WIth pure HTML/CSS, no JS required, you can still mine at least:
- fonts installed
- pointer type (mouse/touchscreen)
- inner screen size (via @media queries)
- mouse movements!
Examples:
GitHub - OliverBrotchie/CSS-Fingerprint: Pure CSS device fingerprinting.
Also mentioned in the filters of quBO. Yes, CSS is also a vector.
This one doesn’t work without JS - a Catch 22.
In the future, JS will likely become less-and-less essential for tracking, and thinking that by disabling JS you thwart these attempts is just wishful thinking.
I can’t predict the future. As of today, JS’s capabilities are bigger.
I personally use Tor Browser often, and am surprised how well most websites behave without JS, even cookie notices can be interactively clicked on, and even ads often load, which was rarely the case some years ago. This further solidifies my belief that disabling JS doesn’t really do all that much to prevent tracking.
You can do some generic testing in https://coveryourtracks.eff.org.