A nice heuristic: treat cookies differently depending on whether you've browsed to their domain. Browser fingerprint tech is mature though. https://twitter.com/TheRegister/status/909787320907386881