable storage plus oak.identify() carry the load and fingerprint is the fallback, not the foundation.
• Identical models collide. Two people on the same MacBook model can share a GPU reading, so OakData scores every link as certain, likely, uncertain, or a model level collision, and refuses to merge across device classes (an iPhone and a Mac sharing Apple silicon output are not one person).
• You stay in control. Ambiguous matches land in a review queue you confirm or dismiss, and those decisions are honored at read time without rewriting a single event.

The point is not that a visitor can never be anonymous. It is that the casual, everyday evasions, the cleared cookie, the incognito tab, the second browser, the VPN, the ad blocker, do not quietly corrupt your numbers the way they do everywhere else. Stack durable storage, deterministic identity, and a device fallback, and one person stays one person.

OakData mirrors identity across storage, binds it to real accounts with oak.identify(), and falls back to a tiered device fingerprint, so cookie wipes, incognito, browser switches, VPNs, and ad blockers stop turning one visitor into five.