Ayup. For those not in the know... it's a huge industry now, called Identity Resolution.

They use every available signal. A million browser fingerprinting signals. Which are much worse if you run JS. But even TLS fingerprints. Timings. How long does it take for your browser to fetch resources from these 20 domains. Canvas readbacks. A million things.

This was predicted when govs started to clamp down on cookies. Cookies were the easiest thing in the damn world to block or delete. After the ad and surveilence industry lost cookies for tracking they moved to less savory methods. Ones much much harder to block or deter. We didn't get rid of tracking with cookie-consent. Instead we made it unimaginably more powerful.