Yeah, and there are some excellent fingerprinting testing sites that show it that even from a single website visit you can be narrowed down substantially, and from there a few more visits to sites working together and they could easily pin you down to an exact person. The discussion about malicious actors is insane, even legitimate ones can do it easily.