A common investigative technique in law enforcement is to collect fingerprints at the scene of a crime. At the time of collection, it's not known who those fingerprints belong to, so the goal is wholesale collection for later analysis. Those fingerprints are later matched against a database of fingerprints with known owners to identify specific people.

Browser fingerprinting works in the same way: the wholesale collection of as many browser identification points as possible at a website that can then be later matched against the browser characteristics of known people. In both types of fingerprinting, analysis may not reveal the identify of a person but can still show that the same person performed different activities.

Most privacy enthusiasts are aware that the primary way in which they can be identified online is through the use of their IP address. TCP/IP, the protocol suite that the internet uses, necessarily requires that your IP address be sent with every request in order for the web server to know where to send the response.

Virtual Private Networks (VPNs) have become popular over the past few years as a way to hide your real IP address by borrowing an IP address from your VPN provider that is shared by many people. This effectively hides your real IP address. Traffic in the web server's log simply shows the VPNs IP address. But what else does your browser send that a VPN cannot scrub out? Much of that depends on your browser configuration, but some of it simply cannot be helped. Correlating the data in your browser's requests can allow someone to identify you, even if you're using a VPN.