I don't actually know how much this happens - software versioning is the biggest one. Chrome updates every two weeks, Microsoft updates once a month, your GPU drivers get updated semi regularly, etc. Any one of those would break the fingerprint.

Your IP changes way less often so that combined with everything else would be more than enough to track you through browser version changes. Even a new IP with the exact same everything else would be pretty easy to correlate too. It just depends on how much they're willing to track and companies are often willing to track a lot already, including things like how fast you type, what kind of movements your mouse makes, etc.

Most people probably have completely default fonts, right? Doesn't seem like much of an identifier anyway

Depending on the browser new fonts can be downloaded and installed automatically. I'd bet most people have a lot more than just the default fonts that came with their OS installed.

Automatically installed fonts don't give much of a signal if they are automatically installed on everyone's machines.

A small list of websites that install their custom fonts can cause you to picked out of a crowd even when other things (like your IP) change. The centralization of the internet probably helps a bit here, but I'm guessing that most people go to smaller websites at least occasionally rather than just spending all their time on a handful of social media sites.

Hm, what if each site install its own custom font to intentionally track users across websites?

don't give them ideas!

You could generate a font per user and bam. Damn, is that really it?

Yeah, it sounds too easy, so wonder if I'm missing something. Weird how the site can even tell what fonts you have.

Hmm. I used to have to do that a lot, but I haven't in a few years now.

Perhaps, but that would also mean the cardinality is lower.