I worked on designing tracking scripts for six months (fortunately they aren't in production). Flash cookies aren't a very useful tracking mechanism anymore, mainly because Google and other browsers now clear Flash cookies when you clear your regular cookies. Fingerprinting was very difficult to pull off in practice: even with canvas fingerprinting, font enumeration, plugin enumeration, etc. etc. most mobile phones are indistinguishable, and even when you find devices with unique fingerprints (usually because of the unique set of plugins installed) it's difficult to be certain the new device you've seen is the same as the old device unless they are coming from the same ip address.<p>Now, the one mechanism that was very effective was ETag tracking. When you request a picture or other asset from a website, the website can send you an etag id which is supposed to signify the picture's version. When the client revisits the page, the client sends back the etag to confirm the version cached is the same as the version on the server. The security leak is that the etag protocol allows arbitrary text to be set as an etag, so to set an etag cookie all you have to do is place a 1x1 pixel on each page with a random GUID, and when the user revisits the page the browser will resend the tracking etag in its request for the 1x1 tracking pixel. This works for browsers with cookies disabled, and will remain when cookies are cleared. The only way to clear it is to clear all browsing history entirely, including cached images.